https://seclists.org/oss-sec/2023/q4/77: CVE-2023-42794: Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

Q: Which deployments are exposed to this issue?

The issue affects Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93, and the denial-of-service condition is specific to Windows deployments.

Q: What conditions are required for exploitation?

A web application must accept uploaded files, open a stream for an uploaded file, and fail to close that stream. Under those conditions, the temporary uploaded file is not deleted from disk.

Q: What is the practical impact if the application leaves upload streams open?

Temporary files can accumulate until disk space is exhausted, potentially causing a denial of service. The issue is therefore most relevant to applications that handle uploads and do not reliably close their file streams.

Published Oct 10, 2023

Updated

Affected Software

2 affected components

Apache Tomcat>=9.0.70<9.0.80

Apache Tomcat>=8.5.85<8.5.93

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93, and the denial-of-service condition is specific to Windows deployments.

What conditions are required for exploitation?

A web application must accept uploaded files, open a stream for an uploaded file, and fail to close that stream. Under those conditions, the temporary uploaded file is not deleted from disk.

What is the practical impact if the application leaves upload streams open?

Temporary files can accumulate until disk space is exhausted, potentially causing a denial of service. The issue is therefore most relevant to applications that handle uploads and do not reliably close their file streams.