DX NetOps Spectrum: CVE-2023-24998 - Apache Tomcat denial of service

Products

• CA Spectrum
• DX NetOps

Issue/Introduction

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.

Environment

Release : All Spectrum releases

Resolution

You must upgrade to 22.2.7 to resolve this vulnerability.

DX NetOps 22.2.7 upgrades Tomcat to 9.0.73 as well as Java : Adapt Open JDK(64) 11.0.18

The release notes are available here

There is, unfortunately, no workaround for this issue or any patches that can be provided an upgrade to 22.2.7 or higher is the only solution.



Update: CVE-2023-28709
   DX NetOps Spectrum: CVE-2023-28709 - Apache Tomcat denial of service