Resource exhaustion in Apache Tomcat - CVE-2024-38286

Vulnerability identifier: #VU97652

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-38286

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources during the TLS handshake process. A remote attacker can initiate multiple TLS connections, trigger memory exhaustion and perform a denial of service (DoS) attack.

Apache Tomcat
Debian Linux
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
Crowd Data Center
IBM UrbanCode Release
IBM Sterling Partner Engagement Manager
IBM Rational Build Forge
Bitbucket Data Center
IBM Process Mining
IBM Watson Discovery for IBM Cloud Pak for Data
UCD - IBM UrbanCode Deploy
Crowd Server
DevOps
IBM Business Automation Manager Open Editions
CICS Transaction Gateway for Multiplatforms
CICS Transaction Gateway Desktop Edition
webMethods developer portal
Storage Copy Data Management
DevOps Deploy
Integration Bus for z/OS
Storage Protect Plus Server
Cloudera Data Platform Private Cloud Base for IBM
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
tomcat10 (Ubuntu package)
tomcat-javadoc
tomcat-el-3_0-api
tomcat-servlet-4_0-api
tomcat-docs-webapp
tomcat
tomcat-lib
tomcat-webapps
tomcat-admin-webapps
tomcat-jsp-2_3-api
pki-servlet-engine (Red Hat package)
tomcat-servlet-4.0-api
tomcat-jsp-2.3-api
tomcat-el-3.0-api
tomcat10 (Debian package)
Bitbucket Server
SAP Commerce Cloud
IBM Qradar SIEM

Install updates from vendor's website.

Apache Tomcat - addressed in versions 9.0.90, 10.1.25, 11.0.0-M21
Crowd Data Center - addressed in versions 5.3.5, 6.0.3
Crowd Server - addressed in versions 5.3.5, 6.0.3
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
DevOps - update to 7.0.0.4
IBM Business Automation Manager Open Editions - update to 8.0.8
IBM Rational Build Forge - update to 8.0.0.28
Bitbucket Data Center - update to 8.19.26
Bitbucket Server - update to 8.19.26
webMethods developer portal - update to 11.1.6
IBM Process Mining - update to 1.15.0 IF004
Storage Copy Data Management - update to 2.2.26.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
UCD - IBM UrbanCode Deploy - addressed in versions 7.0.5.24, 7.1.2.20, 7.2.3.13, 7.3.2.8
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF01
DevOps Deploy - update to 8.0.1.3
tomcat10 (Ubuntu package) - addressed in versions 8.5.39-1ubuntu1~18.04.3+esm5, 9.0.16-3ubuntu0.18.04.2+esm7, 9.0.31-1ubuntu0.9+esm2, 9.0.58-1ubuntu0.2+esm3, 9.0.70-2ubuntu0.1+esm2, 9.0.70-2ubuntu1.24.10.2, 9.0.70-2ubuntu1.25.04.2, 10.1.16-1ubuntu0.1~esm2
tomcat-javadoc - update to 9.0.36-3.130.1
tomcat-el-3_0-api - update to 9.0.36-3.130.1
tomcat-servlet-4_0-api - update to 9.0.36-3.130.1
tomcat-docs-webapp - update to 9.0.36-3.130.1
tomcat - update to 9.0.36-3.130.1
tomcat-lib - update to 9.0.36-3.130.1
tomcat-webapps - update to 9.0.36-3.130.1
tomcat-admin-webapps - update to 9.0.36-3.130.1
tomcat-jsp-2_3-api - update to 9.0.36-3.130.1
pki-servlet-engine (Red Hat package) - addressed in versions 9.0.43-4.el9_0.1, 9.0.50-1.el9_2.1
tomcat - update to 9.0.87-1
tomcat-webapps - update to 9.0.87-1
tomcat-servlet-4.0-api - update to 9.0.87-1
tomcat-lib - update to 9.0.87-1
tomcat-jsp-2.3-api - update to 9.0.87-1
tomcat-el-3.0-api - update to 9.0.87-1
tomcat-docs-webapp - update to 9.0.87-1
tomcat-admin-webapps - update to 9.0.87-1
Integration Bus for z/OS - update to 10.1.0.5
Storage Protect Plus Server - update to 10.1.18
tomcat10 (Debian package) - update to 10.1.34-0+deb12u1

• https://lists.apache.org/thread/bk6k97ps0mcdw7nv6c1rpoyh8kn9cj93

• Denial of service in Apache Tomcat
• SUSE update for tomcat
• Red Hat Enterprise Linux 9 update for pki-servlet-engine
• Red Hat Enterprise Linux 8 update for the pki-deps:10.6 module
• Red Hat Enterprise Linux 9 update for pki-servlet-engine
• Red Hat Enterprise Linux 8 update for the pki-core:10.6 and pki-deps:10.6 module
• Red Hat Enterprise Linux 8 update for the pki-deps:10.6 module
• Red Hat Enterprise Linux 8 update for the pki-deps:10.6 module
• Multiple vulnerabilities in IBM QRadar SIEM
• Crowd Data Center and Server update for tomcat-coyote
• Multiple vulnerabilities in IBM Process Mining
• IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) update for Apache Tomcat
• IBM Integration Bus for z/OS update for Apache Tomcat
• Debian update for tomcat10
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• SAP Commerce Cloud update for Apache Tomcat
• Anolis OS update for tomcat
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Ubuntu update for tomcat10
• Multiple vulnerabilities in IBM DevOps Release
• Multiple vulnerabilities in IBM Rational Build Forge
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM webMethods developer portal
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition
• Bitbucket Data Center and Server update for org.apache.tomcat.embed:tomcat-embed-core
• Multiple vulnerabilities in IBM Storage Protect Plus Server
• Multiple vulnerabilities in IBM Cloudera Data Platform Private Cloud Base with IBM (CDP)
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition