Security Bulletin: [All] Apache Tomcat (core only) - CVE-2023-42795 (Publicly disclosed vulnerability)

Summary

Apache Tomcat is used by Power Hardware Management Console (HMC). HMC has addressed the applicable CVE.

Vulnerability Details

CVEID:CVE-2023-42795
**DESCRIPTION:**Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by an incomplete Cleanup vulnerability when recycling various internal objects. By skipping some parts of the recycling process, an attacker could exploit this vulnerability to obtain sensitive information leaking from the current request/response to the next.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268201 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

The following fixes are available on IBM Fix Central at: <http://www-933.ibm.com/support/fixcentral/&gt;

Product

|

VRMF

|

APAR

|

Remediation/Fix

—|—|—|—

Power HMC

|

V10.1.1020.0 SP3 x86

|

MB04436

|

MF71508

Power HMC

|

V10.1.1020.0 SP3 ppc

|

MB04437

|

MF71509

Power HMC

|

V10.2.1040.0 SP1 x86

|

MB04429

|

MF71408

Power HMC

|

V10.2.1040.0 SP1 ppc

|

MB04430

|

MF71409

Power HMC

|

V10.3.1050.0 x86

|

MB04433

|

MF71421

Power HMC

|

V10.3.1050.0 ppc

|

MB04434

|

MF71422

Workarounds and Mitigations

None