Bug 2269608 (CVE-2024-23672) - CVE-2024-23672 Apache Tomcat: WebSocket DoS with incomplete closing handshake
Summary: CVE-2024-23672 Apache Tomcat: WebSocket DoS with incomplete closing handshake
Keywords:
Status: NEW
Alias: CVE-2024-23672
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2269612
Blocks: 2270596
TreeView+ depends on / blocked
 
Reported: 2024-03-14 21:00 UTC by Zack Miele
Modified: 2024-06-27 03:40 UTC (History)
7 users (show)

Fixed In Version: Apache Tomcat 11.0.0-M17, Apache Tomcat 10.1.19, Apache Tomcat 9.0.86, Apache Tomcat 8.5.99
Doc Type: If docs needed, set a value
Doc Text:
A denial of service (DoS) vulnerability present in the Apache Tomcat package arises from an incomplete cleanup process. Specifically, WebSocket clients can perpetuate WebSocket connections without proper termination, thereby causing a sustained drain on system resources. This vulnerability facilitates the exploitation of Apache Tomcat servers, leading to a scenario where excessive resource consumption occurs due to the prolonged existence of these open WebSocket connections. As a consequence, the server's performance may degrade significantly, resulting in potential service disruption or unresponsiveness.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:1913 0 None None None 2024-05-07 12:19:17 UTC
Red Hat Product Errata RHSA-2024:1914 0 None None None 2024-05-07 12:19:36 UTC
Red Hat Product Errata RHSA-2024:1916 0 None None None 2024-05-07 13:03:38 UTC
Red Hat Product Errata RHSA-2024:1917 0 None None None 2024-05-07 13:07:52 UTC
Red Hat Product Errata RHSA-2024:3307 0 None None None 2024-05-23 06:15:10 UTC
Red Hat Product Errata RHSA-2024:3308 0 None None None 2024-05-23 06:13:44 UTC
Red Hat Product Errata RHSA-2024:3666 0 None None None 2024-06-06 08:37:57 UTC
Red Hat Product Errata RHSA-2024:3814 0 None None None 2024-06-11 17:29:58 UTC

Description Zack Miele 2024-03-14 21:00:30 UTC 
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.

Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f
Comment 1 Zack Miele 2024-03-14 21:33:34 UTC 
Created tomcat tracking bugs for this issue:

Affects: fedora-all [bug 2269612]
Comment 4 errata-xmlrpc 2024-05-07 12:19:13 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 5.8 on RHEL 7
  Red Hat JBoss Web Server 5.8 on RHEL 8
  Red Hat JBoss Web Server 5.8 on RHEL 9

Via RHSA-2024:1913 https://access.redhat.com/errata/RHSA-2024:1913
Comment 5 errata-xmlrpc 2024-05-07 12:19:34 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2024:1914 https://access.redhat.com/errata/RHSA-2024:1914
Comment 6 errata-xmlrpc 2024-05-07 13:03:36 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 6.0 on RHEL 8
  Red Hat JBoss Web Server 6.0 on RHEL 9

Via RHSA-2024:1916 https://access.redhat.com/errata/RHSA-2024:1916
Comment 7 errata-xmlrpc 2024-05-07 13:07:51 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2024:1917 https://access.redhat.com/errata/RHSA-2024:1917
Comment 9 errata-xmlrpc 2024-05-23 06:13:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:3308 https://access.redhat.com/errata/RHSA-2024:3308
Comment 10 errata-xmlrpc 2024-05-23 06:15:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:3307 https://access.redhat.com/errata/RHSA-2024:3307
Comment 12 Ben 2024-05-31 15:37:09 UTC 
Is there a fix coming for Red Hat Enterprise Linux 8, please?
Comment 13 errata-xmlrpc 2024-06-06 08:37:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:3666 https://access.redhat.com/errata/RHSA-2024:3666
Comment 14 errata-xmlrpc 2024-06-11 17:29:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:3814 https://access.redhat.com/errata/RHSA-2024:3814
Note You need to log in before you can comment on or make changes to this bug.