You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2024/07/05 08:12:50 UTC

[Bug 69167] New: Is tomcat10.1 impacted with these vulnerabilities (CVE-2024-5535, CVE-2024-4603, CVE-2024-2511)

https://bz.apache.org/bugzilla/show_bug.cgi?id=69167

            Bug ID: 69167
           Summary: Is tomcat10.1 impacted with these vulnerabilities
                    (CVE-2024-5535, CVE-2024-4603, CVE-2024-2511)
           Product: Tomcat Native
           Version: unspecified
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: major
          Priority: P2
         Component: Library
          Assignee: dev@tomcat.apache.org
          Reporter: zjhua2002@163.com
  Target Milestone: ---

Hi colleague,

In BDBA (Black Duck Binary Analysis) scans, it detected a critical
vulnerability: CVE-2024-5535(https://nvd.nist.gov/vuln/detail/CVE-2024-5535) in
openssl 3.0.13 in Tomcat 10.1.20

The detected object is: apache-tomcat-10.1.20/bin/tcnative-2.dll

There are other vulnerabilities inside OpenSSL, such as CVE-2024-4603,
CVE-2024-2511.

Pls. kindly help check whether it is true positive or not in Tomcat, and when
and which release it will be mitigated?


Best regards,
Peyton Zhong

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

[Bug 69167] Is tomcat10.1 impacted with these vulnerabilities (CVE-2024-5535, CVE-2024-4603, CVE-2024-2511)

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69167

--- Comment #2 from Mariah Carey <ma...@gmail.com> ---
(In reply to Mark Thomas from comment #1)
> Bugzilla is not a support forum. Please direct you question to the Tomcat
> users mailing list.
> 
> https://yoplay.io https://tomcat.apache.org/lists.html#tomcat-users

Thanks, I sent it again!

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

[Bug 69167] Is tomcat10.1 impacted with these vulnerabilities (CVE-2024-5535, CVE-2024-4603, CVE-2024-2511)

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69167

Mark Thomas <ma...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |INVALID

--- Comment #1 from Mark Thomas <ma...@apache.org> ---
Bugzilla is not a support forum. Please direct you question to the Tomcat users
mailing list.

https://tomcat.apache.org/lists.html#tomcat-users

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org