tomcat security update

2024-01-2900:00:00

linux.oracle.com

tomcat

security update

http request smuggling

malformed trailer headers

cve-2023-46589

unix

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

6.9 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.1%

JSON

[1:9.0.62-27.3]

tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)

OSVersionArchitecturePackageVersionFilename
oracle linux8srctomcat< 9.0.62-27.el8_9.3tomcat-9.0.62-27.el8_9.3.src.rpm
oracle linux8noarchtomcat< 9.0.62-27.el8_9.3tomcat-9.0.62-27.el8_9.3.noarch.rpm
oracle linux8noarchtomcat-admin-webapps< 9.0.62-27.el8_9.3tomcat-admin-webapps-9.0.62-27.el8_9.3.noarch.rpm
oracle linux8noarchtomcat-docs-webapp< 9.0.62-27.el8_9.3tomcat-docs-webapp-9.0.62-27.el8_9.3.noarch.rpm
oracle linux8noarchtomcat-el-3.0-api< 9.0.62-27.el8_9.3tomcat-el-3.0-api-9.0.62-27.el8_9.3.noarch.rpm
oracle linux8noarchtomcat-jsp-2.3-api< 9.0.62-27.el8_9.3tomcat-jsp-2.3-api-9.0.62-27.el8_9.3.noarch.rpm
oracle linux8noarchtomcat-lib< 9.0.62-27.el8_9.3tomcat-lib-9.0.62-27.el8_9.3.noarch.rpm
oracle linux8noarchtomcat-servlet-4.0-api< 9.0.62-27.el8_9.3tomcat-servlet-4.0-api-9.0.62-27.el8_9.3.noarch.rpm
oracle linux8noarchtomcat-webapps< 9.0.62-27.el8_9.3tomcat-webapps-9.0.62-27.el8_9.3.noarch.rpm
oracle linux8srctomcat< 9.0.62-27.el8_9.3tomcat-9.0.62-27.el8_9.3.src.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	8	src	tomcat	< 9.0.62-27.el8_9.3	tomcat-9.0.62-27.el8_9.3.src.rpm
oracle linux	8	noarch	tomcat	< 9.0.62-27.el8_9.3	tomcat-9.0.62-27.el8_9.3.noarch.rpm
oracle linux	8	noarch	tomcat-admin-webapps	< 9.0.62-27.el8_9.3	tomcat-admin-webapps-9.0.62-27.el8_9.3.noarch.rpm
oracle linux	8	noarch	tomcat-docs-webapp	< 9.0.62-27.el8_9.3	tomcat-docs-webapp-9.0.62-27.el8_9.3.noarch.rpm
oracle linux	8	noarch	tomcat-el-3.0-api	< 9.0.62-27.el8_9.3	tomcat-el-3.0-api-9.0.62-27.el8_9.3.noarch.rpm
oracle linux	8	noarch	tomcat-jsp-2.3-api	< 9.0.62-27.el8_9.3	tomcat-jsp-2.3-api-9.0.62-27.el8_9.3.noarch.rpm
oracle linux	8	noarch	tomcat-lib	< 9.0.62-27.el8_9.3	tomcat-lib-9.0.62-27.el8_9.3.noarch.rpm
oracle linux	8	noarch	tomcat-servlet-4.0-api	< 9.0.62-27.el8_9.3	tomcat-servlet-4.0-api-9.0.62-27.el8_9.3.noarch.rpm
oracle linux	8	noarch	tomcat-webapps	< 9.0.62-27.el8_9.3	tomcat-webapps-9.0.62-27.el8_9.3.noarch.rpm
oracle linux	8	src	tomcat	< 9.0.62-27.el8_9.3	tomcat-9.0.62-27.el8_9.3.src.rpm