CVE-2023-42794

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)
• tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794)
• tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)
• tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

• tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)
• tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794)
• tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)
• tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Incomplete Cleanup vulnerability in Apache Tomcat.

The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full.

Other, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

• CVE-2023-42794: restore the finalize() method

• SECURITY UPDATE: Misc vulnerability fixes
  • CVE-2019-12418, CVE-2019-17563, CVE-2020-1935, CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-13943, CVE-2020-17527, CVE-2021-24122, CVE-2021-30639, CVE-2021-30640, CVE-2021-33037, CVE-2021-42340, CVE-2021-43980, CVE-2022-25762, CVE-2022-34305, CVE-2022-45143, CVE-2023-24998, CVE-2023-28709, CVE-2023-34981, CVE-2023-42794, CVE-2024-21733
• Update to 8.5.100
  • debian/rules, debian/libtomcat8-java.poms, debian/maven.rules, debian/tomcat8-common.links, debian/patches/0018-fix-manager-webapp.patch, debian/patches/0019-add-distribution-to-error-page.patch, debian/patches/0021-dont-test-unsupported-ciphers.patch, debian/patches/0101-skipping-tests-incompatible-with-firewall.patch: updated
  • debian/patches/0002-do-not-load-AJP13-connector-by-default.patch, debian/patches/0026-easymock4-compatibility.patch: removed as they were applied in upstream
  • CVE-2019-0221.patch, CVE-2019-10072-1.patch, CVE-2019-10072-2.patch, CVE-2022-42252.patch, CVE-2020-1938.patch, CVE-2021-25122.patch, CVE-2021-41079.patch, CVE-2022-29885.patch, CVE-2020-9484.patch, CVE-2021-25329-pre1.patch, CVE-2021-25329.patch, CVE-2022-23181.patch, CVE-2023-44487.patch, CVE-2023-46589-pre1.patch, CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch, CVE-2023-46589-pre4.patch, CVE-2023-46589.patch: removed because these CVEs were fixed in upstream
• Internal tests
  • debian/test_certs/*: updated from upstream branch 9.0.x, as the 8.0.x certs were expired

TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1.

Incomplete Cleanup vulnerability in Apache Tomcat.

The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full.

Other, EOL versions may also be affected.

Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

These are all security issues fixed in the tomcat-9.0.82-2.1 package on the GA media of openSUSE Tumbleweed.

This update for tomcat fixes the following issues:

Updated to Tomcat 9.0.85:

• CVE-2023-45648: Improve trailer header parsing (bsc#1216118).
• CVE-2023-42794: FileUpload: remove tmp files to avoid DoS on Windows (bsc#1216120).
• CVE-2023-42795: Improve handling of failures during recycle() methods (bsc#1216119).
• CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing (bsc#1217649)
• CVE-2024-22029: Fixed escalation to root from tomcat user via %post script. (bsc#1219208)

The following non-security issues were fixed:

• Fixed the file permissions for server.xml (bsc#1217768, bsc#1217402).

Find the full release notes at:

https://tomcat.apache.org/tomcat-9.0-doc/changelog.html