AIKIDO-2024-10008
tomcat-embed-core is vulnerable to DOS
75
High Risk
This Affects:
tomcat-embed-coreTL;DR
Affected versions of this package are vulnerable to a Denial of Service (DoS) attack if the Tomcat server is configured to allow HTTP/2 requests.
Who does this affect?
You are affected if you use Tomcat (within the affected versions) to process HTTP/2 requests without a load balancer in front of it.
Background info
tomcat-embed-core is vulnerable to DOS in versions 10.0.0 - 10.1.18, 9.0.0 - 9.0.85 and 8.5.0 - 8.5.98.
How to fix this
Upgrade Tomcat to any of the patched versions.
Links
Other
lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvgopenwall.com/lists/oss-security/2024/03/13/3lists.debian.org/debian-lts-announce/2024/04/msg00001.htmllists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/security.netapp.com/advisory/ntap-20240402-0002/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.