Input validation error in Apache Tomcat - CVE-2024-24549

Vulnerability identifier: #VU87510

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-24549

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling HTTP/2 requests. A remote attacker can send specially crafted HTTP/2 requests to the server and perform a denial of service (DoS) attack.

Apache Tomcat
Confluence Server
JBoss Web Server
Amazon Linux AMI
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Web and Scripting Module
openSUSE Leap
Ubuntu
openEuler
Fedora
Oracle Solaris
Confluence Data Center
Crowd Data Center
IBM UrbanCode Release
IBM Rational Build Forge
Oracle Financial Services Model Management and Governance
Bitbucket Data Center
Bamboo Server
Oracle Communications Cloud Native Core Network Data Analytics Function
Oracle Communications EAGLE Element Management System
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM Power Hardware Management Console (HMC)
EMC NetWorker Server
FortiSandbox
Crowd Server
Communications Unified Assurance
DevOps
IBM Business Automation Manager Open Editions
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
webMethods developer portal
Oracle Communications User Data Repository
PowerProtect DP Series Appliance (IDPA)
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Storage Resource Manager
Storage Virtualize
Maximo Application Suite - Monitor Component
Integration Bus for z/OS
NetWorker Management Console (NMC)
Cloudera Data Platform Private Cloud Base for IBM
Oracle Managed File Transfer
FortiSwitch
Dell EMC VxRail Appliance
MySQL Enterprise Monitor
Bitbucket Server
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Tomcat
jws5-tomcat-native (Red Hat package)
tomcat10 (Ubuntu package)
tomcat8
tomcat-webapps
tomcat-admin-webapps
tomcat-jsp-2_3-api
tomcat-docs-webapp
tomcat-lib
tomcat-el-3_0-api
tomcat-servlet-4_0-api
tomcat
tomcat-javadoc
tomcat9 (Debian package)
jws5-tomcat (Red Hat package)
tomcat-el-3.0-api
tomcat-jsp-2.3-api
tomcat-servlet-4.0-api
tomcat9
tomcat (Red Hat package)
tomcat-jsvc
tomcat-help
tomcat10 (Debian package)
jws6-tomcat (Red Hat package)
tomcat10-lib
tomcat10-admin-webapps
tomcat10-el-5_0-api
tomcat10-webapps
tomcat10
tomcat10-servlet-6_0-api
tomcat10-embed
tomcat10-jsvc
tomcat10-jsp-3_1-api
tomcat10-docs-webapp
Oracle Agile PLM Framework
Oracle Autonomous Health Framework
Oracle Commerce Guided Search
Siebel CRM Integration
QRadar Suite
Dell EMC Storage Monitoring and Reporting (SMR)
IBM App Connect Professional
Operational Decision Manager
IBM Security Guardium

Install updates from vendor's website.

Apache Tomcat - addressed in versions 8.5.99, 9.0.86, 10.1.19, 11.0.0-M17
Confluence Data Center - addressed in versions 7.19.22, 8.5.9, 8.9.1
Confluence Server - addressed in versions 7.19.22, 8.5.9, 8.9.1
FortiSandbox - update to 4.4.6
Crowd Server - addressed in versions 5.1.9, 5.2.4
Crowd Data Center - addressed in versions 5.1.9, 5.2.4
Communications Unified Assurance - update to 6.0.5
JBoss Web Server - addressed in versions 5.7.8, 6.0.1
DevOps - update to 7.0.0.1
IBM UrbanCode Release - update to 7.0.0.1
FortiSwitch - update to 7.4.4
IBM Rational Build Forge - update to 8.0.0.26
IBM Business Automation Manager Open Editions - update to 8.0.8
Bitbucket Data Center - addressed in versions 8.9.12, 8.19.1, 9.0.0
Bitbucket Server - addressed in versions 8.9.12, 8.19.1, 9.0.0
Bamboo Server - addressed in versions 9.2.13, 9.5.3, 9.6.1
webMethods developer portal - update to 11.1.6
Tomcat - update to D.9.0.87.01
jws5-tomcat-native (Red Hat package) - addressed in versions 1.2.31-17.redhat_17.el7jws, 1.2.31-17.redhat_17.el8jws, 1.2.31-17.redhat_17.el9jws
QRadar Suite - update to 1.10.22.0
PowerProtect DP Series Appliance (IDPA) - update to 2.7.7
DB2 on Cloud Pak for Data - update to 4.8.5
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.5
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0
Storage Resource Manager - update to 5.0.1.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
Dell Secure Connect Gateway - update to 5.24.00.14
IBM App Connect Professional - update to 7.5.5.0.24
Dell EMC VxRail Appliance - update to 8.0.212
Storage Virtualize - addressed in versions 8.4.0.14, 8.5.0.12, 8.6.0.4, 8.7.0.0
tomcat10 (Ubuntu package) - addressed in versions 8.5.39-1ubuntu1~18.04.3+esm5, 9.0.16-3ubuntu0.18.04.2+esm7, 9.0.31-1ubuntu0.9+esm2, 9.0.58-1ubuntu0.2+esm3, 9.0.70-2ubuntu0.1+esm2, 9.0.70-2ubuntu1.24.10.2, 9.0.70-2ubuntu1.25.04.2, 10.1.16-1ubuntu0.1~esm2
tomcat8 - update to 8.5.99-1.97
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.9, 8.11.6
tomcat-webapps - update to 9.0.36-3.124.1
tomcat-admin-webapps - update to 9.0.36-3.124.1
tomcat-jsp-2_3-api - update to 9.0.36-3.124.1
tomcat-docs-webapp - update to 9.0.36-3.124.1
tomcat-lib - update to 9.0.36-3.124.1
tomcat-el-3_0-api - update to 9.0.36-3.124.1
tomcat-servlet-4_0-api - update to 9.0.36-3.124.1
tomcat - update to 9.0.36-3.124.1
tomcat-javadoc - update to 9.0.36-3.124.1
tomcat9 (Debian package) - update to 9.0.43-2~deb11u10
jws5-tomcat (Red Hat package) - addressed in versions 9.0.62-41.redhat_00020.1.el7jws, 9.0.62-41.redhat_00020.1.el8jws, 9.0.62-41.redhat_00020.1.el9jws
tomcat-admin-webapps - addressed in versions 9.0.86-1, 9.0.87-1
tomcat - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-docs-webapp - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-el-3.0-api - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-jsp-2.3-api - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-lib - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-servlet-4.0-api - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-webapps - addressed in versions 9.0.86-1, 9.0.87-1
tomcat9 - update to 9.0.87-1
tomcat (Red Hat package) - addressed in versions 9.0.87-1.el8_8.2, 9.0.87-1.el8_10.1, 9.0.87-1.el9_2.1, 9.0.87-1.el9_4.1
tomcat - addressed in versions 9.0.89-1.fc39, 9.0.89-1.fc40
tomcat-jsvc - addressed in versions 9.0.96-1, 9.0.96-2
tomcat-help - addressed in versions 9.0.96-1, 9.0.96-2
tomcat - addressed in versions 9.0.96-1, 9.0.96-2
Integration Bus for z/OS - update to 10.1.0.3
tomcat10 (Debian package) - update to 10.1.6-1+deb12u2
jws6-tomcat (Red Hat package) - addressed in versions 10.1.8-6.redhat_00013.1.el8jws, 10.1.8-6.redhat_00013.1.el9jws
tomcat10-lib - update to 10.1.20-150200.5.22.2
tomcat10-admin-webapps - update to 10.1.20-150200.5.22.2
tomcat10-el-5_0-api - update to 10.1.20-150200.5.22.2
tomcat10-webapps - update to 10.1.20-150200.5.22.2
tomcat10 - update to 10.1.20-150200.5.22.2
tomcat10-servlet-6_0-api - update to 10.1.20-150200.5.22.2
tomcat10-embed - update to 10.1.20-150200.5.22.2
tomcat10-jsvc - update to 10.1.20-150200.5.22.2
tomcat10-jsp-3_1-api - update to 10.1.20-150200.5.22.2
tomcat10-docs-webapp - update to 10.1.20-150200.5.22.2
IBM Power Hardware Management Console (HMC) - addressed in versions 10.1.1020.0 SP3, 10.2.1040.0 SP2, 10.3.1050.0 SP1
Oracle Solaris - addressed in versions 11.3 ESU 36.33, 11.4 SRU 68
IBM Security Guardium - update to 12.0 p6009
EMC NetWorker Server - update to 19.10.0.5
NetWorker Management Console (NMC) - update to 19.10.0.5

• Exploit #10987 - CVE-2024-24549 (December 13, 2024)
• Exploit #10326 - CVE-2024-24549 (August 9, 2024)

• https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg

• Multiple vulnerabilities in Apache Tomcat
• Multiple vulnerabilities in Red Hat JBoss Web Server 5.7
• Multiple vulnerabilities in Red Hat JBoss Web Server 6.0
• Multiple vulnerabilities in JBoss Enterprise Web Server 6 for RHEL 8 and 9
• Multiple vulnerabilities in IBM UrbanCode Release
• Multiple vulnerabilities in IBM DevOps
• Multiple vulnerabilities in IBM Rational Build Forge
• Multiple vulnerabilities in IBM Integration Bus for z/OS
• SUSE update for tomcat10
• SUSE update for tomcat
• Oracle Solaris update for thrid-party components
• Input validation error in IBM Power Hardware Management Console (HMC)
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in App connect professional
• Confluence Data Center and Server update for tomcat-coyote
• Fedora 39 update for tomcat
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Fedora 40 update for tomcat
• Red Hat Enterprise Linux 9 update for tomcat
• Red Hat Enterprise Linux 9.2 Extended Update Support update for tomcat
• Red Hat Enterprise Linux 8 update for tomcat
• Red Hat Enterprise Linux 8.8 Extended Update Support update for tomcat
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Amazon Linux AMI update for tomcat8
• Multiple vulnerabilities in IBM SAN Volume Controller, IBM Storwize, IBM Storage Virtualize and IBM FlashSystem products
• Debian update for tomcat10
• Debian update for tomcat9
• Input validation error in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Oracle Communications User Data Repository
• Multiple vulnerabilities in Oracle Communications EAGLE Element Management System
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Data Analytics Function
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in MySQL Enterprise Monitor
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Amazon Linux AMI update for tomcat9
• Input validation error in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Security Guardium
• HP-UX update for Tomcat
• Multiple vulnerabilities in Communications Unified Assurance
• Input validation error in Oracle Managed File Transfer
• Input validation error in Oracle Agile PLM Framework
• Input validation error in Siebel CRM Integration
• Multiple vulnerabilities in Dell NetWorker And NetWorker Management Console
• openEuler 22.03 LTS SP4 update for tomcat
• openEuler 22.03 LTS SP1 update for tomcat
• openEuler 20.03 LTS SP4 update for tomcat
• openEuler 22.03 LTS SP3 update for tomcat
• Crowd Data Center and Server update for tomcat-coyote
• Bitbucket Data Center and Server update for tomcat-embed-core
• Multiple HTTP/2 CONTINUATION frames vulnerabilities in FortiSandbox
• Multiple HTTP/2 CONTINUATION frames vulnerabilities in FortiSwitch
• openEuler 24.03 LTS update for tomcat
• Bamboo Data Center and Server update for Apache Tomcat
• Multiple vulnerabilities in Dell PowerProtect DP Series Appliance (IDPA)
• Anolis OS update for tomcat
• Anolis OS update for tomcat
• Input validation error in Oracle Autonomous Health Framework
• Ubuntu update for tomcat10
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM webMethods developer portal
• Multiple vulnerabilities in IBM Cloudera Data Platform Private Cloud Base with IBM (CDP)
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition