Red Hat Security Advisory

RHSA-2008:1007

tomcat security update for Red Hat Network Satellite Server

Released 2008-12-08 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat Satellite 5.0 (RHEL v.4 AS) tomcat5-5.0.30-0jpp_12rh
Red Hat Satellite 5.1 (RHEL v.4 AS) tomcat5-5.0.30-0jpp_12rh

Fixes 5 records

TI-2008-02812 CVE-2008-2938 · GHSA-m7xj-ccqc-p4g2

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through…

HIGH 65

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encode…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.99708 Published 2008-08-13 Fixed in 4.1.39, 5.5.27 +1 CWE-22

TI-2008-01184 CVE-2008-1232 · GHSA-q74x-qqhr-f8rx

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0…

MEDIUM 59

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is u…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.75865 Published 2008-08-04 Fixed in 4.1.38, 5.5.27 +1 CWE-79

TI-2008-02274 CVE-2008-2370 · GHSA-m8h8-6rvg-f4mg

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when…

MEDIUM 55

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attacke…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.52716 Published 2008-08-04 Fixed in 4.1.38, 5.5.27 +1 CWE-22

TI-2008-01870 CVE-2008-1947 · GHSA-f98p-9pp6-7q6c

Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0…

LOW 32

Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) t…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.09776 Published 2008-06-04 Fixed in 5.5.27, 6.0.18 CWE-79

TI-2008-03133 CVE-2008-3271 · GHSA-5jpg-mjvg-hfhp

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP…

LOW 28

Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a differe…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04807 Published 2008-10-13 Fixed CWE-264