TI-2018-08441 CVE-2018-11784 · GHSA-5q99-f34m-67gc
Open redirect in Apache Tomcat
Priority HIGH 65
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g.
RHSA-2019:1529
pki-deps:10.6 security update
Released 2019-06-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.0.0+3248+9d514f3b.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.0.0+3248+9d514f3b.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.0.0+3248+9d514f3b.noarch::pki-deps:10.6 +47
Fixes 4 records
TI-2018-05791 CVE-2018-8014 · GHSA-r4x2-3cq5-hqvp
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8…
Priority MEDIUM 61
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins.
TI-2018-05811 CVE-2018-8034 · GHSA-46j3-r4pj-4835
Improper certificate validation in Apache Tomcat
Priority MEDIUM 58
The host name verification when using TLS with the WebSocket client was missing.
TI-2018-05814 CVE-2018-8037 · GHSA-6v52-mj5r-7j2m
Race condition in Apache Tomcat
Priority MEDIUM 40
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user.