What is GHSA-jm7m-8jh6-29hp?

GHSA-jm7m-8jh6-29hp is a security advisory published by GitHub Security Advisories with Medium severity. Apache Tomcat Incomplete Cleanup vulnerability

Which CVE IDs does GHSA-jm7m-8jh6-29hp cover?

GHSA-jm7m-8jh6-29hp covers the following CVE IDs: CVE-2023-42794. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jm7m-8jh6-29hp?

GHSA-jm7m-8jh6-29hp has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-jm7m-8jh6-29hp?

GHSA-jm7m-8jh6-29hp affects 2 products, including: maven/org.apache.tomcat:tomcat-coyote:\u003e= 9.0.70, \u003c 9.0.81; maven/org.apache.tomcat:tomcat-coyote:\u003e= 8.5.85, \u003c 8.5.94.

GHSA-jm7m-8jh6-29hpMediumCVSS 5.9

Apache Tomcat Incomplete Cleanup vulnerability

Vendor

GitHub Security Advisories

Published

October 10, 2023

Last Modified

February 13, 2025

🔗 CVE IDs covered (1)

CVE-2023-42794 →

📋 Description

Incomplete Cleanup vulnerability in Apache Tomcat.

The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full.

Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

🎯 Affected products2

maven/org.apache.tomcat:tomcat-coyote:>= 9.0.70, < 9.0.81
maven/org.apache.tomcat:tomcat-coyote:>= 8.5.85, < 8.5.94

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-42794
https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82
http://www.openwall.com/lists/oss-security/2023/10/10/8
https://github.com/advisories/GHSA-jm7m-8jh6-29hp