GHSA-jm7m-8jh6-29hp BIT-tomcat-2023-42794 CVE-2023-42794
Apache Tomcat Incomplete Cleanup vulnerability
- Severity
- 5.9 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 2.30%
- Chance of exploitation in the next 30 days. Higher than 83.33% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-459 Incomplete Cleanup
- Fix
9.0.81- Upgrade org.apache.tomcat:tomcat-coyote to this version or later
Description
Incomplete Cleanup vulnerability in Apache Tomcat.
The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full.
Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.tomcat:tomcat-coyote | >= 9.0.70, < 9.0.81 |
9.0.81 |
| org.apache.tomcat:tomcat-coyote | >= 8.5.85, < 8.5.94 |
8.5.94 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.tomcat:tomcat-coyote Maven → 9.0.81
- maven
<dependency><groupId>org.apache.tomcat</groupId><artifactId>tomcat-coyote</artifactId><version>9.0.81</version></dependency>- gradle
implementation("org.apache.tomcat:tomcat-coyote:9.0.81")
Severity breakdown
CVSS 3.1 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-459: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
How to prevent it
- Architecture and Design, Implementation: Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack | Medium Known exploited | Also affects org.apache.tomcat:tomcat-coyote |
| GHSA-f525-44xv-f2qj Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation | Critical | Also affects org.apache.tomcat:tomcat-coyote |
| GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated | Critical | Also affects org.apache.tomcat:tomcat-coyote |
| GHSA-8mc5-53m5-3qj2 Apache Tomcat has an Improper Input Validation vulnerability | Medium | Also affects org.apache.tomcat:tomcat-coyote |
| GHSA-69cc-cv78-qc8g Apache Tomcat: Configured cipher preference order not preserved | High | Also affects org.apache.tomcat:tomcat-coyote |
| GHSA-563x-q5rq-57qp Apache Tomcat has an HTTP Request/Response Smuggling vulnerability | High | Also affects org.apache.tomcat:tomcat-coyote |
| GHSA-mgp5-rv84-w37q Apache Tomcat has an Improper Input Validation vulnerability | High | Also affects org.apache.tomcat:tomcat-coyote |
| GHSA-qq5r-98hh-rxc9 Apache Tomcat - Security constraint bypass with HTTP/0.9 | Low | Also affects org.apache.tomcat:tomcat-coyote |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor