Red Hat Security AdvisoryRHSA-2019:2205
tomcat security, bug fix, and enhancement update
Released 2019-08-06 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-9.el7, tomcat-servlet-3.0-api-7.0.76-9.el7
- Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-9.el7, tomcat-admin-webapps-7.0.76-9.el7, tomcat-docs-webapp-7.0.76-9.el7 +6
- Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.76-9.el7, tomcat-servlet-3.0-api-7.0.76-9.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-9.el7, tomcat-admin-webapps-7.0.76-9.el7, tomcat-docs-webapp-7.0.76-9.el7 +6
- Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-9.el7, tomcat-admin-webapps-7.0.76-9.el7, tomcat-el-2.2-api-7.0.76-9.el7 +4
- Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-9.el7, tomcat-admin-webapps-7.0.76-9.el7, tomcat-docs-webapp-7.0.76-9.el7 +6
- Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-9.el7, tomcat-admin-webapps-7.0.76-9.el7, tomcat-el-2.2-api-7.0.76-9.el7 +4
- Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-9.el7, tomcat-javadoc-7.0.76-9.el7, tomcat-jsvc-7.0.76-9.el7
Fixes 4 records
Priority MEDIUM 61
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.20942 · Published 2018-05-16 · Partial fix · 9.0.9, 8.5.32 +2 CWE-1188
Priority MEDIUM 58
The host name verification when using TLS with the WebSocket client was missing.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.21048 · Published 2018-08-01 · Partial fix · 9.0.10, 8.5.32 +2 CWE-295
Priority MEDIUM 49
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.1707 · Published 2018-02-28 · Partial fix · 9.0.5, 8.5.28 +2
Priority MEDIUM 44
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.14472 · Published 2018-02-23 · Partial fix · 9.0.5, 8.5.28 +1
THREATIST.IORead the docs