Incomplete Cleanup vulnerability in Apache Tomcat.
The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased,
in progress refactoring that exposed a potential denial of service on
Windows if a web application opened a stream for an uploaded file but
failed to close the stream. The file would never be deleted from disk
creating the possibility of an eventual denial of service due to the
disk being full.
Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2023/10/10/8 | Mailing List Third Party Advisory |
| https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82 | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2023/10/10/8 | Mailing List Third Party Advisory |
| https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82 | Mailing List Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Feb 2025, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. |
Information
Published : 2023-10-10 18:15
Updated : 2025-02-13 17:17
NVD link : CVE-2023-42794
Mitre link : CVE-2023-42794
CVE.ORG link : CVE-2023-42794
JSON object : View
Products Affected
apache
- tomcat
CWE
CWE-459
Incomplete Cleanup