Red Hat Security AdvisoryRHSA-2017:2247
tomcat security, bug fix, and enhancement update
Released 2017-08-01 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-2.el7, tomcat-servlet-3.0-api-7.0.76-2.el7
- Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-docs-webapp-7.0.76-2.el7 +6
- Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.76-2.el7, tomcat-servlet-3.0-api-7.0.76-2.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-docs-webapp-7.0.76-2.el7 +6
- Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-el-2.2-api-7.0.76-2.el7 +4
- Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-docs-webapp-7.0.76-2.el7 +6
- Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-2.el7, tomcat-admin-webapps-7.0.76-2.el7, tomcat-el-2.2-api-7.0.76-2.el7 +4
- Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-2.el7, tomcat-javadoc-7.0.76-2.el7, tomcat-jsvc-7.0.76-2.el7
Fixes 5 records
Priority MEDIUM 60
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that…
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.10303 · Published 2017-08-10 · Partial fix · 9.0.0.M10, 8.5.5 +3 CWE-288
Priority MEDIUM 50
The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to thos…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0807 · Published 2017-08-10 · Partial fix · 9.0.0.M10, 8.5.5 +2 CWE-863
Priority MEDIUM 50
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.08321 · Published 2017-08-11 · Partial fix · 9.0.0.M10, 8.5.5 +3
Priority MEDIUM 43
The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not e…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.07991 · Published 2017-08-10 · Partial fix · 9.0.0.M10, 8.5.5 +3 CWE-203
Priority LOW 34
When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.07152 · Published 2017-08-10 · Partial fix · 6.0.47, 7.0.72 +3
THREATIST.IORead the docs