SUSE-SU-2024:3510-1

Details

Description of the patch:

This update for tomcat fixes the following issues:

CVE-2024-38286: OutOfMemory exception triggered through abuse of the TLS handshake process. (bsc#1230986)

Affected Packages

tomcat

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

9.0.36-3.130.1

tomcat-admin-webapps

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

9.0.36-3.130.1

tomcat-docs-webapp

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

9.0.36-3.130.1

tomcat-el-3_0-api

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

9.0.36-3.130.1

tomcat-javadoc

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

9.0.36-3.130.1

tomcat-jsp-2_3-api

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

9.0.36-3.130.1

tomcat-lib

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

9.0.36-3.130.1

tomcat-servlet-4_0-api

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

9.0.36-3.130.1

tomcat-webapps

SUSE Linux Enterprise Server 12 SP5SUSE Linux Enterprise Server for SAP Applications 12 SP5

Fixed in:

9.0.36-3.130.1

References

ADVISORY

https://bugzilla.suse.com/1230986

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2024-October/019542.html

ADVISORY

https://www.suse.com/security/cve/CVE-2024-38286/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2024/suse-su-20243510-1/