RHSA-2024:3307: Important: tomcat security and bug fix update
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.Security Fix(es): Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549) Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672) Bug Fix(es) and Enhancement(s): Rebase tomcat to version 9.0.87 (JIRA:RHEL-34815) Amend tomcat's changelog so that fixed CVEs are mentioned explicitly (JIRA:RHEL-35328) For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage(s) listed in the References section.
Other sources
Important: tomcat security and bug fix update
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2024:3307?
The severity of RHSA-2024:3307 is categorized as important due to the denial of service vulnerabilities in Apache Tomcat.
How do I fix RHSA-2024:3307?
To fix RHSA-2024:3307, update to the patched version 9.0.87-1.el9_4.1 of Apache Tomcat.
What vulnerabilities are addressed in RHSA-2024:3307?
RHSA-2024:3307 addresses CVE-2024-24549 related to HTTP/2 header handling DoS and CVE-2024-23672 for WebSocket DoS.
What versions of Apache Tomcat are affected by RHSA-2024:3307?
Versions of Apache Tomcat prior to 9.0.87-1.el9_4.1 are affected by RHSA-2024:3307.
Is RHSA-2024:3307 applicable for all Red Hat Enterprise Linux products?
RHSA-2024:3307 is applicable to multiple Red Hat Enterprise Linux products including those for Power, IBM z Systems, and x86_64.