The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4017 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4017-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     January 17, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : tomcat9     Version        : 9.0.43-2~deb11u11     CVE ID         : CVE-2024-21733 CVE-2024-38286 CVE-2024-50379 CVE-2024-52316                      CVE-2024-56337

    Several problems have been addressed in Tomcat 9, a Java based web server,     servlet and JSP engine which may lead to a denial-of-service or the disclosure     of sensitive information.

    CVE-2024-21733

        Generation of Error Message Containing Sensitive Information vulnerability         in Apache Tomcat.

    CVE-2024-38286

        Apache Tomcat, under certain configurations, allows an attacker to cause an         OutOfMemoryError by abusing the TLS handshake process.

    CVE-2024-52316

        Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is         configured to use a custom Jakarta Authentication (formerly JASPIC)         ServerAuthContext component which may throw an exception during the         authentication process without explicitly setting an HTTP status to         indicate failure, the authentication may not fail, allowing the user to         bypass the authentication process. There are no known Jakarta         Authentication components that behave in this way.

    CVE-2024-50379 / CVE-2024-56337

        Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP         compilation in Apache Tomcat permits an RCE on case insensitive file         systems when the default servlet is enabled for write (non-default         configuration).
        Some users may need additional configuration to fully mitigate         CVE-2024-50379 depending on which version of Java they are using with         Tomcat. For Debian 11 bullseye the system property         sun.io.useCanonCaches must be explicitly set to false (it defaults to         true). Most Debian users will not be affected because Debian uses case         sensitive file systems by default.

    For Debian 11 bullseye, these problems have been fixed in version     9.0.43-2~deb11u11.

    We recommend that you upgrade your tomcat9 packages.

    For the detailed security status of tomcat9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tomcat9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-4017 : libtomcat9-embed-java - security update

medium Nessus Plugin ID 214321

Version 1.2

Version 1.1

Version 1.2 Mar 13, 2025, 9:08 PM IAVM reference Plugin Feed: 202503132108
Version 1.1 Jan 17, 2025, 6:12 PM New Plugin Feed: 202501171812