Red Hat Security AdvisoryRHSA-2016:2045
tomcat6 security and bug fix update
Released 2016-10-10 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) tomcat6-6.0.24-98.el6_8, tomcat6-admin-webapps-6.0.24-98.el6_8, tomcat6-docs-webapp-6.0.24-98.el6_8 +6
- Red Hat Enterprise Linux HPC Node (v. 6) tomcat6-6.0.24-98.el6_8, tomcat6-admin-webapps-6.0.24-98.el6_8, tomcat6-docs-webapp-6.0.24-98.el6_8 +6
- Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-98.el6_8, tomcat6-admin-webapps-6.0.24-98.el6_8, tomcat6-docs-webapp-6.0.24-98.el6_8 +6
- Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-98.el6_8, tomcat6-admin-webapps-6.0.24-98.el6_8, tomcat6-docs-webapp-6.0.24-98.el6_8 +6
Fixes 6 records
Priority HIGH 67
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_…
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.50896 · Published 2016-07-19 · Partial fix · 7.0.72, 8.5.5 CWE-284
Priority MEDIUM 55
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass in…
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.13075 · Published 2016-02-25 · Partial fix · 9.0.0.M2, 8.0.32 +2 CWE-264
Priority MEDIUM 48
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attacker…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.1838 · Published 2016-02-25 · Partial fix · 9.0.0.M2, 8.0.30 +2 CWE-22
Priority LOW 35
The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to ga…
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00693 · Published 2016-10-13 · Partial fix CWE-264
Priority LOW 34
Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and lis…
CVSS 3.0MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.12555 · Published 2016-02-25 · Partial fix · 8.0.27, 7.0.65 +1 CWE-22
Priority LOW 29
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties…
CVSS 3.0MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.06113 · Published 2016-02-25 · Partial fix · 9.0.0.M2, 8.0.31 +1 CWE-200
THREATIST.IORead the docs