Oracle Linux: CVE-2023-24998: ELSA-2023-6570: tomcat security and bug fix update (MODERATE) (Multiple Advisories)

Oracle Linux: CVE-2023-24998: ELSA-2023-6570:tomcat security and bug fix update (MODERATE) (Multiple Advisories)

Severity

7

CVSS

(AV:N/AC:L/Au:S/C:N/I:N/A:C)

Published

02/20/2023

Created

11/18/2023

Added

11/16/2023

Modified

11/28/2024

Description

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. A flaw was found in Apache Commons FileUpload, where it does not limit the number of parts being processed in a request. This issue may allow an attacker to use a malicious upload or series of uploads to trigger a denial of service. While Red Hat Satellite relies upon Apache Tomcat, it does not directly ship it. Tomcat is shipped with Red Hat Enterprise Linux and consumed by the Candlepin component of Satellite. Red Hat Satellite users are therefore advised to check the impact state of Red Hat Enterprise Linux, since any necessary fixes will be distributed through the platform.

Solution(s)

• oracle-linux-upgrade-tomcat
• oracle-linux-upgrade-tomcat-admin-webapps
• oracle-linux-upgrade-tomcat-docs-webapp
• oracle-linux-upgrade-tomcat-el-3-0-api
• oracle-linux-upgrade-tomcat-jsp-2-3-api
• oracle-linux-upgrade-tomcat-lib
• oracle-linux-upgrade-tomcat-servlet-4-0-api
• oracle-linux-upgrade-tomcat-webapps

References

• https://attackerkb.com/topics/cve-2023-24998
• CVE - 2023-24998
• ELSA-2023-6570
• ELSA-2023-7065