Amazon Linux 2 Security Advisory: ALASTOMCAT8.5-2024-020
Advisory Release Date: 2024-08-01 01:10 Pacific
Advisory Updated Date: 2024-08-13 09:30 Pacific
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.
Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue. (CVE-2024-34750)
Affected Packages:
tomcat
Note:
This advisory is applicable to Amazon Linux 2 - Tomcat8.5 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update tomcat to update your system.
noarch:
tomcat-8.5.100-1.amzn2.0.2.noarch
tomcat-admin-webapps-8.5.100-1.amzn2.0.2.noarch
tomcat-docs-webapp-8.5.100-1.amzn2.0.2.noarch
tomcat-javadoc-8.5.100-1.amzn2.0.2.noarch
tomcat-jsvc-8.5.100-1.amzn2.0.2.noarch
tomcat-jsp-2.3-api-8.5.100-1.amzn2.0.2.noarch
tomcat-lib-8.5.100-1.amzn2.0.2.noarch
tomcat-servlet-3.1-api-8.5.100-1.amzn2.0.2.noarch
tomcat-el-3.0-api-8.5.100-1.amzn2.0.2.noarch
tomcat-webapps-8.5.100-1.amzn2.0.2.noarch
src:
tomcat-8.5.100-1.amzn2.0.2.src