MGASA-2023-0191

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2023-28709
Published: 31 May 2023, 06:41
Last modified:16 Apr 2026, 04:23

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

31 May 2023, 06:41
Published
Vulnerability first disclosed
16 Apr 2026, 04:23
Last Modified
Vulnerability information updated

Description

Updated tomcat packages fix security vulnerability The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur. (CVE-2023-28709)

Affected Systems

  • mageia•tomcat

    < 9.0.74-1.mga8

References (3)