-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 18 Apr 2024 22:17:07 +0200 Source: tomcat9 Architecture: source Version: 9.0.43-2~deb11u10 Distribution: bullseye-security Urgency: high Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> Changed-By: Markus Koschany <apo@debian.org> Changes: tomcat9 (9.0.43-2~deb11u10) bullseye-security; urgency=high . * Team upload. * Fix CVE-2023-46589: Improper Input Validation vulnerability in Apache Tomcat. Tomcat 10 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. * Fix CVE-2024-24549: Denial of Service due to improper input validation vulnerability for HTTP/2. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed. * Fix CVE-2024-23672: Denial of Service via incomplete cleanup vulnerability. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption. Checksums-Sha1: 55d94ac3d8d7947d4a3ac2b1b4e4a2fcbd7f5533 2910 tomcat9_9.0.43-2~deb11u10.dsc 4dcd8db9ffcc56ed6db5965a9d415947fb275a04 63088 tomcat9_9.0.43-2~deb11u10.debian.tar.xz 93ac5c033f4270df8e2ef7269e3f165c208994a8 14427 tomcat9_9.0.43-2~deb11u10_source.buildinfo Checksums-Sha256: 783993a4d13955e395f7213ce9cf281ce016d30f161cde53661febe08e58639f 2910 tomcat9_9.0.43-2~deb11u10.dsc 6e66360dd51b9d2868869c0e155ee2ebec3a9198df4417c8279fddaaba651768 63088 tomcat9_9.0.43-2~deb11u10.debian.tar.xz e3b481c1e5062d5c1572c0df1aaa0b83aa72ade5012d60b983d30d06b9a6e565 14427 tomcat9_9.0.43-2~deb11u10_source.buildinfo Files: 81f7ac41578e5bf9a564cf6aa43fb1d7 2910 java optional tomcat9_9.0.43-2~deb11u10.dsc b529191678916c015e89a18343011bd6 63088 java optional tomcat9_9.0.43-2~deb11u10.debian.tar.xz 49000bf7af3ba4dc5ba2899890a65227 14427 java optional tomcat9_9.0.43-2~deb11u10_source.buildinfo -----BEGIN PGP SIGNATURE----- iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmYhgNBfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp YW4ub3JnAAoJENmtFLlRO1Hk0WkP/1CS7KqzxMDVxvpBxHA375DPodK41siBlA5D u1wOVpmbZtwDeX6vHl7iTWepYEQwRD+xSn9Q8KXbBBlj7im4NQP1jbPiWyqVRnkP 9RgVZMx8wC/G2KPFfQS0cyqNSjvZV43DApYYu77wCze+N2kliqCrVAgINO4YHOLk G/Hancffb45dXh0e+82ampQK5RBmFzIeNLhOxe8YGYrd+kAkUyHol5Ilbm1AYJXm uLW2ZyyruH1MhPn/sRkzQ7RfQY36vh8kXclWzWDuTcKi/1Jl7D14WVTnviNB+kyP hk+/Zc9GTN1jGv/CWyKZe+NJgG+tt4mChjVgRBQ+Cg4rcLNIo/stMrLFJOcBk5X7 Gz/Ww807rMY0RZpDCv8AJgypHagYO0Jm1tpx9WErmbwI8WooL2lGPnNAF00zXsrj mlty4FoSRNMxR/xEoIAt8Rgnaz0iMjcCswiet0AqnedExmrp8/RLH8PSMveEQh6N choc9mnsHebupCuC2lgHTSQVB7RZv1nQaidxfDuvxL2jx5QqdaytALd0b2iSn9Bg w3WEULd2O/2/a5SZpNWANCohUwMwcRC4nexnUtPZyUx/zeXsH4sQL3UI0/IJEWD5 +B4Pl5tmHrCTiLYy6QmMdyVXka2+iDzRhWJhQ+zQgmNXFyKRQgX/B7gIKzzKA8Hg E2HliF2h =rcw5 -----END PGP SIGNATURE-----
