Red Hat Security Advisory

RHSA-2007:0326

tomcat security update

Released 2007-05-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Application Server v2 4AS jakarta-commons-modeler-2.0-3jpp_2rh, jakarta-commons-modeler-javadoc-2.0-3jpp_2rh, tomcat5-5.5.23-0jpp_4rh.3 +10
Red Hat Application Server v2 4ES jakarta-commons-modeler-2.0-3jpp_2rh, jakarta-commons-modeler-javadoc-2.0-3jpp_2rh, tomcat5-5.5.23-0jpp_4rh.3 +10
Red Hat Application Server v2 4WS jakarta-commons-modeler-2.0-3jpp_2rh, jakarta-commons-modeler-javadoc-2.0-3jpp_2rh, tomcat5-5.5.23-0jpp_4rh.3 +10

Fixes 7 records

TI-2007-00437 CVE-2007-0450 · GHSA-4prh-gqw8-rgh5

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and…

HIGH 66

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary fil…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.91158 Published 2007-03-16 Fixed in 5.5.22, 6.0.10 CWE-22

TI-2006-06937 CVE-2006-7196 · GHSA-pm78-wxxf-fw98

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache…

MEDIUM 58

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject ar…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.72168 Published 2007-05-09 Fixed in 4.0.7, 4.1.32 +2 CWE-79

TI-2006-03722 CVE-2006-3835 · GHSA-wfj7-mhr5-pcwq

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon…

MEDIUM 53

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.48051 Published 2006-07-25 Fixed in 5.5.17 CWE-200

TI-2005-01978 CVE-2005-2090 · GHSA-f2gq-p6qv-ccw4

Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers…

MEDIUM 42

Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Tran…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.26114 Published 2005-06-30 Fixed

TI-2007-01301 CVE-2007-1358 · GHSA-xmc9-6p56-3c4v

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat…

LOW 32

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Languag…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.19889 Published 2007-05-09 Fixed CWE-79

TI-2007-01781 CVE-2007-1858 · GHSA-cjg9-7x8h-6gw3

The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0…

LOW 31

The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.18254 Published 2007-05-09 Fixed

TI-2006-06936 CVE-2006-7195 · GHSA-p57v-p3fx-qgwm

Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0…

LOW 28

Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.05476 Published 2007-05-09 Fixed in 5.5.18 CWE-79