| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat:tomcat | ≥ 10.0.0-M1, < 10.0.0-M6≥ 8.5.1, < 8.5.56≥ 9.0.0.M5, < 9.0.36 | 10.0.0-M68.5.569.0.36 |
| org.apache.tomcat:tomcat-coyote | ≥ 10.0.0-M1, < 10.0.0-M6≥ 8.5.1, < 8.5.56≥ 9.0.0.M5, < 9.0.36 | 10.0.0-M68.5.569.0.36 |
| tomcat | = 10.0.0= 9.0.0≥ 8.5.1, ≤ 8.5.56≥ 9.0.1, ≤ 9.0.36 | |
| oncommand system manager | ≥ 3.0.0, ≤ 3.1.3 | |
| agile engineering data management | = 6.2.1.0 | |
| agile product lifecycle management | = 9.3.3= 9.3.5= 9.3.6 | |
| communications instant messaging server | = 10.0.1.5.0 | |
| fmw platform | = 12.2.1.3.0= 12.2.1.4.0 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| managed file transfer | = 12.2.1.3.0= 12.2.1.4.0 | |
| mysql enterprise monitor | ≤ 8.0.21 | |
| siebel ui framework | ≤ 20.12 | |
| workload manager | = 12.2.0.1= 18c= 19c |
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free