Red Hat Security AdvisoryRHSA-2017:0935
tomcat security update
Released 2017-04-12 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.69-11.el7_3, tomcat-servlet-3.0-api-7.0.69-11.el7_3
- Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.69-11.el7_3, tomcat-admin-webapps-7.0.69-11.el7_3, tomcat-docs-webapp-7.0.69-11.el7_3 +6
- Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.69-11.el7_3, tomcat-servlet-3.0-api-7.0.69-11.el7_3
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.69-11.el7_3, tomcat-admin-webapps-7.0.69-11.el7_3, tomcat-docs-webapp-7.0.69-11.el7_3 +6
- Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.69-11.el7_3, tomcat-admin-webapps-7.0.69-11.el7_3, tomcat-el-2.2-api-7.0.69-11.el7_3 +4
- Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.69-11.el7_3, tomcat-admin-webapps-7.0.69-11.el7_3, tomcat-docs-webapp-7.0.69-11.el7_3 +6
- Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.69-11.el7_3, tomcat-admin-webapps-7.0.69-11.el7_3, tomcat-el-2.2-api-7.0.69-11.el7_3 +4
- Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.69-11.el7_3, tomcat-javadoc-7.0.69-11.el7_3, tomcat-jsvc-7.0.69-11.el7_3
Fixes 2 records
Priority MEDIUM 59
The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters.
CVSS 3.0HIGH 7.1· Network · No auth · User interaction · EPSS 0.39633 · Published 2017-03-20 · Partial fix · 9.0.0.M12, 8.5.8 +3 CWE-20
Priority MEDIUM 55
A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Proce…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.16038 · Published 2017-08-10 · Partial fix · 9.0.0.M14, 8.5.9 +3 CWE-388
