Red Hat Security Advisory

RHSA-2017:3080

tomcat6 security update

Released 2017-10-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6-6.0.24-111.el6_9, tomcat6-admin-webapps-6.0.24-111.el6_9, tomcat6-docs-webapp-6.0.24-111.el6_9 +6
Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6-6.0.24-111.el6_9, tomcat6-admin-webapps-6.0.24-111.el6_9, tomcat6-docs-webapp-6.0.24-111.el6_9 +6
Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-111.el6_9, tomcat6-el-2.1-api-6.0.24-111.el6_9, tomcat6-jsp-2.1-api-6.0.24-111.el6_9 +2
Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-admin-webapps-6.0.24-111.el6_9, tomcat6-docs-webapp-6.0.24-111.el6_9, tomcat6-javadoc-6.0.24-111.el6_9 +1
Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-111.el6_9, tomcat6-el-2.1-api-6.0.24-111.el6_9, tomcat6-jsp-2.1-api-6.0.24-111.el6_9 +2
Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-admin-webapps-6.0.24-111.el6_9, tomcat6-docs-webapp-6.0.24-111.el6_9, tomcat6-javadoc-6.0.24-111.el6_9 +1

Fixes 4 records

TI-2017-09342 CVE-2017-12617 · GHSA-xjgh-84hx-56c5

Unrestricted file upload in Apache Tomcat

CRITICAL 94KEV

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.99968 Published 2017-10-03 Partial fix · 9.0.1, 8.5.23 +2 CWE-434

TI-2017-09340 CVE-2017-12615 · GHSA-pjfr-qf3p-3q25

Unrestricted file upload in Apache Tomcat

CRITICAL 94KEV

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.99707 Published 2017-09-19 Fixed in 7.0.79 CWE-434

TI-2017-03664 CVE-2017-5664 · GHSA-jmvv-524f-hj5j

Improper handling of exceptional conditions in Apache Tomcat

MEDIUM 56

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error pag…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.16567 Published 2017-06-06 Partial fix · 9.0.0.M21, 8.5.15 +2 CWE-755

TI-2017-03647 CVE-2017-5647 · GHSA-3gv7-3h64-78cm

Information disclosure in Apache Tomcat

MEDIUM 50

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined reques…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.1684 Published 2017-04-17 Partial fix · 9.0.0.M19, 8.5.13 +3 CWE-200