Red Hat Security AdvisoryRHSA-2007:0871
tomcat security update
Released 2007-09-26 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) tomcat5-5.5.23-0jpp.3.0.2.el5, tomcat5-5.5.23-0jpp.3.0.2.el5.i386, tomcat5-5.5.23-0jpp.3.0.2.el5.ia64 +41
- Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5-5.5.23-0jpp.3.0.2.el5, tomcat5-jsp-2.0-api-5.5.23-0jpp.3.0.2.el5, tomcat5-jsp-2.0-api-5.5.23-0jpp.3.0.2.el5.i386 +2
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) tomcat5-5.5.23-0jpp.3.0.2.el5, tomcat5-5.5.23-0jpp.3.0.2.el5.i386, tomcat5-admin-webapps-5.5.23-0jpp.3.0.2.el5 +15
Fixes 3 records
Priority MEDIUM 54
Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstr…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.58956 · Published 2007-08-14 · Fixed CWE-79
Priority MEDIUM 47
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be le…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.37497 · Published 2007-08-14 · Fixed CWE-200
Priority LOW 37
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as ses…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.16944 · Published 2007-08-14 · Fixed CWE-200
THREATIST.IORead the docs