Bug 1208513 (CVE-2023-24998) - VUL-0: CVE-2023-24998: tomcat,tomcat6,apache-commons-fileupload,jakarta-commons-fileupload: FileUpload DoS with excessive parts
Summary: VUL-0: CVE-2023-24998: tomcat,tomcat6,apache-commons-fileupload,jakarta-commo...
Status: RESOLVED FIXED
Alias: CVE-2023-24998
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Michele Bussolotto
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/357748/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-24998:7.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-02-21 08:03 UTC by Robert Frohl
Modified: 2024-01-17 09:50 UTC (History)
10 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2023-02-21 08:03:28 UTC 
CVE-2023-24998

Apache Commons FileUpload before 1.5 does not limit the number of request parts
to be processed resulting in the possibility of an attacker triggering a DoS
with a malicious upload or series of uploads.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-24998
https://seclists.org/oss-sec/2023/q1/108
https://seclists.org/oss-sec/2023/q1/107
https://www.cve.org/CVERecord?id=CVE-2023-24998
https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy
Comment 2 Michele Bussolotto 2023-02-21 08:35:55 UTC 
github issue: https://github.com/SUSE/spacewalk/issues/20552
Comment 4 Robert Frohl 2023-02-21 11:11:34 UTC 
tracking the following as affected

tomcat:

- SUSE:SLE-12-SP2:Update/tomcat
- SUSE:SLE-12-SP4:Update/tomcat
- SUSE:SLE-15-SP1:Update/tomcat
- SUSE:SLE-15-SP2:Update/tomcat
- SUSE:SLE-11:Update/tomcat6 


apache-commons-fileupload:

- SUSE:SLE-15-SP2:Update/apache-commons-fileupload


jakarta-commons-fileupload:

- SUSE:SLE-11:Update/jakarta-commons-fileupload
- SUSE:SLE-12:Update/jakarta-commons-fileupload
- SUSE:SLE-15:Update/jakarta-commons-fileupload
Comment 6 don matheson 2023-02-21 18:36:10 UTC 
I have a customer also asking about CVE-2022-43719. Does Suse have plans to release a patch for  this one as well? 

thanx
Don
Comment 7 Michele Bussolotto 2023-02-23 10:15:46 UTC 
it seems that older tomcat version uses apache-commons-fileupload rpm but newer has embedded code. Issues has been fixed in 9.0.71 (thanks Robert for finding this really helpful information! )

I think I will able to provide a fix in few days
Comment 9 don matheson 2023-02-23 14:03:57 UTC 
In reply to Robert Frohl in comment 8

>Why does the customer think we should ship an update ?

Here's  what the customer said: 

"We want to know if there is any patch to solve the following CVEs:
CVE-2022-43719
CVE-2023-24998"

It looks like the customer was just asking if there was a fix.
Comment 12 Michele Bussolotto 2023-02-28 14:36:17 UTC 
still missing:
- SUSE:SLE-15-SP2:Update/tomcat
- SUSE:SLE-11:Update/tomcat6 (tomcat 6)

work on it these days
Comment 14 Michele Bussolotto 2023-03-01 15:37:17 UTC 
Created MR also for SUSE:SLE-15-SP2:Update/tomcat. Unfortunately for
SUSE:SLE-11:Update/tomcat6

I didn't find any easy way to fix it. Consider that tomcat6 is EOL of December 2016. Moreover, this particular fix is on fileupload, that is embedded in tomcat6: the version embedded is commons-fileupload-1.0 and it was released on Jun 2003. So it's not possible to fix this security issue without a bump commons-fileupload versions (and it would be really risky).
There's also the possibility that tomcat6 is not affected.

Not sure how we can move forward
Comment 21 Maintenance Automation 2023-03-10 12:30:14 UTC 
SUSE-SU-2023:0697-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1208513
CVE References: CVE-2023-24998
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): tomcat-9.0.36-150100.4.87.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): tomcat-9.0.36-150100.4.87.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): tomcat-9.0.36-150100.4.87.1
SUSE CaaS Platform 4.0 (src): tomcat-9.0.36-150100.4.87.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 22 Maintenance Automation 2023-03-10 12:30:17 UTC 
SUSE-SU-2023:0696-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1208513
CVE References: CVE-2023-24998
Sources used:
SUSE OpenStack Cloud 9 (src): tomcat-9.0.36-3.99.1
SUSE OpenStack Cloud Crowbar 9 (src): tomcat-9.0.36-3.99.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (src): tomcat-9.0.36-3.99.1
SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (src): tomcat-9.0.36-3.99.1
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (src): tomcat-9.0.36-3.99.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): tomcat-9.0.36-3.99.1
SUSE Linux Enterprise Server 12 SP5 (src): tomcat-9.0.36-3.99.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): tomcat-9.0.36-3.99.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 23 Maintenance Automation 2023-03-10 12:30:19 UTC 
SUSE-SU-2023:0695-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1208513
CVE References: CVE-2023-24998
Sources used:
SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (src): tomcat-8.0.53-29.63.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 24 Maintenance Automation 2023-03-14 20:30:22 UTC 
SUSE-SU-2023:0730-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1208513, 986359
CVE References: CVE-2016-3092, CVE-2023-24998
Sources used:
openSUSE Leap 15.4 (src): jakarta-commons-fileupload-1.1.1-150000.4.8.1
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): jakarta-commons-fileupload-1.1.1-150000.4.8.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): jakarta-commons-fileupload-1.1.1-150000.4.8.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): jakarta-commons-fileupload-1.1.1-150000.4.8.1
SUSE CaaS Platform 4.0 (src): jakarta-commons-fileupload-1.1.1-150000.4.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 25 Maintenance Automation 2023-03-16 12:30:45 UTC 
SUSE-SU-2023:0758-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1208513, 986359
CVE References: CVE-2016-3092, CVE-2023-24998
Sources used:
SUSE OpenStack Cloud 9 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE OpenStack Cloud Crowbar 9 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise Server 12 SP5 (src): jakarta-commons-fileupload-1.1.1-122.8.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): jakarta-commons-fileupload-1.1.1-122.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 30 Maintenance Automation 2023-04-05 12:30:22 UTC 
SUSE-SU-2023:1769-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1208513, 1209622
CVE References: CVE-2023-24998, CVE-2023-28708
Sources used:
openSUSE Leap 15.4 (src): tomcat-9.0.43-150200.35.1
Web and Scripting Module 15-SP4 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): tomcat-9.0.43-150200.35.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): tomcat-9.0.43-150200.35.1
SUSE Manager Server 4.2 (src): tomcat-9.0.43-150200.35.1
SUSE Enterprise Storage 7.1 (src): tomcat-9.0.43-150200.35.1
SUSE Enterprise Storage 7 (src): tomcat-9.0.43-150200.35.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 32 Cathy Hu 2023-05-22 14:13:05 UTC 
The fix was incomplete and there was a new CVE assigned to the incomplete fix: CVE-2023-28709 (see bsc#1211608 for more details).
Comment 34 Maintenance Automation 2023-06-06 08:30:12 UTC 
SUSE-SU-2023:2390-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1208513
CVE References: CVE-2023-24998
Sources used:
openSUSE Leap 15.4 (src): apache-commons-fileupload-1.5-150200.3.9.1
openSUSE Leap 15.5 (src): apache-commons-fileupload-1.5-150200.3.9.1
Web and Scripting Module 15-SP4 (src): apache-commons-fileupload-1.5-150200.3.9.1
Web and Scripting Module 15-SP5 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Manager Server 4.2 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Enterprise Storage 7.1 (src): apache-commons-fileupload-1.5-150200.3.9.1
SUSE Enterprise Storage 7 (src): apache-commons-fileupload-1.5-150200.3.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 35 Maintenance Automation 2023-06-13 16:30:01 UTC 
SUSE-SU-2023:2505-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1208513, 1211608
CVE References: CVE-2023-24998, CVE-2023-28709
Sources used:
SUSE Enterprise Storage 7 (src): tomcat-9.0.75-150200.41.1
openSUSE Leap 15.4 (src): tomcat-9.0.75-150200.41.1
openSUSE Leap 15.5 (src): tomcat-9.0.75-150200.41.1
Web and Scripting Module 15-SP4 (src): tomcat-9.0.75-150200.41.1
Web and Scripting Module 15-SP5 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): tomcat-9.0.75-150200.41.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): tomcat-9.0.75-150200.41.1
SUSE Manager Server 4.2 (src): tomcat-9.0.75-150200.41.1
SUSE Enterprise Storage 7.1 (src): tomcat-9.0.75-150200.41.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.