Advisory details:
gitlab / maven/org.apache.tomcat/tomcat/CVE-2023-42794
| Advisory ID | gitlab/maven/org.apache.tomcat/tomcat/CVE-2023-42794 |
| Aliases |
CVE-2023-42794
GHSA-jm7m-8jh6-29hp |
| Summary | Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2023-42794.yml |
| Reference id | Reference type | URL |
|---|---|---|
| https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82 | ||
| http://www.openwall.com/lists/oss-security/2023/10/10/8 | ||
| CVE-2023-42794 | https://nvd.nist.gov/vuln/detail/CVE-2023-42794 | |
| GHSA-jm7m-8jh6-29hp | https://github.com/advisories/GHSA-jm7m-8jh6-29hp |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.