High severityNVD Advisory· Published May 22, 2023· Updated Feb 13, 2025
Apache Tomcat: Fix for CVE-2023-24998 is incomplete
CVE-2023-28709
Description
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-coreMaven | >= 11.0.0-M2, < 11.0.0-M5 | 11.0.0-M5 |
org.apache.tomcat.embed:tomcat-embed-coreMaven | >= 10.1.5, < 10.1.8 | 10.1.8 |
org.apache.tomcat.embed:tomcat-embed-coreMaven | >= 9.0.71, < 9.0.74 | 9.0.74 |
org.apache.tomcat:tomcat-coyoteMaven | >= 8.5.85, < 8.5.88 | 8.5.88 |
Affected products
42- osv-coords41 versionspkg:apk/chainguard/tomcat-8.5.87-jamf-compatpkg:bitnami/tomcatpkg:maven/org.apache.tomcat.embed/tomcat-embed-corepkg:maven/org.apache.tomcat/tomcat-coyotepkg:rpm/almalinux/tomcatpkg:rpm/almalinux/tomcat-admin-webappspkg:rpm/almalinux/tomcat-docs-webapppkg:rpm/almalinux/tomcat-el-3.0-apipkg:rpm/almalinux/tomcat-jsp-2.3-apipkg:rpm/almalinux/tomcat-libpkg:rpm/almalinux/tomcat-servlet-4.0-apipkg:rpm/almalinux/tomcat-webappspkg:rpm/opensuse/tomcat10&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/tomcat&distro=openSUSE%20Tumbleweedpkg:rpm/suse/tomcat&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/tomcat&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP5pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-ESPOSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/tomcat&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5pkg:rpm/suse/tomcat&distro=SUSE%20Manager%20Server%204.2pkg:rpm/suse/tomcat&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/tomcat&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209
< 8.5.87-r3+ 40 more
- (no CPE)range: < 8.5.87-r3
- (no CPE)range: >= 8.5.85, <= 8.5.87
- (no CPE)range: >= 11.0.0-M2, < 11.0.0-M5
- (no CPE)range: >= 8.5.85, < 8.5.88
- (no CPE)range: < 1:9.0.62-37.el9_3
- (no CPE)range: < 1:9.0.62-37.el9_3
- (no CPE)range: < 1:9.0.62-37.el9_3
- (no CPE)range: < 1:9.0.62-37.el9_3
- (no CPE)range: < 1:9.0.62-37.el9_3
- (no CPE)range: < 1:9.0.62-37.el9_3
- (no CPE)range: < 1:9.0.62-37.el9_3
- (no CPE)range: < 1:9.0.62-37.el9_3
- (no CPE)range: < 10.1.14-1.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.75-1.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.36-150100.4.93.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 8.0.53-29.66.1
- (no CPE)range: < 9.0.36-3.105.1
- (no CPE)range: < 9.0.36-3.105.1
- (no CPE)range: < 9.0.36-3.105.1
- (no CPE)range: < 9.0.115-3.160.1
- (no CPE)range: < 9.0.36-150100.4.93.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.36-3.105.1
- (no CPE)range: < 9.0.36-3.105.1
- (no CPE)range: < 9.0.36-150100.4.93.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.115-3.160.1
- (no CPE)range: < 9.0.75-150200.41.1
- (no CPE)range: < 9.0.36-3.105.1
- (no CPE)range: < 9.0.36-3.105.1
- Apache Software Foundation/Apache Tomcatv5Range: 11.0.0-M2
Patches
Vulnerability mechanics
References
16- github.com/advisories/GHSA-cx6h-86xw-9x34ghsaADVISORY
- lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3jghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-28709ghsaADVISORY
- www.openwall.com/lists/oss-security/2023/05/22/1ghsaWEB
- github.com/apache/tomcat/commit/5badf94e79e5de206fc0ef3054fd536b1bb787cdghsaWEB
- github.com/apache/tomcat/commit/ba848da71c523d94950d3c53c19ea155189df9dcghsaWEB
- github.com/apache/tomcat/commit/d53d8e7f77042cc32a3b98f589496a1ef5088e38ghsaWEB
- github.com/apache/tomcat/commit/fbd81421629afe8b8a3922d59020cde81caea861ghsaWEB
- security.gentoo.org/glsa/202305-37ghsaWEB
- security.netapp.com/advisory/ntap-20230616-0004ghsaWEB
- tomcat.apache.org/security-10.htmlghsaWEB
- tomcat.apache.org/security-11.htmlghsaWEB
- tomcat.apache.org/security-8.htmlghsaWEB
- tomcat.apache.org/security-9.htmlghsaWEB
- www.debian.org/security/2023/dsa-5521ghsaWEB
- security.netapp.com/advisory/ntap-20230616-0004/mitre
News mentions
0No linked articles in our index yet.