Inadequate Encryption Strength Affecting org.apache.tomcat.embed:tomcat-embed-core package, versions [9.0.93,9.0.96) [10.1.28,10.1.31) [11.0.0-M24,11.0.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHETOMCATEMBED-8383918
- published 19 Nov 2024
- disclosed 18 Nov 2024
- credit Tomcat Security Team
Introduced: 18 Nov 2024
New CVE-2024-52317 Open this link in a new tabHow to fix?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.96, 10.1.31, 11.0.0 or higher.
Overview
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.
Affected versions of this package are vulnerable to Inadequate Encryption Strength due to incorrect recycling of the request and response used by HTTP/2 requests. An attacker can cause a mix-up of requests and/or responses between users by exploiting the reuse of incorrect objects.