Bug 1208513 (CVE-2023-24998)

Summary:	VUL-0: CVE-2023-24998: tomcat,tomcat6,apache-commons-fileupload,jakarta-commons-fileupload: FileUpload DoS with excessive parts
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Robert Frohl <rfrohl>
Component:	Incidents	Assignee:	Michele Bussolotto <michele.bussolotto>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	abergmann, cathy.hu, david.anes, don.matheson, fstrba, meissner, michele.bussolotto, rfrohl, security-team, stoyan.manolov
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/357748/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-24998:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Robert Frohl 2023-02-21 08:03:28 UTC

CVE-2023-24998

Apache Commons FileUpload before 1.5 does not limit the number of request parts
to be processed resulting in the possibility of an attacker triggering a DoS
with a malicious upload or series of uploads.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-24998
https://seclists.org/oss-sec/2023/q1/108
https://seclists.org/oss-sec/2023/q1/107
https://www.cve.org/CVERecord?id=CVE-2023-24998
https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy

Comment 2 Michele Bussolotto 2023-02-21 08:35:55 UTC

github issue: https://github.com/SUSE/spacewalk/issues/20552

Comment 4 Robert Frohl 2023-02-21 11:11:34 UTC

tracking the following as affected

tomcat:

- SUSE:SLE-12-SP2:Update/tomcat
- SUSE:SLE-12-SP4:Update/tomcat
- SUSE:SLE-15-SP1:Update/tomcat
- SUSE:SLE-15-SP2:Update/tomcat
- SUSE:SLE-11:Update/tomcat6 


apache-commons-fileupload:

- SUSE:SLE-15-SP2:Update/apache-commons-fileupload


jakarta-commons-fileupload:

- SUSE:SLE-11:Update/jakarta-commons-fileupload
- SUSE:SLE-12:Update/jakarta-commons-fileupload
- SUSE:SLE-15:Update/jakarta-commons-fileupload

Comment 6 don matheson 2023-02-21 18:36:10 UTC

I have a customer also asking about CVE-2022-43719. Does Suse have plans to release a patch for  this one as well? 

thanx
Don

Comment 7 Michele Bussolotto 2023-02-23 10:15:46 UTC

it seems that older tomcat version uses apache-commons-fileupload rpm but newer has embedded code. Issues has been fixed in 9.0.71 (thanks Robert for finding this really helpful information! )

I think I will able to provide a fix in few days

Comment 9 don matheson 2023-02-23 14:03:57 UTC

In reply to Robert Frohl in comment 8

>Why does the customer think we should ship an update ?

Here's  what the customer said: 

"We want to know if there is any patch to solve the following CVEs:
CVE-2022-43719
CVE-2023-24998"

It looks like the customer was just asking if there was a fix.

Comment 12 Michele Bussolotto 2023-02-28 14:36:17 UTC

still missing:
- SUSE:SLE-15-SP2:Update/tomcat
- SUSE:SLE-11:Update/tomcat6 (tomcat 6)

work on it these days

Comment 14 Michele Bussolotto 2023-03-01 15:37:17 UTC

Created MR also for SUSE:SLE-15-SP2:Update/tomcat. Unfortunately for
SUSE:SLE-11:Update/tomcat6

I didn't find any easy way to fix it. Consider that tomcat6 is EOL of December 2016. Moreover, this particular fix is on fileupload, that is embedded in tomcat6: the version embedded is commons-fileupload-1.0 and it was released on Jun 2003. So it's not possible to fix this security issue without a bump commons-fileupload versions (and it would be really risky).
There's also the possibility that tomcat6 is not affected.

Not sure how we can move forward

Comment 21 Maintenance Automation 2023-03-10 12:30:14 UTC

SUSE-SU-2023:0697-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1208513
CVE References: CVE-2023-24998
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): tomcat-9.0.36-150100.4.87.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): tomcat-9.0.36-150100.4.87.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): tomcat-9.0.36-150100.4.87.1
SUSE CaaS Platform 4.0 (src): tomcat-9.0.36-150100.4.87.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 22 Maintenance Automation 2023-03-10 12:30:17 UTC

SUSE-SU-2023:0696-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1208513
CVE References: CVE-2023-24998
Sources used:
SUSE OpenStack Cloud 9 (src): tomcat-9.0.36-3.99.1
SUSE OpenStack Cloud Crowbar 9 (src): tomcat-9.0.36-3.99.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (src): tomcat-9.0.36-3.99.1
SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (src): tomcat-9.0.36-3.99.1
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (src): tomcat-9.0.36-3.99.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): tomcat-9.0.36-3.99.1
SUSE Linux Enterprise Server 12 SP5 (src): tomcat-9.0.36-3.99.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): tomcat-9.0.36-3.99.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 23 Maintenance Automation 2023-03-10 12:30:19 UTC

SUSE-SU-2023:0695-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1208513
CVE References: CVE-2023-24998
Sources used:
SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (src): tomcat-8.0.53-29.63.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 24 Maintenance Automation 2023-03-14 20:30:22 UTC

SUSE-SU-2023:0730-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1208513, 986359
CVE References: CVE-2016-3092, CVE-2023-24998
Sources used:
openSUSE Leap 15.4 (src): jakarta-commons-fileupload-1.1.1-150000.4.8.1
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): jakarta-commons-fileupload-1.1.1-150000.4.8.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): jakarta-commons-fileupload-1.1.1-150000.4.8.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): jakarta-commons-fileupload-1.1.1-150000.4.8.1
SUSE CaaS Platform 4.0 (src): jakarta-commons-fileupload-1.1.1-150000.4.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 25 Maintenance Automation 2023-03-16 12:30:45 UTC

SUSE-SU-2023:0758-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1208513, 986359
CVE References: CVE-2016-3092, CVE-2023-24998
Sources used:
SUSE OpenStack Cloud 9 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE OpenStack Cloud Crowbar 9 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise Server 12 SP5 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): jakarta-commons-fileupload-1.1.1-122.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 30 Maintenance Automation 2023-04-05 12:30:22 UTC

SUSE-SU-2023:1769-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1208513, 1209622
CVE References: CVE-2023-24998, CVE-2023-28708
Sources used:
openSUSE Leap 15.4 (src): tomcat-9.0.43-150200.35.1
Web and Scripting Module 15-SP4 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): tomcat-9.0.43-150200.35.1
SUSE Manager Server 4.2 (src): tomcat-9.0.43-150200.35.1
SUSE Enterprise Storage 7.1 (src): tomcat-9.0.43-150200.35.1
SUSE Enterprise Storage 7 (src): tomcat-9.0.43-150200.35.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 32 Cathy Hu 2023-05-22 14:13:05 UTC

The fix was incomplete and there was a new CVE assigned to the incomplete fix: CVE-2023-28709 (see bsc#1211608 for more details).

Comment 34 Maintenance Automation 2023-06-06 08:30:12 UTC

SUSE-SU-2023:2390-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1208513
CVE References: CVE-2023-24998
Sources used:
openSUSE Leap 15.4 (src): apache-commons-fileupload-1.5-150200.3.9.1
openSUSE Leap 15.5 (src): apache-commons-fileupload-1.5-150200.3.9.1
Web and Scripting Module 15-SP4 (src): apache-commons-fileupload-1.5-150200.3.9.1
Web and Scripting Module 15-SP5 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Manager Server 4.2 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Enterprise Storage 7.1 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Enterprise Storage 7 (src): apache-commons-fileupload-1.5-150200.3.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 35 Maintenance Automation 2023-06-13 16:30:01 UTC

SUSE-SU-2023:2505-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1208513, 1211608
CVE References: CVE-2023-24998, CVE-2023-28709
Sources used:
SUSE Enterprise Storage 7 (src): tomcat-9.0.75-150200.41.1
openSUSE Leap 15.4 (src): tomcat-9.0.75-150200.41.1
openSUSE Leap 15.5 (src): tomcat-9.0.75-150200.41.1
Web and Scripting Module 15-SP4 (src): tomcat-9.0.75-150200.41.1
Web and Scripting Module 15-SP5 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): tomcat-9.0.75-150200.41.1
SUSE Manager Server 4.2 (src): tomcat-9.0.75-150200.41.1
SUSE Enterprise Storage 7.1 (src): tomcat-9.0.75-150200.41.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.