[SECURITY] [DLA 3707-1] tomcat9 security update

2024-01-0509:40:41

lists.debian.org

request smuggling

improper input validation

http trailer headers

apache tomcat

debian 10 buster

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

7.8

Confidence

High

EPSS

0.005

Percentile

76.1%

JSON

Debian LTS Advisory DLA-3707-1 [email protected]
https://www.debian.org/lts/security/ Bastien RoucariÃ¨s
January 05, 2024 https://wiki.debian.org/LTS

Package : tomcat9
Version : 9.0.31-1~deb10u11
CVE ID : CVE-2023-46589
Debian Bug : 1057082

Apache Tomcat 9, a Servlet and JSP engine, was vulnerable.

An Improper Input Validation vulnerability was present.
and Tomcat did not correctly parse HTTP trailer headers.
A trailer header that exceeded the header size limit could cause
Tomcat to treat a single request as multiple requests leading to
the possibility of request smuggling when behind a reverse proxy.

For Debian 10 buster, this problem has been fixed in version
9.0.31-1~deb10u11.

We recommend that you upgrade your tomcat9 packages.

For the detailed security status of tomcat9 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tomcat9

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian12alltomcat10-admin< 10.1.6-1+deb12u2tomcat10-admin_10.1.6-1+deb12u2_all.deb
Debian10alltomcat9-examples< 9.0.31-1~deb10u11tomcat9-examples_9.0.31-1~deb10u11_all.deb
Debian11alltomcat9-examples< 9.0.43-2~deb11u10tomcat9-examples_9.0.43-2~deb11u10_all.deb
Debian11alltomcat9-docs< 9.0.43-2~deb11u10tomcat9-docs_9.0.43-2~deb11u10_all.deb
Debian11alltomcat9-common< 9.0.43-2~deb11u10tomcat9-common_9.0.43-2~deb11u10_all.deb
Debian12alltomcat10< 10.1.6-1+deb12u2tomcat10_10.1.6-1+deb12u2_all.deb
Debian12alllibtomcat10-java< 10.1.6-1+deb12u2libtomcat10-java_10.1.6-1+deb12u2_all.deb
Debian11alllibtomcat9-embed-java< 9.0.43-2~deb11u10libtomcat9-embed-java_9.0.43-2~deb11u10_all.deb
Debian10alltomcat9-docs< 9.0.31-1~deb10u11tomcat9-docs_9.0.31-1~deb10u11_all.deb
Debian12alltomcat10-user< 10.1.6-1+deb12u2tomcat10-user_10.1.6-1+deb12u2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	tomcat10-admin	< 10.1.6-1+deb12u2	tomcat10-admin_10.1.6-1+deb12u2_all.deb
Debian	10	all	tomcat9-examples	< 9.0.31-1~deb10u11	tomcat9-examples_9.0.31-1~deb10u11_all.deb
Debian	11	all	tomcat9-examples	< 9.0.43-2~deb11u10	tomcat9-examples_9.0.43-2~deb11u10_all.deb
Debian	11	all	tomcat9-docs	< 9.0.43-2~deb11u10	tomcat9-docs_9.0.43-2~deb11u10_all.deb
Debian	11	all	tomcat9-common	< 9.0.43-2~deb11u10	tomcat9-common_9.0.43-2~deb11u10_all.deb
Debian	12	all	tomcat10	< 10.1.6-1+deb12u2	tomcat10_10.1.6-1+deb12u2_all.deb
Debian	12	all	libtomcat10-java	< 10.1.6-1+deb12u2	libtomcat10-java_10.1.6-1+deb12u2_all.deb
Debian	11	all	libtomcat9-embed-java	< 9.0.43-2~deb11u10	libtomcat9-embed-java_9.0.43-2~deb11u10_all.deb
Debian	10	all	tomcat9-docs	< 9.0.31-1~deb10u11	tomcat9-docs_9.0.31-1~deb10u11_all.deb
Debian	12	all	tomcat10-user	< 10.1.6-1+deb12u2	tomcat10-user_10.1.6-1+deb12u2_all.deb