Begin forwarded message:From: Jennifer Oxelson Ganter <oxe...@ucar.edu>Subject: [thredds] Fwd: [SECURITY] CVE-2024-24549 Apache Tomcat - Denial of ServiceDate: March 13, 2024 at 9:18:45 AM PDTTo: THREDDS community <thr...@unidata.ucar.edu>_______________________________________________Hello all,Two new high-level CVEs were just issued for Tomcat (CVE-2024-24549 & CVE-2024-23672). Please make sure you are running the latest version.---------- Forwarded message ---------
From: Mark Thomas <ma...@apache.org>
Date: Wed, Mar 13, 2024 at 9:46 AM
Subject: [SECURITY] CVE-2024-24549 Apache Tomcat - Denial of Service
To: us...@tomcat.apache.org <us...@tomcat.apache.org>
Cc: <anno...@apache.org>, anno...@tomcat.apache.org <anno...@tomcat.apache.org>, Tomcat Developers List <d...@tomcat.apache.org>
CVE-2024-24549 Apache Tomcat - Denial of Service
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 11.0.0-M1 to 11.0.0-M16
Apache Tomcat 10.1.0-M1 to 10.1.18
Apache Tomcat 9.0.0-M1 to 9.0.85
Apache Tomcat 8.5.0 to 8.5.98
Description:
When processing an HTTP/2 request, if the request exceeded any of the
configured limits for headers, the associated HTTP/2 stream was not
reset until after all of the headers had been processed.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 11.0.0-M17 or later
- Upgrade to Apache Tomcat 10.1.19 or later
- Upgrade to Apache Tomcat 9.0.86 or later
- Upgrade to Apache Tomcat 8.5.99 or later
Credit:
This vulnerability was reported responsibly to the Tomcat security team
by Bartek Nowotarski (https://nowotarski.info/).
History:
2024-03-13 Original advisory
References:
[1] https://tomcat.apache.org/security-11.html
[2] https://tomcat.apache.org/security-10.html
[3] https://tomcat.apache.org/security-9.html
[4] https://tomcat.apache.org/security-8.html
--------------------------------------------------------------------------------------Jennifer Oxelson Ganter NSF UnidataSoftware Engineer IV P.O. Box 3000oxe...@ucar.edu Boulder, CO 80307------------------------------------------------------------------------------------
NOTE: All exchanges posted to Unidata maintained email lists are
recorded in the Unidata inquiry tracking system and made publicly
available through the web. Users who post to any of the lists we
maintain are reminded to remove any personal information that they
do not want to be made public.
thredds mailing list
thr...@unidata.ucar.edu
For list information or to unsubscribe, visit: https://www.unidata.ucar.edu/mailing_lists/