Read the docs
Red Hat Security Advisory

RHSA-2017:0457

Red Hat JBoss Web Server security and enhancement update

Released 2017-03-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 11 records

TI-2016-07192 CVE-2016-8735 · GHSA-cw54-59pw-4g8c

Improper access control in Apache Tomcat

Priority CRITICAL 100KEV

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX p…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.90338 Published 2017-04-06 Partial fix · 6.0.48, 7.0.73 +3 CWE-284
TI-2016-02591 CVE-2016-3092 · GHSA-fvm3-cfvj-gxqq

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache…

Priority HIGH 65

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.37171 Published 2016-07-04 Partial fix · 1.3.2 CWE-20
TI-2016-04337 CVE-2016-5018 · GHSA-4v3g-g84w-hv7r

Authentication bypass in Apache Tomcat

Priority MEDIUM 60

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.10303 Published 2017-08-10 Partial fix · 9.0.0.M10, 8.5.5 +3 CWE-288
TI-2016-05857 CVE-2016-6816 · GHSA-jc7p-5r39-9477

Improper input validation in Apache Tomcat

Priority MEDIUM 59

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters.

CVSS 3.0HIGH 7.1 Network No auth User interaction EPSS 0.39633 Published 2017-03-20 Partial fix · 9.0.0.M12, 8.5.8 +3 CWE-20
TI-2016-07202 CVE-2016-8745 · GHSA-w3j5-q8f2-3cqq

Race condition in Apache Tomcat

Priority MEDIUM 55

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Proce…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.16038 Published 2017-08-10 Partial fix · 9.0.0.M14, 8.5.9 +3 CWE-388
TI-2016-05838 CVE-2016-6797 · GHSA-q6x7-f33r-3wxx

Incorrect authorization in Apache Tomcat

Priority MEDIUM 50

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to thos…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0807 Published 2017-08-10 Partial fix · 9.0.0.M10, 8.5.5 +2 CWE-863
TI-2016-05837 CVE-2016-6796 · GHSA-3mjp-p938-4329

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to…

Priority MEDIUM 50

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08321 Published 2017-08-11 Partial fix · 9.0.0.M10, 8.5.5 +3
TI-2016-01138 CVE-2016-1240 · GHSA-8c5c-v572-37xf

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package…

Priority MEDIUM 46

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS,…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.09783 Published 2016-10-03 Partial fix CWE-20
TI-2016-00681 CVE-2016-0762 · GHSA-wxcp-f2c8-x6xv

Observable discrepancy in Apache Tomcat

Priority MEDIUM 43

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not e…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.07991 Published 2017-08-10 Partial fix · 9.0.0.M10, 8.5.5 +3 CWE-203
TI-2016-05415 CVE-2016-6325 · GHSA-398j-w8vh-r865

The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0…

Priority LOW 35

The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to ga…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00693 Published 2016-10-13 Partial fix CWE-264