ELSA-2023-5928

Опубликовано: 24 окт. 2023

Источник: oracle-oval

Платформа: Oracle Linux 8

Описание

ELSA-2023-5928: tomcat security update (IMPORTANT)

[1:9.0.62-5.2]

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

Обновленные пакеты

Oracle Linux 8

Oracle Linux aarch64

tomcat

9.0.62-5.el8_8.2

tomcat-admin-webapps

9.0.62-5.el8_8.2

tomcat-docs-webapp

9.0.62-5.el8_8.2

tomcat-el-3.0-api

9.0.62-5.el8_8.2

tomcat-jsp-2.3-api

9.0.62-5.el8_8.2

tomcat-lib

9.0.62-5.el8_8.2

tomcat-servlet-4.0-api

9.0.62-5.el8_8.2

tomcat-webapps

9.0.62-5.el8_8.2

Oracle Linux x86_64

tomcat

9.0.62-5.el8_8.2

tomcat-admin-webapps

9.0.62-5.el8_8.2

tomcat-docs-webapp

9.0.62-5.el8_8.2

tomcat-el-3.0-api

9.0.62-5.el8_8.2

tomcat-jsp-2.3-api

9.0.62-5.el8_8.2

tomcat-lib

9.0.62-5.el8_8.2

tomcat-servlet-4.0-api

9.0.62-5.el8_8.2

tomcat-webapps

9.0.62-5.el8_8.2

Связанные CVE

CVE-2023-44487

Ссылки на источники

Связанные уязвимости

CVE-2023-44487

CVSS3: 7.5

ubuntu

больше 1 года назад

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVE-2023-44487

CVSS3: 7.5

redhat

больше 1 года назад

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVE-2023-44487

CVSS3: 7.5

nvd

больше 1 года назад

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVE-2023-44487

msrc

больше 1 года назад

MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack

CVE-2023-44487

CVSS3: 7.5

debian

больше 1 года назад

The HTTP/2 protocol allows a denial of service (server resource consum ...