Red Hat Security AdvisoryRHSA-2020:4004
tomcat security and bug fix update
Released 2020-09-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-15.el7, tomcat-servlet-3.0-api-7.0.76-15.el7
- Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-docs-webapp-7.0.76-15.el7 +6
- Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.76-15.el7, tomcat-servlet-3.0-api-7.0.76-15.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-docs-webapp-7.0.76-15.el7 +6
- Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-el-2.2-api-7.0.76-15.el7 +4
- Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-docs-webapp-7.0.76-15.el7 +6
- Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-15.el7, tomcat-admin-webapps-7.0.76-15.el7, tomcat-el-2.2-api-7.0.76-15.el7 +4
- Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-15.el7, tomcat-javadoc-7.0.76-15.el7, tomcat-jsvc-7.0.76-15.el7
Fixes 2 records
Priority HIGH 81
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.86608 · Published 2020-07-14 · Partial fix · 10.0.0-M7, 9.0.37 +2 CWE-835
Priority MEDIUM 48
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.10687 · Published 2019-12-23 · Partial fix · 7.0.99, 8.5.50 +1 CWE-384
