Red Hat Security Advisory

RHSA-2008:0862

tomcat security update

Released 2008-10-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Application Server v2 4AS tomcat5-5.5.23-0jpp_4rh.9, tomcat5-admin-webapps-5.5.23-0jpp_4rh.9, tomcat5-common-lib-5.5.23-0jpp_4rh.9 +8
Red Hat Application Server v2 4ES tomcat5-5.5.23-0jpp_4rh.9, tomcat5-admin-webapps-5.5.23-0jpp_4rh.9, tomcat5-common-lib-5.5.23-0jpp_4rh.9 +8
Red Hat Application Server v2 4WS tomcat5-5.5.23-0jpp_4rh.9, tomcat5-admin-webapps-5.5.23-0jpp_4rh.9, tomcat5-common-lib-5.5.23-0jpp_4rh.9 +8

Fixes 6 records

TI-2008-02812 CVE-2008-2938 · GHSA-m7xj-ccqc-p4g2

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through…

HIGH 65

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encode…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.99708 Published 2008-08-13 Fixed in 4.1.39, 5.5.27 +1 CWE-22

TI-2008-01184 CVE-2008-1232 · GHSA-q74x-qqhr-f8rx

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0…

MEDIUM 59

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is u…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.75865 Published 2008-08-04 Fixed in 4.1.38, 5.5.27 +1 CWE-79

TI-2008-02274 CVE-2008-2370 · GHSA-m8h8-6rvg-f4mg

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when…

MEDIUM 55

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attacke…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.52716 Published 2008-08-04 Fixed in 4.1.38, 5.5.27 +1 CWE-22

TI-2007-05247 CVE-2007-5461 · GHSA-v5p2-vg3c-pmrr

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0…

MEDIUM 44

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.39681 Published 2007-10-15 Fixed CWE-22

TI-2007-05139 CVE-2007-5342 · GHSA-w65j-cmqc-37p2

The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through…

LOW 36

The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify loggin…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.05156 Published 2007-12-27 Fixed CWE-264

TI-2008-01870 CVE-2008-1947 · GHSA-f98p-9pp6-7q6c

Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0…

LOW 32

Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) t…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.09776 Published 2008-06-04 Fixed in 5.5.27, 6.0.18 CWE-79