[<prev] [next>] [day] [month] [year] [list]
Message-ID: <40414da1-f11e-4cab-ae44-810bded40f1e@apache.org>
Date: Fri, 19 Jan 2024 10:30:04 +0000
From: Mark Thomas <markt@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-21733: Apache Tomcat: Leaking of unrelated request bodies in
default error page
Severity: important
Affected versions:
- Apache Tomcat 8.5.7 through 8.5.63
- Apache Tomcat 9.0.0-M11 through 9.0.43
Description:
Generation of Error Message Containing Sensitive Information
vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from
8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43.
Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44
onwards, which contain a fix for the issue.
Credit:
xer0dayz from company Sn1perSecurity LLC (finder)
References:
https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfz
https://tomcat.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-21733
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
