Detections
Analytics

Debian DLA-3617-1 : tomcat9 - LTS security update

medium Nessus Plugin ID 183089

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3617 advisory.

 - Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. (CVE-2023-24998)

 - URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. The vulnerability is limited to the ROOT (default) web application. (CVE-2023-41080)

 - Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
 (CVE-2023-42795)

 - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

 - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue. (CVE-2023-45648)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the tomcat9 packages.

For Debian 10 buster, these problems have been fixed in version 9.0.31-1~deb10u9.

See Also

https://security-tracker.debian.org/tracker/source-package/tomcat9

https://www.debian.org/lts/security/2023/dla-3617

https://security-tracker.debian.org/tracker/CVE-2023-24998

https://security-tracker.debian.org/tracker/CVE-2023-41080

https://security-tracker.debian.org/tracker/CVE-2023-42795

https://security-tracker.debian.org/tracker/CVE-2023-44487

https://security-tracker.debian.org/tracker/CVE-2023-45648

https://packages.debian.org/source/buster/tomcat9

Plugin Details

Severity: Medium

ID: 183089

File Name: debian_DLA-3617.nasl

Version: 1.2

Type: local

Agent: unix

Published: 10/14/2023

Updated: 2/9/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2023-41080

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:tomcat9-docs, p-cpe:/a:debian:debian_linux:tomcat9-admin, p-cpe:/a:debian:debian_linux:libtomcat9-java, cpe:/o:debian:debian_linux:10.0, p-cpe:/a:debian:debian_linux:tomcat9, p-cpe:/a:debian:debian_linux:tomcat9-user, p-cpe:/a:debian:debian_linux:libtomcat9-embed-java, p-cpe:/a:debian:debian_linux:tomcat9-examples, p-cpe:/a:debian:debian_linux:tomcat9-common

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/13/2023

Vulnerability Publication Date: 2/20/2023

CISA Known Exploited Vulnerability Due Dates: 10/31/2023

Reference Information

CVE: CVE-2023-24998, CVE-2023-41080, CVE-2023-42795, CVE-2023-44487, CVE-2023-45648

IAVA: 2023-A-0112-S, 2023-A-0443-S, 2023-A-0534-S