CVE-2023-28709

描述

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.

如何修補 CVE-2023-28709

要修補 CVE-2023-28709,請將受影響套件升級到下列已修補版本。

• —未列出修補版本
• —升級至 10.1.6-1+deb12u1 或更新版本
• —升級至 10.1.6-1+deb12u1 或更新版本
• —升級至 11.0.0-M5 或更新版本
• —升級至 8.5.88 或更新版本

CVE-2023-28709 正在被利用嗎?

可能 — EPSS 為 51.5%,屬於高被利用機率區間,建議優先修補。

受影響套件(5)

• >= 8.5.85, <= 8.5.87, >= 9.0.71, <= 9.0.73, >= 10.1.5, <= 10.1.7
• from 0, < 10.1.6-1+deb12u1
• from 0, < 10.1.6-1+deb12u1
• >= 11.0.0-M2, < 11.0.0-M5
• >= 8.5.85, < 8.5.88

CVSS 分數

參考連結(17)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-28709
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-28709
• PATCHgithub.com/apache/tomcat
• WEBwww.openwall.com/lists/oss-security/2023/05/22/1
• WEB