Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-kbpn-7esm-77ew
Summary
Incomplete Cleanup vulnerability in Apache Tomcat.

The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, 
in progress refactoring that exposed a potential denial of service on 
Windows if a web application opened a stream for an uploaded file but 
failed to close the stream. The file would never be deleted from disk 
creating the possibility of an eventual denial of service due to the 
disk being full.

Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
Aliases
0
alias CVE-2023-42794
1
alias GHSA-jm7m-8jh6-29hp
Fixed_packages
0
url pkg:apache/tomcat@8.5.94
purl pkg:apache/tomcat@8.5.94
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@8.5.94
1
url pkg:apache/tomcat@9.0.81
purl pkg:apache/tomcat@9.0.81
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@9.0.81
2
url pkg:deb/debian/tomcat10@0?distro=trixie
purl pkg:deb/debian/tomcat10@0?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/tomcat10@0%3Fdistro=trixie
3
url pkg:deb/debian/tomcat10@10.1.52-1~deb12u1?distro=trixie
purl pkg:deb/debian/tomcat10@10.1.52-1~deb12u1?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1qsf-yxnk-fqhy
1
vulnerability VCID-2s6w-bbfa-afb8
2
vulnerability VCID-2ym4-frda-dbbe
3
vulnerability VCID-84a8-y1hg-vuep
4
vulnerability VCID-8qk1-ufax-eugz
5
vulnerability VCID-cugj-j48z-jub5
6
vulnerability VCID-gw94-yyjd-17er
7
vulnerability VCID-j493-xan3-myfm
8
vulnerability VCID-j7w8-ean1-33b8
9
vulnerability VCID-nqgv-hbwa-d3en
10
vulnerability VCID-nsp7-e9m6-juhv
11
vulnerability VCID-qjqr-axrq-xkcf
12
vulnerability VCID-ud36-sb2d-8ych
13
vulnerability VCID-w9nk-wv5n-2kg9
14
vulnerability VCID-xtdv-ygus-xuds
15
vulnerability VCID-z8df-aq4y-ubet
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/tomcat10@10.1.52-1~deb12u1%3Fdistro=trixie
4
url pkg:deb/debian/tomcat10@10.1.52-1~deb13u1?distro=trixie
purl pkg:deb/debian/tomcat10@10.1.52-1~deb13u1?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1qsf-yxnk-fqhy
1
vulnerability VCID-2s6w-bbfa-afb8
2
vulnerability VCID-2ym4-frda-dbbe
3
vulnerability VCID-84a8-y1hg-vuep
4
vulnerability VCID-8qk1-ufax-eugz
5
vulnerability VCID-cugj-j48z-jub5
6
vulnerability VCID-gw94-yyjd-17er
7
vulnerability VCID-j493-xan3-myfm
8
vulnerability VCID-j7w8-ean1-33b8
9
vulnerability VCID-nqgv-hbwa-d3en
10
vulnerability VCID-nsp7-e9m6-juhv
11
vulnerability VCID-qjqr-axrq-xkcf
12
vulnerability VCID-ud36-sb2d-8ych
13
vulnerability VCID-w9nk-wv5n-2kg9
14
vulnerability VCID-xtdv-ygus-xuds
15
vulnerability VCID-z8df-aq4y-ubet
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/tomcat10@10.1.52-1~deb13u1%3Fdistro=trixie
5
url pkg:deb/debian/tomcat10@10.1.54-1?distro=trixie
purl pkg:deb/debian/tomcat10@10.1.54-1?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2ym4-frda-dbbe
1
vulnerability VCID-84a8-y1hg-vuep
2
vulnerability VCID-j7w8-ean1-33b8
3
vulnerability VCID-qjqr-axrq-xkcf
4
vulnerability VCID-ud36-sb2d-8ych
5
vulnerability VCID-w9nk-wv5n-2kg9
6
vulnerability VCID-xtdv-ygus-xuds
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/tomcat10@10.1.54-1%3Fdistro=trixie
6
url pkg:deb/debian/tomcat10@10.1.55-1?distro=trixie
purl pkg:deb/debian/tomcat10@10.1.55-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/tomcat10@10.1.55-1%3Fdistro=trixie
7
url pkg:deb/debian/tomcat9@0?distro=trixie
purl pkg:deb/debian/tomcat9@0?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/tomcat9@0%3Fdistro=trixie
8
url pkg:deb/debian/tomcat9@9.0.43-2~deb11u10?distro=trixie
purl pkg:deb/debian/tomcat9@9.0.43-2~deb11u10?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/tomcat9@9.0.43-2~deb11u10%3Fdistro=trixie
9
url pkg:deb/debian/tomcat9@9.0.70-2?distro=trixie
purl pkg:deb/debian/tomcat9@9.0.70-2?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/tomcat9@9.0.70-2%3Fdistro=trixie
10
url pkg:deb/debian/tomcat9@9.0.95-1?distro=trixie
purl pkg:deb/debian/tomcat9@9.0.95-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/tomcat9@9.0.95-1%3Fdistro=trixie
11
url pkg:deb/debian/tomcat9@9.0.118-1?distro=trixie
purl pkg:deb/debian/tomcat9@9.0.118-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/tomcat9@9.0.118-1%3Fdistro=trixie
12
url pkg:maven/org.apache.tomcat/tomcat@8.5.94
purl pkg:maven/org.apache.tomcat/tomcat@8.5.94
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5udv-rheh-kqfy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@8.5.94
13
url pkg:maven/org.apache.tomcat/tomcat@9.0.81
purl pkg:maven/org.apache.tomcat/tomcat@9.0.81
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.81
14
url pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.94
purl pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.94
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.94
15
url pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.81
purl pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.81
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.81
16
url pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.94
purl pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.94
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.94
17
url pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.81
purl pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.81
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.81
Affected_packages
0
url pkg:apache/tomcat@8.5.85
purl pkg:apache/tomcat@8.5.85
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-kbpn-7esm-77ew
1
vulnerability VCID-paqj-ye46-8bdb
2
vulnerability VCID-ryby-gbcx-33ec
resource_url http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@8.5.85
1
url pkg:apache/tomcat@8.5.93
purl pkg:apache/tomcat@8.5.93
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h6f2-qgnu-bqf4
1
vulnerability VCID-jsyt-cmxf-gbh3
2
vulnerability VCID-kbpn-7esm-77ew
3
vulnerability VCID-y4a2-mamb-yqg6
resource_url http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@8.5.93
2
url pkg:apache/tomcat@9.0.70
purl pkg:apache/tomcat@9.0.70
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-kbpn-7esm-77ew
1
vulnerability VCID-m1k8-9pwc-1qb9
resource_url http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@9.0.70
3
url pkg:apache/tomcat@9.0.80
purl pkg:apache/tomcat@9.0.80
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h6f2-qgnu-bqf4
1
vulnerability VCID-jsyt-cmxf-gbh3
2
vulnerability VCID-kbpn-7esm-77ew
3
vulnerability VCID-y4a2-mamb-yqg6
resource_url http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@9.0.80
4
url pkg:maven/org.apache.tomcat/coyote@8.5.85
purl pkg:maven/org.apache.tomcat/coyote@8.5.85
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-kbpn-7esm-77ew
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/coyote@8.5.85
5
url pkg:maven/org.apache.tomcat/coyote@9.0.70
purl pkg:maven/org.apache.tomcat/coyote@9.0.70
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-kbpn-7esm-77ew
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/coyote@9.0.70
6
url pkg:maven/org.apache.tomcat/tomcat@8.5.85
purl pkg:maven/org.apache.tomcat/tomcat@8.5.85
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5udv-rheh-kqfy
1
vulnerability VCID-kbpn-7esm-77ew
2
vulnerability VCID-paqj-ye46-8bdb
3
vulnerability VCID-ryby-gbcx-33ec
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@8.5.85
7
url pkg:maven/org.apache.tomcat/tomcat@8.5.93
purl pkg:maven/org.apache.tomcat/tomcat@8.5.93
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5udv-rheh-kqfy
1
vulnerability VCID-h6f2-qgnu-bqf4
2
vulnerability VCID-jsyt-cmxf-gbh3
3
vulnerability VCID-kbpn-7esm-77ew
4
vulnerability VCID-y4a2-mamb-yqg6
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@8.5.93
8
url pkg:maven/org.apache.tomcat/tomcat@9.0.70
purl pkg:maven/org.apache.tomcat/tomcat@9.0.70
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-kbpn-7esm-77ew
1
vulnerability VCID-m1k8-9pwc-1qb9
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.70
9
url pkg:maven/org.apache.tomcat/tomcat@9.0.80
purl pkg:maven/org.apache.tomcat/tomcat@9.0.80
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h6f2-qgnu-bqf4
1
vulnerability VCID-jsyt-cmxf-gbh3
2
vulnerability VCID-kbpn-7esm-77ew
3
vulnerability VCID-y4a2-mamb-yqg6
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.80
10
url pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.85
purl pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.85
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-kbpn-7esm-77ew
1
vulnerability VCID-ryby-gbcx-33ec
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.85
11
url pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.70
purl pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.70
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-kbpn-7esm-77ew
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.70
12
url pkg:rpm/redhat/tomcat@1:9.0.62-27.el8_9?arch=2
purl pkg:rpm/redhat/tomcat@1:9.0.62-27.el8_9?arch=2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h6f2-qgnu-bqf4
1
vulnerability VCID-jsyt-cmxf-gbh3
2
vulnerability VCID-kbpn-7esm-77ew
3
vulnerability VCID-urhs-6aus-syb1
resource_url http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/tomcat@1:9.0.62-27.el8_9%3Farch=2
13
url pkg:rpm/redhat/tomcat@1:9.0.62-37.el9_3?arch=1
purl pkg:rpm/redhat/tomcat@1:9.0.62-37.el9_3?arch=1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-h6f2-qgnu-bqf4
1
vulnerability VCID-jsyt-cmxf-gbh3
2
vulnerability VCID-kbpn-7esm-77ew
3
vulnerability VCID-urhs-6aus-syb1
resource_url http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/tomcat@1:9.0.62-37.el9_3%3Farch=1
References
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-42794.json
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-42794.json
1
reference_url https://github.com/apache/tomcat
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat
2
reference_url https://github.com/apache/tomcat/commit/43b882b8a577684498ab9b8851aa0427216784f7
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/43b882b8a577684498ab9b8851aa0427216784f7
3
reference_url https://github.com/apache/tomcat/commit/c99ffc30e95ddc4daede564d08cb5ea2b9a9da65
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/c99ffc30e95ddc4daede564d08cb5ea2b9a9da65
4
reference_url https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82
5
reference_url http://www.openwall.com/lists/oss-security/2023/10/10/8
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2023/10/10/8
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2243751
reference_id 2243751
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2243751
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42794
reference_id CVE-2023-42794
reference_type
scores
0
value Low
scoring_system apache_tomcat
scoring_elements
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42794
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-42794
reference_id CVE-2023-42794
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-42794
9
reference_url https://github.com/advisories/GHSA-jm7m-8jh6-29hp
reference_id GHSA-jm7m-8jh6-29hp
reference_type
scores
url https://github.com/advisories/GHSA-jm7m-8jh6-29hp
10
reference_url https://access.redhat.com/errata/RHSA-2023:7247
reference_id RHSA-2023:7247
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:7247
11
reference_url https://access.redhat.com/errata/RHSA-2023:7623
reference_id RHSA-2023:7623
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:7623
12
reference_url https://access.redhat.com/errata/RHSA-2024:0125
reference_id RHSA-2024:0125
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0125
13
reference_url https://access.redhat.com/errata/RHSA-2024:0474
reference_id RHSA-2024:0474
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0474
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 459
name Incomplete Cleanup
description The product does not properly clean up and remove temporary or supporting resources after they have been used.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
Exploits
Severity_range_score0.1 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-kbpn-7esm-77ew