Red Hat Security AdvisoryRHSA-2016:2046
tomcat security update
Released 2016-10-10 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.54-8.el7_2, tomcat-servlet-3.0-api-7.0.54-8.el7_2
- Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.54-8.el7_2, tomcat-admin-webapps-7.0.54-8.el7_2, tomcat-docs-webapp-7.0.54-8.el7_2 +6
- Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.54-8.el7_2, tomcat-servlet-3.0-api-7.0.54-8.el7_2
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.54-8.el7_2, tomcat-admin-webapps-7.0.54-8.el7_2, tomcat-docs-webapp-7.0.54-8.el7_2 +6
- Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.54-8.el7_2, tomcat-admin-webapps-7.0.54-8.el7_2, tomcat-el-2.2-api-7.0.54-8.el7_2 +4
- Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.54-8.el7_2, tomcat-admin-webapps-7.0.54-8.el7_2, tomcat-docs-webapp-7.0.54-8.el7_2 +6
- Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.54-8.el7_2, tomcat-admin-webapps-7.0.54-8.el7_2, tomcat-el-2.2-api-7.0.54-8.el7_2 +4
- Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.54-8.el7_2, tomcat-javadoc-7.0.54-8.el7_2, tomcat-jsvc-7.0.54-8.el7_2
Fixes 5 records
Priority HIGH 67
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_…
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.50896 · Published 2016-07-19 · Partial fix · 7.0.72, 8.5.5 CWE-284
Priority MEDIUM 48
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, mi…
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.10573 · Published 2016-02-25 · Partial fix · 9.0.0.M2, 8.0.31 +1 CWE-79
Priority MEDIUM 44
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessibl…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.13349 · Published 2015-06-07 · Partial fix · 6.0.44, 7.0.58 +1 CWE-284
Priority MEDIUM 41
The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain ro…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.03782 · Published 2016-10-13 · Fixed CWE-276
Priority LOW 35
The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to ga…
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00693 · Published 2016-10-13 · Partial fix CWE-264
THREATIST.IORead the docs