Read the docs
Red Hat Security Advisory

RHSA-2020:1521

Red Hat JBoss Web Server 5.3 release

Released 2020-04-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 5 records

TI-2020-01862 CVE-2020-1938 · GHSA-c9hw-wf7x-jp9j

Improper privilege management in Apache Tomcat

Priority CRITICAL 100KEV

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9927 Published 2020-02-24 Partial fix · 9.0.31, 8.5.51 +1 CWE-269
TI-2019-13106 CVE-2019-17563 · GHSA-9xcj-c8cr-8c3c

Session fixation in Apache Tomcat

Priority MEDIUM 48

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.10687 Published 2019-12-23 Partial fix · 7.0.99, 8.5.50 +1 CWE-384
TI-2020-01859 CVE-2020-1935 · GHSA-qxf4-chvg-4r8r

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header…

Priority MEDIUM 40

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.09386 Published 2020-02-24 Partial fix · 7.0.100, 8.5.51 +1 CWE-444
TI-2019-09263 CVE-2019-12418 · GHSA-hh3j-x4mc-g48r

Insufficiently protected credentials in Apache Tomcat

Priority LOW 35

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manip…

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.01221 Published 2019-12-23 Partial fix · 7.0.99, 8.5.49 +1 CWE-522