Thank you for your contribution to Debian. Mapping oldstable-security to oldstable-proposed-updates.
Accepted:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 18 Apr 2024 22:17:07 +0200
Source: tomcat9
Architecture: source
Version: 9.0.43-2~deb11u10
Distribution: bullseye-security
Urgency: high
Maintainer: Debian Java Maintainers
<pkg-java-maintain...@lists.alioth.debian.org>
Changed-By: Markus Koschany <a...@debian.org>
Changes:
tomcat9 (9.0.43-2~deb11u10) bullseye-security; urgency=high
.
* Team upload.
* Fix CVE-2023-46589:
Improper Input Validation vulnerability in Apache Tomcat. Tomcat 10 did not
correctly parse HTTP trailer headers. A trailer header that exceeded the
header size limit could cause Tomcat to treat a single request as multiple
requests leading to the possibility of request smuggling when behind a
reverse proxy.
* Fix CVE-2024-24549:
Denial of Service due to improper input validation vulnerability for
HTTP/2. When processing an HTTP/2 request, if the request exceeded any of
the configured limits for headers, the associated HTTP/2 stream was not
reset until after all of the headers had been processed.
* Fix CVE-2024-23672:
Denial of Service via incomplete cleanup vulnerability. It was possible for
WebSocket clients to keep WebSocket connections open leading to increased
resource consumption.
Checksums-Sha1:
55d94ac3d8d7947d4a3ac2b1b4e4a2fcbd7f5533 2910 tomcat9_9.0.43-2~deb11u10.dsc
4dcd8db9ffcc56ed6db5965a9d415947fb275a04 63088
tomcat9_9.0.43-2~deb11u10.debian.tar.xz
93ac5c033f4270df8e2ef7269e3f165c208994a8 14427
tomcat9_9.0.43-2~deb11u10_source.buildinfo
Checksums-Sha256:
783993a4d13955e395f7213ce9cf281ce016d30f161cde53661febe08e58639f 2910
tomcat9_9.0.43-2~deb11u10.dsc
6e66360dd51b9d2868869c0e155ee2ebec3a9198df4417c8279fddaaba651768 63088
tomcat9_9.0.43-2~deb11u10.debian.tar.xz
e3b481c1e5062d5c1572c0df1aaa0b83aa72ade5012d60b983d30d06b9a6e565 14427
tomcat9_9.0.43-2~deb11u10_source.buildinfo
Files:
81f7ac41578e5bf9a564cf6aa43fb1d7 2910 java optional
tomcat9_9.0.43-2~deb11u10.dsc
b529191678916c015e89a18343011bd6 63088 java optional
tomcat9_9.0.43-2~deb11u10.debian.tar.xz
49000bf7af3ba4dc5ba2899890a65227 14427 java optional
tomcat9_9.0.43-2~deb11u10_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmYhgNBfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp
YW4ub3JnAAoJENmtFLlRO1Hk0WkP/1CS7KqzxMDVxvpBxHA375DPodK41siBlA5D
u1wOVpmbZtwDeX6vHl7iTWepYEQwRD+xSn9Q8KXbBBlj7im4NQP1jbPiWyqVRnkP
9RgVZMx8wC/G2KPFfQS0cyqNSjvZV43DApYYu77wCze+N2kliqCrVAgINO4YHOLk
G/Hancffb45dXh0e+82ampQK5RBmFzIeNLhOxe8YGYrd+kAkUyHol5Ilbm1AYJXm
uLW2ZyyruH1MhPn/sRkzQ7RfQY36vh8kXclWzWDuTcKi/1Jl7D14WVTnviNB+kyP
hk+/Zc9GTN1jGv/CWyKZe+NJgG+tt4mChjVgRBQ+Cg4rcLNIo/stMrLFJOcBk5X7
Gz/Ww807rMY0RZpDCv8AJgypHagYO0Jm1tpx9WErmbwI8WooL2lGPnNAF00zXsrj
mlty4FoSRNMxR/xEoIAt8Rgnaz0iMjcCswiet0AqnedExmrp8/RLH8PSMveEQh6N
choc9mnsHebupCuC2lgHTSQVB7RZv1nQaidxfDuvxL2jx5QqdaytALd0b2iSn9Bg
w3WEULd2O/2/a5SZpNWANCohUwMwcRC4nexnUtPZyUx/zeXsH4sQL3UI0/IJEWD5
+B4Pl5tmHrCTiLYy6QmMdyVXka2+iDzRhWJhQ+zQgmNXFyKRQgX/B7gIKzzKA8Hg
E2HliF2h
=rcw5
-----END PGP SIGNATURE-----
pgpOP9Ldt3lh7.pgp
Description: PGP signature
__ This is the maintainer address of Debian's Java team <https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use debian-j...@lists.debian.org for discussions and questions.
