- 88/2024
- High
Apache has released security updates to address two vulnerabilities affecting multiple versions of Apache Tomcat.
The addressed vulnerabilities could allow the remote attacker to perform denial of service attacks by sending specially crafted WebSocket connections or HTTP/2 requests.
Sample of the addressed vulnerabilities:
Apache Tomcat Denial of Service Vulnerability (CVE-2024-23672):
- CVSS: 7.5
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Consequences: Denial of Service
The affected products:
- Apache Tomcat 11.0.0-M1 through 11.0.0-M16.
- Apache Tomcat 10.1.0-M1 through 10.1.18.
- Apache Tomcat 9.0.0-M1 through 9.0.85.
- Apache Tomcat 8.5.0 through 8.5.98.
Vulnerabilities
- CVE-2024-23672
- CVE-2024-24549
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.