CVE-2024-54677

一、漏洞信息
 漏洞编号：[CVE-2024-54677](https://nvd.nist.gov/vuln/detail/CVE-2024-54677)
 漏洞归属组件：[tomcat](https://gitee.com/src-openeuler/tomcat)
 漏洞归属的版本：9.0.10,9.0.96
 CVSS V3.0分值：
  BaseScore：5.3 Medium
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
 漏洞简述：
  Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97.Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
 漏洞公开时间：2024-12-17 21:15:18
 漏洞创建时间：2024-12-17 21:32:46
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-54677
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security.apache.org | https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n |  |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2024/12/17/5 |  |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2024/12/17/6 |  |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2024/12/18/1 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-54677 | https://bugzilla.suse.com/show_bug.cgi?id=1234664 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-54677 | https://bugzilla.suse.com/show_bug.cgi?id=1234664 |
| suse_bugzilla | https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n | https://bugzilla.suse.com/show_bug.cgi?id=1234664 |
| suse_bugzilla | https://seclists.org/oss-sec/2024/q4/158 | https://bugzilla.suse.com/show_bug.cgi?id=1234664 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-54677 |
| trousers | https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n | https://seclists.org/oss-sec/2024/q4/158 |
| trousers | https://tomcat.apache.org/ | https://seclists.org/oss-sec/2024/q4/158 |
| trousers | https://www.cve.org/CVERecord?id=CVE-2024-54677 | https://seclists.org/oss-sec/2024/q4/158 |
| tomcat |  | https://tomcat.apache.org/security-9.html |
| mageia |  | http://advisories.mageia.org/MGASA-2024-0394.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| tomcat |  | https://github.com/apache/tomcat/commit/1d88dd3ffaed76188dd4ee32ce77709ce6e153cd |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/721544ea28e92549824b106be954a9f411867a1c |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/84065e26ca4555e63a922bb29b13b0a1c86b7654 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/3315a9027a7eaab18f42625b97b569940ff1365d |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/c2f7ce21c3fb12caefee87c517a8bb4f80700044 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/75ff7e8622edcc024b268677aa789ee8f0880ecc |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/4d5cc6538d91386f950373ac8120e98c2c78ed3a |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/84c4af76e7a10fc7f8630ce62e6a46632ea4a90e |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/9ffd23fc27f5d1fc95bf97e5cea175c8968f4533 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/f57a9d9847c1038be61f5818d73b8be907c460d4 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/aa5b4d0043289cf054f531ec55126c980d3572e1 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/e8c16cdba833884e1bd49fff1f1cb699da177585 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/dbec927859d9484cb8bd680a7c67b1a560f48444 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/d63a10afc142b12f462a15f7d10f79fd80ff94eb |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/54e56495e9a106218efe9fc9c79d976c0032bbfd |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/bbd82e9593314ade4cfd57248f9285fbad686f66 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/4f0236606961176257b883213e1621b1859ed746 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/c0a23927ea5e061ca3fdff695138464179fe674a |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/b1f65728b37d7d227a0764344473b7e261a13408 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/a95bf2b0303442a2c9a1ac364b0e63b56049e33a |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/4a335c6dcba8d6f8a54629eda392a50da267bdf4 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/722814668708c42a61b0c1e340b15bc2b785c0d1 |  | tomcat |
| tomcat |  | https://github.com/apache/tomcat/commit/cb1707685472994e9d924746f8c91cb116fa5213 |  | tomcat |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97.Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
 openEuler评分：
  5.3
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
 受影响版本排查(受影响/不受影响)：
  1.master:受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS-SP1:受影响
4.openEuler-22.03-LTS-SP3:受影响
5.openEuler-24.03-LTS:受影响
6.openEuler-24.03-LTS-Next:受影响
7.openEuler-22.03-LTS-SP4:受影响
8.openEuler-24.03-LTS-SP1:受影响

修复是否涉及abi变化(是/否)：
  1.master:否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP1:否
4.openEuler-22.03-LTS-SP3:否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否
8.openEuler-24.03-LTS-SP1:否

原因说明：
  1.master:正常修复
2.openEuler-20.03-LTS-SP4:正常修复
3.openEuler-22.03-LTS-SP1:正常修复
4.openEuler-22.03-LTS-SP3:正常修复
5.openEuler-22.03-LTS-SP4:正常修复
6.openEuler-24.03-LTS:正常修复
7.openEuler-24.03-LTS-Next:正常修复
8.openEuler-24.03-LTS-SP1:正常修复

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2564

src-openEuler/tomcat

内容风险标识

评论 (9)

src-openEuler/tomcat .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-54677

评论 (9)

搜索帮助

src-openEuler/tomcat