Lucene search
AlmaLinuxALSA-2023:5929HistoryOct 19, 2023 - 12:00 a.m.
Important: tomcat security update
2023-10-1900:00:00
errata.almalinux.org
20
tomcat
servlet container
java servlet
javaserver pages
security update
http/2
ddos attack
cve-2023-44487
cvss score
references
unix
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.816
Percentile
98.4%
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
- HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| almalinux | 9 | noarch | tomcat-docs-webapp | < 9.0.62-11.el9_2.3 | tomcat-docs-webapp-9.0.62-11.el9_2.3.noarch.rpm |
| almalinux | 9 | noarch | tomcat-lib | < 9.0.62-11.el9_2.3 | tomcat-lib-9.0.62-11.el9_2.3.noarch.rpm |
| almalinux | 9 | noarch | tomcat | < 9.0.62-11.el9_2.3 | tomcat-9.0.62-11.el9_2.3.noarch.rpm |
| almalinux | 9 | noarch | tomcat-webapps | < 9.0.62-11.el9_2.3 | tomcat-webapps-9.0.62-11.el9_2.3.noarch.rpm |
| almalinux | 9 | noarch | tomcat-jsp-2.3-api | < 9.0.62-11.el9_2.3 | tomcat-jsp-2.3-api-9.0.62-11.el9_2.3.noarch.rpm |
| almalinux | 9 | noarch | tomcat-admin-webapps | < 9.0.62-11.el9_2.3 | tomcat-admin-webapps-9.0.62-11.el9_2.3.noarch.rpm |
| almalinux | 9 | noarch | tomcat-servlet-4.0-api | < 9.0.62-11.el9_2.3 | tomcat-servlet-4.0-api-9.0.62-11.el9_2.3.noarch.rpm |
| almalinux | 9 | noarch | tomcat-el-3.0-api | < 9.0.62-11.el9_2.3 | tomcat-el-3.0-api-9.0.62-11.el9_2.3.noarch.rpm |
Related
github
github
HTTP/2 Stream Cancellation Attack
2023-10-10 21:28:24
redhat
redhat
(RHSA-2023:5716) Important: Red Hat Data Grid 8.4.5 security update
2023-10-16 14:21:45
(RHSA-2023:5768) Important: nghttp2 security update
2023-10-17 08:51:22
(RHSA-2023:5769) Important: nghttp2 security update
2023-10-17 08:52:38
nessus
nessus
Amazon Linux 2 : nghttp2 (ALAS-2023-2312)
2023-10-17 00:00:00
RHEL 9 : nodejs (RHSA-2023:5765)
2023-10-17 00:00:00
Oracle Linux 8 : nginx:1.20 (ELSA-2023-5712)
2023-10-17 00:00:00
almalinux
almalinux
Important: dotnet6.0 security update
2023-10-16 00:00:00
Important: nghttp2 security update
2023-10-18 00:00:00
Important: varnish security update
2023-10-19 00:00:00
amazon
amazon
Important: nghttp2
2023-10-16 13:45:00
veracode
veracode
Denial Of Service (DoS)
2023-10-12 14:37:40
rocky
rocky
nodejs security update
2023-10-24 18:36:46
varnish security update
2023-10-24 18:36:42
varnish security update
2023-10-24 18:35:47
fedora
fedora
[SECURITY] Fedora 38 Update: fbthrift-2023.10.16.00-1.fc38
2023-10-24 01:23:49
[SECURITY] Fedora 38 Update: wangle-2023.10.16.00-1.fc38
2023-10-24 01:23:49
[SECURITY] Fedora 39 Update: proxygen-2023.10.16.00-1.fc39
2023-11-03 19:01:54
osv
osv
h2o - security update
2023-10-29 00:00:00
kubernetes1.28-apiserver-1.28.13-2.1 on GA media
2024-08-29 00:00:00
BIT-nginx-ingress-controller-2023-44487
2024-07-26 07:28:26
ibm
ibm
cbl_mariner
cbl_mariner
CVE-2023-44487 affecting package moby-containerd-cc for versions less than 1.7.1-5
2024-02-09 19:07:07
CVE-2023-44487 affecting package vitess for versions less than 16.0.2-5
2024-02-09 19:07:07
CVE-2023-44487 affecting package terraform for versions less than 1.3.2-11
2024-02-09 19:07:07
redos
redos
ROS-20231107-01
2023-11-07 00:00:00
atlassian
atlassian
oraclelinux
oraclelinux
.NET 7.0 security update
2023-10-18 00:00:00
nghttp2 security update
2023-10-19 00:00:00
nodejs:16 security update
2023-10-20 00:00:00
githubexploit
githubexploit
Exploit for Uncontrolled Resource Consumption in Ietf Http
2023-12-11 23:12:03
debian
debian
[SECURITY] [DLA 3617-2] tomcat9 regression update
2023-10-16 22:23:23
[SECURITY] [DLA 3638-1] h2o security update
2023-10-31 14:09:23
openvas
openvas
Huawei EulerOS: Security Advisory for nghttp2 (EulerOS-SA-2024-1092)
2024-01-09 00:00:00
Huawei EulerOS: Security Advisory for nghttp2 (EulerOS-SA-2024-1365)
2024-03-14 00:00:00
openSUSE: Security Advisory for netty, netty (SUSE-SU-2023:4163-1)
2024-03-04 00:00:00
cnvd
cnvd
F5 BIG-IP Denial of Service Vulnerability (CNVD-2023-75597)
2023-10-11 00:00:00
wolfi
wolfi
CVE-2023-44487 vulnerabilities
2024-09-21 03:21:11
cgr
cgr
CVE-2023-44487 vulnerabilities
2024-05-19 03:07:16
talosblog
talosblog
impervablog
impervablog
HTTP/2 Rapid Reset Mitigation With Imperva WAF
2024-01-03 14:21:45
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.816
Percentile
98.4%
Related for ALSA-2023:5929