Red Hat Security Advisory

RHSA-2016:2807

Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7

Released 2016-11-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat7-7.0.54-23_patch_05.ep6.el6, tomcat7-admin-webapps-7.0.54-23_patch_05.ep6.el6, tomcat7-docs-webapp-7.0.54-23_patch_05.ep6.el6 +8
Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server tomcat7-7.0.54-23_patch_05.ep6.el7, tomcat7-admin-webapps-7.0.54-23_patch_05.ep6.el7, tomcat7-docs-webapp-7.0.54-23_patch_05.ep6.el7 +8

Fixes 6 records

TI-2016-02591 CVE-2016-3092 · GHSA-fvm3-cfvj-gxqq

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache…

HIGH 65

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.37171 Published 2016-07-04 Partial fix · 1.3.2 CWE-20

TI-2016-00643 CVE-2016-0714 · GHSA-mv42-px54-87jw

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before…

MEDIUM 55

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass in…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.13075 Published 2016-02-25 Partial fix · 9.0.0.M2, 8.0.32 +2 CWE-264

TI-2015-04505 CVE-2015-5351 · GHSA-w7cg-5969-678w

The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x…

MEDIUM 50

The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote att…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.09667 Published 2016-02-25 Partial fix · 7.0.68, 8.0.31 +1 CWE-352

TI-2015-04500 CVE-2015-5346 · GHSA-jrcp-c39h-r29x

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and…

MEDIUM 48

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, mi…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.10573 Published 2016-02-25 Partial fix · 9.0.0.M2, 8.0.31 +1 CWE-79

TI-2016-00682 CVE-2016-0763 · GHSA-9hjv-9h75-xmpp

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in…

MEDIUM 41

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalCont…

CVSS 3.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.11297 Published 2016-02-25 Partial fix · 7.0.68, 8.0.32 +1 CWE-264

TI-2016-00635 CVE-2016-0706 · GHSA-6vx3-hr43-cfrh

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before…

LOW 29

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties…

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.06113 Published 2016-02-25 Partial fix · 9.0.0.M2, 8.0.31 +1 CWE-200