Debian dsa-5845 : libtomcat10-embed-java - security update

high Nessus Plugin ID 214338

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5845 advisory.

- ------------------------------------------------------------------------- Debian Security Advisory DSA-5845-1 [email protected] https://www.debian.org/security/ Markus Koschany January 17, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : tomcat10 CVE ID : CVE-2024-34750 CVE-2024-38286 CVE-2024-50379 CVE-2024-52316 CVE-2024-54677 CVE-2024-56337

Several problems have been addressed in Tomcat 10, a Java based web server, servlet and JSP engine which may lead to a denial-of-service.

CVE-2024-38286

Apache Tomcat, under certain configurations, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

CVE-2024-52316

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.

CVE-2024-50379 / CVE-2024-56337

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).
Some users may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat. For Debian 12 bookworm the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to false). Most Debian users will not be affected because Debian uses case sensitive file systems by default.

CVE-2024-34750

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.

CVE-2024-54677

Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.

For the stable distribution (bookworm), these problems have been fixed in version 10.1.34-0+deb12u1.

We recommend that you upgrade your tomcat10 packages.

For the detailed security status of tomcat10 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/tomcat10

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: [email protected]

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the libtomcat10-embed-java packages.

Plugin Details

Severity: High

ID: 214338

File Name: debian_DSA-5845.nasl

Version: 1.3

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 1/17/2025

Updated: 3/13/2025

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-52316

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2024-38286

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:libtomcat10-embed-java, p-cpe:/a:debian:debian_linux:libtomcat10-java, p-cpe:/a:debian:debian_linux:tomcat10, p-cpe:/a:debian:debian_linux:tomcat10-admin, p-cpe:/a:debian:debian_linux:tomcat10-common, p-cpe:/a:debian:debian_linux:tomcat10-docs, p-cpe:/a:debian:debian_linux:tomcat10-examples, p-cpe:/a:debian:debian_linux:tomcat10-user

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/17/2025

Vulnerability Publication Date: 6/19/2024

Reference Information

CVE: CVE-2024-34750, CVE-2024-38286, CVE-2024-50379, CVE-2024-52316, CVE-2024-54677, CVE-2024-56337

IAVA: 2024-A-0393-S, 2024-A-0589-S, 2024-A-0754-S, 2024-A-0822-S

Detections

Analytics