Red Hat Security AdvisoryRHSA-2016:2599
tomcat security, bug fix, and enhancement update
Released 2016-11-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.69-10.el7, tomcat-servlet-3.0-api-7.0.69-10.el7
- Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.69-10.el7, tomcat-admin-webapps-7.0.69-10.el7, tomcat-docs-webapp-7.0.69-10.el7 +6
- Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.69-10.el7, tomcat-servlet-3.0-api-7.0.69-10.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.69-10.el7, tomcat-admin-webapps-7.0.69-10.el7, tomcat-docs-webapp-7.0.69-10.el7 +6
- Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.69-10.el7, tomcat-admin-webapps-7.0.69-10.el7, tomcat-el-2.2-api-7.0.69-10.el7 +4
- Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.69-10.el7, tomcat-admin-webapps-7.0.69-10.el7, tomcat-docs-webapp-7.0.69-10.el7 +6
- Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.69-10.el7, tomcat-admin-webapps-7.0.69-10.el7, tomcat-el-2.2-api-7.0.69-10.el7 +4
- Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.69-10.el7, tomcat-javadoc-7.0.69-10.el7, tomcat-jsvc-7.0.69-10.el7
Fixes 8 records
Priority HIGH 65
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.37171 · Published 2016-07-04 · Partial fix · 1.3.2 CWE-20
Priority MEDIUM 59
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers…
CVSS 2.0HIGH 7.8· Network · No auth · Interaction — · EPSS 0.20183 · Published 2015-06-07 · Partial fix · 6.0.44, 7.0.55 +1 CWE-399
Priority MEDIUM 55
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass in…
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.13075 · Published 2016-02-25 · Partial fix · 9.0.0.M2, 8.0.32 +2 CWE-264
Priority MEDIUM 50
The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote att…
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.09667 · Published 2016-02-25 · Partial fix · 7.0.68, 8.0.31 +1 CWE-352
Priority MEDIUM 48
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attacker…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.1838 · Published 2016-02-25 · Partial fix · 9.0.0.M2, 8.0.30 +2 CWE-22
Priority MEDIUM 41
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalCont…
CVSS 3.0MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.11297 · Published 2016-02-25 · Partial fix · 7.0.68, 8.0.32 +1 CWE-264
Priority LOW 34
Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and lis…
CVSS 3.0MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.12555 · Published 2016-02-25 · Partial fix · 8.0.27, 7.0.65 +1 CWE-22
Priority LOW 29
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties…
CVSS 3.0MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.06113 · Published 2016-02-25 · Partial fix · 9.0.0.M2, 8.0.31 +1 CWE-200
THREATIST.IORead the docs