CVE-2024-21733
Fixed in a distro release EPSS 14%CVSS 5.3
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.64 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.44 |
| Maven | org.apache.tomcat.experimental:tomcat-embed-programmatic | 9.0.44 |
| Maven | org.apache.tomcat:tomcat-coyote | 9.0.44 |
| Maven | org.apache.tomcat:tomcat-coyote | 8.5.64 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | tomcat9 | 9.0.43-2~deb11u11 |
| Debian 12 | tomcat9 | 9.0.53-1 |
| Debian 13 | tomcat9 | 9.0.53-1 |
| Debian 14 | tomcat9 | 9.0.53-1 |
| SUSE Linux Enterprise Server 12 SP5 | tomcat | 9.0.36-3.121.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | tomcat | 9.0.115-3.160.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | tomcat | 9.0.115-3.160.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | tomcat | 9.0.36-3.121.1 |
| Ubuntu Pro 14.04 LTS | tomcat6 | no fix |
| Ubuntu Pro 18.04 LTS | tomcat8 | 8.5.39-1ubuntu1~18.04.3+esm5 |
| Ubuntu Pro 18.04 LTS | tomcat9 | 9.0.16-3ubuntu0.18.04.2+esm7 |
| Ubuntu Pro 20.04 LTS | tomcat9 | 9.0.31-1ubuntu0.9+esm2 |
| Ubuntu Pro 22.04 LTS | tomcat9 | 9.0.58-1ubuntu0.2+esm3 |
| Ubuntu Pro 24.04 LTS | tomcat10 | 10.1.16-1ubuntu0.1~esm2 |
| Ubuntu Pro 24.04 LTS | tomcat9 | 9.0.70-2ubuntu0.1+esm2 |