Red Hat Security AdvisoryRHSA-2007:1069
tomcat security update for Red Hat Network Satellite Server
Released 2007-11-26 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Satellite 5.0 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.0 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.0 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.1 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.1 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.2 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.2 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
Fixes 7 records
Priority HIGH 66
Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary fil…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.91158 · Published 2007-03-16 · Fixed in 5.5.22, 6.0.10 CWE-22
Priority MEDIUM 53
Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.48051 · Published 2006-07-25 · Fixed in 5.5.17 CWE-200
Priority MEDIUM 47
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be le…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.37497 · Published 2007-08-14 · Fixed CWE-200
Priority MEDIUM 42
Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Tran…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.26114 · Published 2005-06-30 · Fixed
Priority LOW 37
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as ses…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.16944 · Published 2007-08-14 · Fixed CWE-200
Priority LOW 32
Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.05954 · Published 2005-11-06 · Fixed in 5.5.12 CWE-770
Priority LOW 31
The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to…
CVSS 2.0LOW 2.6· Network · No auth · Interaction — · EPSS 0.18254 · Published 2007-05-09 · Fixed
THREATIST.IORead the docs