Red Hat Security Advisory

RHSA-2008:0864

tomcat security update

Released 2008-10-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Developer Suite v.3 (AS v.4) tomcat5-5.5.23-0jpp_12rh, tomcat5-common-lib-5.5.23-0jpp_12rh, tomcat5-jasper-5.5.23-0jpp_12rh +3

Fixes 4 records

TI-2008-02812 CVE-2008-2938 · GHSA-m7xj-ccqc-p4g2

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through…

HIGH 65

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encode…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.99708 Published 2008-08-13 Fixed in 4.1.39, 5.5.27 +1 CWE-22

TI-2008-01184 CVE-2008-1232 · GHSA-q74x-qqhr-f8rx

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0…

MEDIUM 59

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is u…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.75865 Published 2008-08-04 Fixed in 4.1.38, 5.5.27 +1 CWE-79

TI-2008-02274 CVE-2008-2370 · GHSA-m8h8-6rvg-f4mg

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when…

MEDIUM 55

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attacke…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.52716 Published 2008-08-04 Fixed in 4.1.38, 5.5.27 +1 CWE-22

TI-2008-01870 CVE-2008-1947 · GHSA-f98p-9pp6-7q6c

Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0…

LOW 32

Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) t…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.09776 Published 2008-06-04 Fixed in 5.5.27, 6.0.18 CWE-79