CVE-2024-23672

NameCVE-2024-23672
DescriptionDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3779-1, DSA-5665-1, DSA-5667-1, ELA-1071-1
Debian Bugs1066877

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tomcat10 (PTS)bookworm (security), bookworm10.1.6-1+deb12u2fixed
sid, trixie10.1.34-1fixed
tomcat7 (PTS)jessie, jessie (lts)7.0.56-3+really7.0.109-1+deb8u6vulnerable
stretch7.0.75-1vulnerable
tomcat8 (PTS)jessie, jessie (lts)8.0.14-1+deb8u28vulnerable
stretch (security)8.5.54-0+deb9u8vulnerable
stretch (lts), stretch8.5.54-0+deb9u15fixed
tomcat9 (PTS)buster (security), buster, buster (lts)9.0.31-1~deb10u12fixed
bullseye (security), bullseye9.0.43-2~deb11u10fixed
bookworm9.0.70-2fixed
sid, trixie9.0.95-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tomcat10sourcebookworm10.1.6-1+deb12u2DSA-5665-1
tomcat10source(unstable)10.1.20-11066877
tomcat7sourcestretch(unfixed)end-of-life
tomcat7source(unstable)(unfixed)
tomcat8sourcestretch8.5.54-0+deb9u15ELA-1071-1
tomcat8source(unstable)(unfixed)
tomcat9sourcebuster9.0.31-1~deb10u12DLA-3779-1
tomcat9sourcebullseye9.0.43-2~deb11u10DSA-5667-1
tomcat9source(unstable)9.0.70-2

Notes

https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f
https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501 (10.1.19)
https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068 (9.0.86)
Starting with 9.0.70-2 Tomcat9 no longer ships the server stack, using that as the fixed version
[jessie] - tomcat7 <no-dsa> (Minor issue)
[jessie] - tomcat8 <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems