Red Hat Security AdvisoryRHSA-2020:5020
tomcat security update
Released 2020-11-10 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-16.el7_9, tomcat-servlet-3.0-api-7.0.76-16.el7_9
- Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-16.el7_9, tomcat-admin-webapps-7.0.76-16.el7_9, tomcat-docs-webapp-7.0.76-16.el7_9 +6
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-16.el7_9, tomcat-admin-webapps-7.0.76-16.el7_9, tomcat-docs-webapp-7.0.76-16.el7_9 +6
- Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-16.el7_9, tomcat-admin-webapps-7.0.76-16.el7_9, tomcat-el-2.2-api-7.0.76-16.el7_9 +4
- Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-16.el7_9, tomcat-admin-webapps-7.0.76-16.el7_9, tomcat-docs-webapp-7.0.76-16.el7_9 +6
- Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-16.el7_9, tomcat-admin-webapps-7.0.76-16.el7_9, tomcat-el-2.2-api-7.0.76-16.el7_9 +4
- Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-16.el7_9, tomcat-javadoc-7.0.76-16.el7_9, tomcat-jsvc-7.0.76-16.el7_9
Fixes 1 record
Priority MEDIUM 40
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid.
CVSS 3.1MEDIUM 4.8· Network · No auth · No interaction · EPSS 0.09386 · Published 2020-02-24 · Partial fix · 7.0.100, 8.5.51 +1 CWE-444
