APACHE TOMCAT ERROR ROCKETGATE UPGRADE
APACHE TOMCAT ERROR ROCKETGATE WINDOWS

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. History Original advisory Updated summary

APACHE TOMCAT ERROR ROCKETGATE UPGRADE

Users are recommended to upgrade to version 1.2.49, which fixes the issue. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd.

Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included 'JkOptions +ForwardDirectories' but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full.

APACHE TOMCAT ERROR ROCKETGATE WINDOWS

The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. Incomplete Cleanup vulnerability in Apache Tomcat. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers.

Apache tomcat error rocketgate