Summary: | <www-servers/tomcat-{8.5.94,9.0.81,10.1.14}: Multiple vulnerabilities | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Hans de Graaff <graaff> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | CONFIRMED --- | ||
Severity: | minor | CC: | fordfrog, java |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | B3 [glsa?] | ||
Package list: | Runtime testing required: | --- | |
Bug Depends on: | 915578 | ||
Bug Blocks: | 915553 |
Description
Hans de Graaff
![]() ![]() The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=08e0500b7183d83fb1d6050f44895ef67d2f0eed commit 08e0500b7183d83fb1d6050f44895ef67d2f0eed Author: Miroslav Šulc <fordfrog@gentoo.org> AuthorDate: 2023-10-11 08:38:48 +0000 Commit: Miroslav Šulc <fordfrog@gentoo.org> CommitDate: 2023-10-11 08:38:59 +0000 www-servers/tomcat: dropped obsolete 8.5.93, 9.0.80 & 10.1.13 Bug: https://bugs.gentoo.org/915578 Bug: https://bugs.gentoo.org/915568 Signed-off-by: Miroslav Šulc <fordfrog@gentoo.org> www-servers/tomcat/Manifest | 7 -- www-servers/tomcat/tomcat-10.1.13.ebuild | 181 ------------------------------- www-servers/tomcat/tomcat-8.5.93.ebuild | 154 -------------------------- www-servers/tomcat/tomcat-9.0.80.ebuild | 180 ------------------------------ 4 files changed, 522 deletions(-) the tree is clean now, you can proceed. CVE-2023-42794 (https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82): Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. |