USN-7469-2: Apache Tomcat vulnerability

Published Apr 28, 2025

Updated

USN-7469-1 fixed a vulnerability in Apache Traffic Server. This update provides the corresponding updates for Apache Tomcat. Original advisory details: It was discovered that Apache Traffic Server exhibited poor server resource management in its HTTP/2 protocol. An attacker could possibly use this issue to cause Apache Traffic Server to crash, resulting in a denial of service.

Affected Software

1 affected component

Apache Tomcat

Event History

May 10, 2025

Advisory Published

via Ubuntu·07:21 PM

Data Sourced

via Ubuntu·07:21 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2023-44487

Frequently Asked Questions

What is the severity of USN-7469-2?

USN-7469-2 addresses a high-severity vulnerability related to poor resource management in Apache Traffic Server's HTTP/2 protocol.

How do I fix USN-7469-2?

To fix USN-7469-2, update to the patched version 8.5.39-1ubuntu1~18.04.3+esm4 of libtomcat8-embed-java, libtomcat8-java, or tomcat8 on Ubuntu 18.04.

What products are affected by USN-7469-2?

USN-7469-2 affects the libtomcat8-embed-java, libtomcat8-java, and tomcat8 packages in Ubuntu 18.04.

Is USN-7469-2 specific to Ubuntu 18.04?

Yes, USN-7469-2 specifically addresses vulnerabilities in packages for Ubuntu version 18.04.

What happens if I don't address USN-7469-2?

Failing to address USN-7469-2 could leave your system vulnerable to attacks exploiting the resource management issues in the affected Apache Traffic Server.