CVE-2024-21733: Apache Tomcat sensitive information disclosure in error messages

CVE-2024-21733 · Severity: medium · CVSS 5.3 · Published 2024-01-19

Apache Tomcat, a widely used web server for Java applications, is vulnerable to a flaw where it may reveal sensitive information in error messages. An attacker could potentially use this information to gain insights into the server's environment or internal data. Organizations should update to the latest versions to prevent this data exposure.

Technologies: Apache Tomcat, org.apache.tomcat:tomcat-coyote (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2024-21733 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-21733 being exploited in the wild.
How severe is CVE-2024-21733?
Medium severity, with a CVSS score of 5.3, published 19 January 2024.
Which products and versions are affected?
Apache Tomcat 8.5.7 to 8.5.63, 9.0.0-M11 to 9.0.43; org.apache.tomcat:tomcat-coyote (Maven) ECOSYSTEM:introduced=9.0.0-M11,fixed=9.0.44; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=8.5.7,fixed=8.5.64; org.apache.tomcat.experimental:tomcat-embed-programmatic (Maven) ECOSYSTEM:introduced=9.0.43,fixed=9.0.44.
Is there a fix for CVE-2024-21733?
Yes. org.apache.tomcat:tomcat-coyote (Maven): upgrade to 9.0.44 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 8.5.64 or later; org.apache.tomcat.experimental:tomcat-embed-programmatic (Maven): upgrade to 9.0.44 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-21733 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-21733?
Check whether you run Apache Tomcat, org.apache.tomcat:tomcat-coyote (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat-coyote (Maven): upgrade to 9.0.44 or later
    # set org.apache.tomcat:tomcat-coyote to 9.0.44 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 8.5.64 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 8.5.64 in your pom.xml or build.gradle
  • org.apache.tomcat.experimental:tomcat-embed-programmatic (Maven): upgrade to 9.0.44 or later
    # set org.apache.tomcat.experimental:tomcat-embed-programmatic to 9.0.44 in your pom.xml or build.gradle

Technical details

Apache Tomcat is vulnerable to CWE-209 (Generation of Error Message Containing Sensitive Information). The vulnerability allows a remote, unauthenticated attacker to trigger error responses that include sensitive details about the server environment or associated data. This issue is related to how the Coyote HTTP connector handles certain request scenarios, potentially leading to information disclosure or HTTP response smuggling. The flaw is fixed in Apache Tomcat versions 8.5.64 and 9.0.44.

Affected products

  • Apache Tomcat 8.5.7 to 8.5.63, 9.0.0-M11 to 9.0.43

Identifiers

  • CVE-2024-21733
  • GHSA-f4qf-m5gf-8jm8

Timeline

  • 2024-01-19: disclosed
  • 2024-01-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.