Bug#1087884: tomcat10: CVE-2024-52318: XSS in generated JSPs

[Salvatore Bonaccorso]

Source: tomcat10
Version: 10.1.31-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for tomcat10.

CVE-2024-52318[0]:
| Incorrect object recycling and reuse vulnerability in Apache Tomcat.
| This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96.  Users
| are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97,
| which fixes the issue.

AFAIU this affects just the listed versions but not previous releases.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-52318
    https://www.cve.org/CVERecord?id=CVE-2024-52318
[1] https://lists.apache.org/thread/co243cw1nlh6p521c5265cm839wkqdp9 

Regards,
Salvatore