Red Hat Security AdvisoryRHSA-2009:1454
tomcat5 security update
Released 2009-09-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server tomcat5-5.5.23-0jpp.9.6.ep5.el5, tomcat5-admin-webapps-5.5.23-0jpp.9.6.ep5.el5, tomcat5-common-lib-5.5.23-0jpp.9.6.ep5.el5 +8
- Red Hat JBoss Web Server 1.0 for RHEL 4 AS tomcat5-5.5.23-1.patch07.19.ep5.el4, tomcat5-admin-webapps-5.5.23-1.patch07.19.ep5.el4, tomcat5-common-lib-5.5.23-1.patch07.19.ep5.el4 +8
- Red Hat JBoss Web Server 1.0 for RHEL 4 ES tomcat5-5.5.23-1.patch07.19.ep5.el4, tomcat5-admin-webapps-5.5.23-1.patch07.19.ep5.el4, tomcat5-common-lib-5.5.23-1.patch07.19.ep5.el4 +8
Fixes 5 records
Priority MEDIUM 64
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.9444 · Published 2009-06-05 · Fixed in 4.1.40, 5.5.28 +1 CWE-200
Priority MEDIUM 58
Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause se…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.62575 · Published 2008-02-12 · Fixed in 6.0.15, 5.5.26 +1 CWE-200
Priority MEDIUM 41
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, whic…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.18685 · Published 2009-06-16 · Fixed in 4.1.40, 5.5.28 +1 CWE-22
Priority LOW 35
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.10053 · Published 2009-06-05 · Fixed CWE-20
Priority LOW 21
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web…
CVSS 3.0MEDIUM 4.2· Local · High privileges · No interaction · EPSS 0.00809 · Published 2009-06-05 · Fixed in 6.0.20 CWE-200
THREATIST.IORead the docs