Resource management error in Apache Tomcat - CVE-2024-34750

Vulnerability identifier: #VU93732

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-34750

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when handling HTTP/2 stream. A remote attacker can initiate multiple HTTP/2 connections to the server that are remain open and perform a denial of service (DoS) attack.

Apache Tomcat
Confluence Server
JBoss Enterprise Web Server
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Server
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Web and Scripting Module
openSUSE Leap
Ubuntu
openEuler
IBM Cloud Pak for Security
Crowd Data Center
IBM Sterling Partner Engagement Manager
IBM UrbanCode Release
Confluence Data Center
Oracle Financial Services Model Management and Governance
Oracle Communications Diameter Signaling Router
Bitbucket Data Center
Oracle SD-WAN Edge
Bamboo Server
Jira Software Data Center
Management Cloud Engine
Oracle Communications EAGLE Element Management System
IBM Maximo Application Suite - AI Broker
IBM Process Mining
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM Rational Build Forge
IBM Power Hardware Management Console (HMC)
EMC NetWorker Server
IBM Edge Application Manager
Crowd Server
Oracle Utilities Testing Accelerator
Cloudera Data Platform Private Cloud Base for IBM
Oracle Managed File Transfer
Oracle Agile Engineering Data Management
DevOps
IBM Business Automation Manager Open Editions
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
Integration Bus for z/OS
webMethods developer portal
Oracle Communications User Data Repository
Storage Resource Manager
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
Storage Protect Plus Server
NetWorker Management Console (NMC)
IBM Qradar SIEM
Jira Software Server
Juniper Secure Analytics (JSA)
QRadar Suite
IBM Security SOAR
Bitbucket Server
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
tomcat10 (Ubuntu package)
tomcat-el-3_0-api
tomcat-webapps
tomcat-jsp-2_3-api
tomcat-javadoc
tomcat
tomcat-admin-webapps
tomcat-servlet-4_0-api
tomcat-docs-webapp
tomcat-lib
tomcat-servlet-4.0-api
tomcat-el-3.0-api
tomcat-jsp-2.3-api
tomcat (Red Hat package)
jws5-tomcat (Red Hat package)
tomcat-jsvc
tomcat-embed
tomcat-help
tomcat10-embed
tomcat10-admin-webapps
tomcat10-servlet-6_0-api
tomcat10
tomcat10-lib
tomcat10-docs-webapp
tomcat10-jsp-3_1-api
tomcat10-jsvc
tomcat10-webapps
tomcat10-el-5_0-api
tomcat10-doc
tomcat10 (Debian package)
Oracle Commerce Guided Search
Oracle Hospitality Cruise Shipboard Property Management System
watsonx.data
Dell EMC Storage Monitoring and Reporting (SMR)

Install updates from vendor's website.

Apache Tomcat - addressed in versions 9.0.90, 10.1.25, 11.0.0-M21
Crowd Server - addressed in versions 5.1.13, 5.2.9, 5.3.5, 6.0.3, 6.1.1
Crowd Data Center - addressed in versions 5.1.13, 5.2.9, 5.3.5, 6.0.3, 6.1.1
Oracle Utilities Testing Accelerator - update to 6.0.0.3.1
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
DevOps - update to 7.0.0.3
IBM Qradar SIEM - update to 7.5.0 Update Pack 9 IF02
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
Confluence Server - addressed in versions 7.19.26, 8.5.14, 8.9.5, 9.0.1
Confluence Data Center - addressed in versions 7.19.26, 8.5.14, 8.9.5, 9.0.1
IBM Business Automation Manager Open Editions - update to 8.0.8
Bitbucket Data Center - addressed in versions 8.9.18, 8.19.7
Bitbucket Server - update to 8.9.18
Bamboo Server - addressed in versions 9.2.17, 9.6.4, 10.0.0
Jira Software Server - addressed in versions 9.4.25, 9.12.12, 9.17.1
Jira Software Data Center - addressed in versions 9.4.25, 9.12.12, 9.17.1
webMethods developer portal - update to 11.1.6
IBM Maximo Application Suite - AI Broker - update to 1.0.1
QRadar Suite - update to 1.10.26.0
IBM Process Mining - update to 1.15.0 IF001
watsonx.data - update to 2.0.3
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
Storage Resource Manager - update to 5.0.2.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.2.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.3
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.1
watsonx Assistant Cartridge - update to 5.1.3
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
JBoss Enterprise Web Server - update to 5.8.1
Dell Secure Connect Gateway - update to 5.26.00.18
IBM Rational Build Forge - update to 8.0.0.27
tomcat10 (Ubuntu package) - addressed in versions 8.5.39-1ubuntu1~18.04.3+esm5, 9.0.16-3ubuntu0.18.04.2+esm7, 9.0.31-1ubuntu0.9+esm2, 9.0.58-1ubuntu0.2+esm3, 9.0.70-2ubuntu0.1+esm2, 9.0.70-2ubuntu1.24.10.2, 9.0.70-2ubuntu1.25.04.2, 10.1.16-1ubuntu0.1~esm2
tomcat-el-3_0-api - addressed in versions 9.0.36-3.127.1, 9.0.91-150200.68.1
tomcat-webapps - addressed in versions 9.0.36-3.127.1, 9.0.91-150200.68.1
tomcat-jsp-2_3-api - addressed in versions 9.0.36-3.127.1, 9.0.91-150200.68.1
tomcat-javadoc - addressed in versions 9.0.36-3.127.1, 9.0.91-150200.68.1
tomcat - addressed in versions 9.0.36-3.127.1, 9.0.91-150200.68.1
tomcat-admin-webapps - addressed in versions 9.0.36-3.127.1, 9.0.91-150200.68.1
tomcat-servlet-4_0-api - addressed in versions 9.0.36-3.127.1, 9.0.91-150200.68.1
tomcat-docs-webapp - addressed in versions 9.0.36-3.127.1, 9.0.91-150200.68.1
tomcat-lib - addressed in versions 9.0.36-3.127.1, 9.0.91-150200.68.1
tomcat-servlet-4.0-api - update to 9.0.87-1
tomcat-lib - update to 9.0.87-1
tomcat-webapps - update to 9.0.87-1
tomcat - update to 9.0.87-1
tomcat-admin-webapps - update to 9.0.87-1
tomcat-docs-webapp - update to 9.0.87-1
tomcat-el-3.0-api - update to 9.0.87-1
tomcat-jsp-2.3-api - update to 9.0.87-1
tomcat (Red Hat package) - addressed in versions 9.0.87-1.el8_8.3, 9.0.87-1.el8_10.2, 9.0.87-1.el9_2.2, 9.0.87-1.el9_4.2
jws5-tomcat (Red Hat package) - addressed in versions 9.0.87-5.redhat_00005.1.el7jws, 9.0.87-5.redhat_00005.1.el8jws, 9.0.87-5.redhat_00005.1.el9jws
tomcat-jsvc - update to 9.0.91-150200.68.1
tomcat-embed - update to 9.0.91-150200.68.1
tomcat-jsvc - addressed in versions 9.0.96-1, 9.0.96-2
tomcat - addressed in versions 9.0.96-1, 9.0.96-2
tomcat-help - addressed in versions 9.0.96-1, 9.0.96-2
Storage Protect Plus Server - update to 10.1.18
tomcat10-embed - update to 10.1.25-150200.5.25.1
tomcat10-admin-webapps - update to 10.1.25-150200.5.25.1
tomcat10-servlet-6_0-api - update to 10.1.25-150200.5.25.1
tomcat10 - update to 10.1.25-150200.5.25.1
tomcat10-lib - update to 10.1.25-150200.5.25.1
tomcat10-docs-webapp - update to 10.1.25-150200.5.25.1
tomcat10-jsp-3_1-api - update to 10.1.25-150200.5.25.1
tomcat10-jsvc - update to 10.1.25-150200.5.25.1
tomcat10-webapps - update to 10.1.25-150200.5.25.1
tomcat10-el-5_0-api - update to 10.1.25-150200.5.25.1
tomcat10-doc - update to 10.1.25-150200.5.25.1
tomcat10 (Debian package) - update to 10.1.34-0+deb12u1
IBM Power Hardware Management Console (HMC) - addressed in versions 10.2.1040.0 SP2, 10.3.1060.0
NetWorker Management Console (NMC) - update to 19.10.0.5
EMC NetWorker Server - update to 19.10.0.5
IBM Security SOAR - update to 51.0.3.0

• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.90
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.25
• https://lists.apache.org/thread/hmw3txqzzbc1yp2t5cg4dsws0n92ly0f

• Denial of service in Apache Tomcat
• SUSE update for tomcat10
• SUSE update for tomcat
• SUSE update for tomcat
• Jira Software Data Center and Server update for tomcat-coyote
• Red Hat Enterprise Linux 9 update for tomcat
• Red Hat Enterprise Linux 8 update for tomcat
• Red Hat Enterprise Linux 8 update for tomcat
• Red Hat Enterprise Linux 9 update for tomcat
• Confluence Data Center and Server update for tomcat-coyote
• Denial of service in Red Hat JBoss Web Server
• Resource management error in IBM Maximo Application Suite - AI Broker
• Multiple vulnerabilities in IBM Qradar SIEM
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Resource management error in IBM Power HMC
• Resource management error in IBM Security SOAR
• Resource management error in IBM Integration Bus for z/OS
• Multiple vulnerabilities in IBM Process Mining
• Bamboo Data Center and Server update for tomcat-coyote
• Bitbucket Data Center and Server update for tomcat-embed-core
• Resource management error in IBM DevOps Release
• IBM watsonx.data update for Apache Tomcat
• IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for Apache Tomcat
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Rational Build Forge
• Multiple vulnerabilities in Oracle Communications User Data Repository
• Multiple vulnerabilities in Management Cloud Engine
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Oracle Hospitality Cruise Shipboard Property Management System
• Multiple vulnerabilities in Dell NetWorker And NetWorker Management Console
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• openEuler 22.03 LTS SP4 update for tomcat
• openEuler 22.03 LTS SP1 update for tomcat
• openEuler 20.03 LTS SP4 update for tomcat
• openEuler 22.03 LTS SP3 update for tomcat
• Crowd Data Center update for Tomcat
• openEuler 24.03 LTS update for tomcat
• IBM Watson Assistant for IBM Cloud Pak for Data update for Apache Tomcat
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Debian update for tomcat10
• Resource management error in Oracle Communications EAGLE Element Management System
• Multiple vulnerabilities in Oracle SD-WAN Edge
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router
• Multiple vulnerabilities in Oracle Agile Engineering Data Management
• Multiple vulnerabilities in Oracle Utilities Testing Accelerator
• Resource management error in Oracle Managed File Transfer
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• Anolis OS update for tomcat
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge update for Apache Tomcat
• Ubuntu update for tomcat10
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM webMethods developer portal
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition
• Multiple vulnerabilities in IBM Storage Protect Plus Server
• Multiple vulnerabilities in IBM Cloudera Data Platform Private Cloud Base with IBM (CDP)
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition