CVE-2024-38286

Опубликовано: 07 нояб. 2024

Источник: nvd

CVSS3: 8.6

CVSS3: 7.5

EPSS Низкий

Описание

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. Older, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.

Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

Ссылки

https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s
Mailing List
http://www.openwall.com/lists/oss-security/2024/09/23/2
Mailing List
https://security.netapp.com/advisory/ntap-20241101-0010/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия от 9.0.13 (включая) до 9.0.90 (исключая)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия от 10.1.1 (включая) до 10.1.25 (исключая)

cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*

EPSS

Процентиль: 71%

0.00693

Низкий

8.6 High

CVSS3

7.5 High

CVSS3

Дефекты

CWE-770

Связанные уязвимости

CVE-2024-38286

CVSS3: 8.6

ubuntu

7 месяцев назад

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. Older, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

CVE-2024-38286

CVSS3: 7.5

redhat

9 месяцев назад

CVE-2024-38286

CVSS3: 8.6

debian

7 месяцев назад

Allocation of Resources Without Limits or Throttling vulnerability in ...

SUSE-SU-2024:3510-1

suse-cvrf

9 месяцев назад

Security update for tomcat

GHSA-7jqf-v358-p8g7

CVSS3: 8.6

github

7 месяцев назад

Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability

EPSS

Процентиль: 71%

0.00693

Низкий

8.6 High

CVSS3

7.5 High

CVSS3

Дефекты

CWE-770