ALT-PU-2025-13307: package tomcat10 update to version 10.1.20-alt2_jvm17.p10.1
Описание
This update upgrades tomcat10 to version 10.1.20-alt2_jvm17.p10.1.
Устраненные уязвимости20
Ссылки11
GHSA-3p2h-wqq4-wf4h
https://github.com/advisories/GHSA-3p2h-wqq4-wf4hGHSA-5j33-cvvr-w245
https://github.com/advisories/GHSA-5j33-cvvr-w245GHSA-653p-vg55-5652
https://github.com/advisories/GHSA-653p-vg55-5652GHSA-83qj-6fr2-vhqg
https://github.com/advisories/GHSA-83qj-6fr2-vhqgGHSA-ff77-26x5-69cr
https://github.com/advisories/GHSA-ff77-26x5-69crGHSA-h2fw-rfh5-95r3
https://github.com/advisories/GHSA-h2fw-rfh5-95r3GHSA-h3gc-qfqq-6h8f
https://github.com/advisories/GHSA-h3gc-qfqq-6h8fGHSA-vv7r-c36w-3prj
https://github.com/advisories/GHSA-vv7r-c36w-3prjGHSA-wm9w-rjj3-j356
https://github.com/advisories/GHSA-wm9w-rjj3-j356GHSA-xcpr-7mr4-h4xq
https://github.com/advisories/GHSA-xcpr-7mr4-h4xqСвязанные уязвимости
ALT-PU-2026-1576: package `tomcat10` update to version 10.1.47-alt0.1_jvm17.p11
ALT-PU-2025-1726: package `tomcat` update to version 9.0.98-alt1_1jpp11
ALT-PU-2025-2379: package `tomcat` update to version 9.0.98-alt0_1jpp17.p10.1
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.