Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/47246?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/47246?format=api", "vulnerability_id": "VCID-uuya-uqgv-kyfb", "summary": "Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.", "aliases": [ { "alias": "CVE-2024-23672" }, { "alias": "GHSA-v682-8vv8-vpwr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/69388?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.99", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@8.5.99" }, { "url": "http://public2.vulnerablecode.io/api/packages/69387?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@9.0.86", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.86" }, { "url": "http://public2.vulnerablecode.io/api/packages/69386?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@10.1.19", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.19" }, { "url": "http://public2.vulnerablecode.io/api/packages/69385?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat@11.0.0-M17", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.0-M17" }, { "url": "http://public2.vulnerablecode.io/api/packages/69374?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.99", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.99" }, { "url": "http://public2.vulnerablecode.io/api/packages/69373?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.86", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.86" }, { "url": "http://public2.vulnerablecode.io/api/packages/69372?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.19", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.19" }, { "url": "http://public2.vulnerablecode.io/api/packages/69371?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@11.0.0-M17", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-websocket@11.0.0-M17" }, { "url": "http://public2.vulnerablecode.io/api/packages/69378?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.99", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.99" }, { "url": "http://public2.vulnerablecode.io/api/packages/69377?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.86", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.86" }, { "url": "http://public2.vulnerablecode.io/api/packages/69376?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.19", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@10.1.19" }, { "url": "http://public2.vulnerablecode.io/api/packages/69375?format=api", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@11.0.0-M17", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@11.0.0-M17" } ], "affected_packages": [], "references": [ { "reference_url": "https://github.com/apache/tomcat", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat" }, { "reference_url": "https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501" }, { "reference_url": "https://github.com/apache/tomcat/commit/3631adb1342d8bbd8598802a12b63ad02c37d591", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/3631adb1342d8bbd8598802a12b63ad02c37d591" }, { "reference_url": "https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068" }, { "reference_url": "https://github.com/apache/tomcat/commit/b0e3b1bd78de270d53e319d7cb79eb282aa53cb9", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/b0e3b1bd78de270d53e319d7cb79eb282aa53cb9" }, { "reference_url": "https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20240402-0002", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20240402-0002" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672", "reference_id": "CVE-2024-23672", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" }, { "reference_url": "https://github.com/advisories/GHSA-v682-8vv8-vpwr", "reference_id": "GHSA-v682-8vv8-vpwr", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-v682-8vv8-vpwr" } ], "weaknesses": [ { "cwe_id": 459, "name": "Incomplete Cleanup", "description": "The product does not properly clean up and remove temporary or supporting resources after they have been used." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": null, "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uuya-uqgv-kyfb" }