Red Hat Security AdvisoryRHSA-2021:0882
tomcat security update
Released 2021-03-16 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) tomcat-7.0.76-11.el7_6, tomcat-servlet-3.0-api-7.0.76-11.el7_6
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) tomcat-7.0.76-11.el7_6, tomcat-admin-webapps-7.0.76-11.el7_6, tomcat-docs-webapp-7.0.76-11.el7_6 +6
- Red Hat Enterprise Linux Server EUS (v. 7.6) tomcat-7.0.76-11.el7_6, tomcat-admin-webapps-7.0.76-11.el7_6, tomcat-el-2.2-api-7.0.76-11.el7_6 +4
- Red Hat Enterprise Linux Server Optional EUS (v. 7.6) tomcat-7.0.76-11.el7_6, tomcat-admin-webapps-7.0.76-11.el7_6, tomcat-docs-webapp-7.0.76-11.el7_6 +6
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) tomcat-7.0.76-11.el7_6, tomcat-admin-webapps-7.0.76-11.el7_6, tomcat-el-2.2-api-7.0.76-11.el7_6 +4
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) tomcat-7.0.76-11.el7_6, tomcat-admin-webapps-7.0.76-11.el7_6, tomcat-docs-webapp-7.0.76-11.el7_6 +6
Fixes 2 records
Priority MEDIUM 48
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.10687 · Published 2019-12-23 · Partial fix · 7.0.99, 8.5.50 +1 CWE-384
Priority MEDIUM 40
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid.
CVSS 3.1MEDIUM 4.8· Network · No auth · No interaction · EPSS 0.09386 · Published 2020-02-24 · Partial fix · 7.0.100, 8.5.51 +1 CWE-444
