Read the docs
TI-2020-01862 Aliases CVE-2020-1938GHSA-c9hw-wf7x-jp9j

Improper privilege management in Apache Tomcat

Priority CRITICAL 100Exploited in the wildCWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 34 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.

Summary

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

Why it matters now

Exploitation Active In CISA KEV since 2022-03-03CISA due date 2022-03-17
EPSS 0.9927 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.apache.tomcat.embed:tomcat-embed-core (Maven): 9.0.31, 8.5.51, 7.0.100Red Hat: 16 advisoriesRed Hat: 34 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TomcatApache Tomcat 9.0.0.M1 to 9.0.0.30; 8.5.0 to 8.5.50; 7.0.0 to 7.0.99—No fix listedCNA
—org.apache.tomcat.embed:tomcat-embed-core (Maven)9.0.0 to before 9.0.319.0.31Patch availableGHSA-c9hw-wf7x-jp9j
—org.apache.tomcat.embed:tomcat-embed-core (Maven)8.0.0 to before 8.5.518.5.51Patch availableGHSA-c9hw-wf7x-jp9j
—org.apache.tomcat.embed:tomcat-embed-core (Maven)7.0.0 to before 7.0.1007.0.100Patch availableGHSA-c9hw-wf7x-jp9j
  • Apache Tomcat VendorApache Affected Apache Tomcat 9.0.0.M1 to 9.0.0.30; 8.5.0 to 8.5.50; 7.0.0 to 7.0.99 Fixed in — No fix listed CNA
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0 to before 9.0.31 Fixed in 9.0.31 Patch available GHSA-c9hw-wf7x-jp9j
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.0.0 to before 8.5.51 Fixed in 8.5.51 Patch available GHSA-c9hw-wf7x-jp9j
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 7.0.0 to before 7.0.100 Fixed in 7.0.100 Patch available GHSA-c9hw-wf7x-jp9j

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:apache:geode:1.12.0:*:*:*:*:*:*:*1.12.0VulnerableApache
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*7.0.0 to before 7.0.100; 8.5.0 to before 8.5.51; 9.0.0 to before 9.0.31VulnerableApache
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*6.2.1.0VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*9.3.3VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*9.3.5VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*8.1.1VulnerableOracle
  • cpe:2.3:a:apache:geode:1.12.0:*:*:*:*:*:*:* Versions 1.12.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.0.100; 8.5.0 to before 8.5.51; 9.0.0 to before 9.0.31 Vulnerable ·Apache
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:* Versions 9.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:* Versions 9.3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·Oracle
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*8.2.0VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:*8.2.1VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*10.0.1.4.0VulnerableOracle
cpe:2.3:a:oracle:health_sciences_empirica_inspections:1.0.1.2:*:*:*:*:*:*:*1.0.1.2VulnerableOracle
cpe:2.3:a:oracle:health_sciences_empirica_signal:7.3.3:*:*:*:*:*:*:*7.3.3VulnerableOracle
cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableOracle
cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*4.2.1VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:*17.1 – 17.3VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*up to 4.0.12; 8.0.0 – 8.0.20VulnerableOracle
cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*up to 20.5VulnerableOracle
cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:*6.3.7VulnerableOracle
cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:*12.2.0.1VulnerableOracle
cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*18cVulnerableOracle
cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*19cVulnerableOracle
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:a:blackberry:good_control:*:*:*:*:*:*:*:*up to 5.2.58.38VulnerableBlackBerry
cpe:2.3:a:blackberry:workspaces_server:7.0.1:*:*:*:*:*:*:*7.0.1VulnerableBlackBerry
cpe:2.3:a:blackberry:workspaces_server:7.1.2:*:*:*:*:*:*:*7.1.2VulnerableBlackBerry
cpe:2.3:a:blackberry:workspaces_server:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableBlackBerry
cpe:2.3:a:blackberry:workspaces_server:9.0:*:*:*:*:*:*:*9.0VulnerableBlackBerry
cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*3.0.0 – 3.1.3VulnerableNetApp
  • cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:* Versions 8.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:* Versions 10.0.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_empirica_inspections:1.0.1.2:*:*:*:*:*:*:* Versions 1.0.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_empirica_signal:7.3.3:*:*:*:*:*:*:* Versions 7.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:* Versions 17.1 – 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 4.0.12; 8.0.0 – 8.0.20 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:* Versions up to 20.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:* Versions 6.3.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:a:blackberry:good_control:*:*:*:*:*:*:*:* Versions up to 5.2.58.38 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:workspaces_server:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:workspaces_server:7.1.2:*:*:*:*:*:*:* Versions 7.1.2 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:workspaces_server:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·BlackBerry
  • cpe:2.3:a:blackberry:workspaces_server:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·BlackBerry
  • cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.1.3 Vulnerable ·NetApp

Remediation

  • Fix · GHSA-c9hw-wf7x-jp9j org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.31 Advisory →
  • Fix · GHSA-c9hw-wf7x-jp9j org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.51 Advisory →
  • Fix · GHSA-c9hw-wf7x-jp9j org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 7.0.100 Advisory →

Red Hat 16 advisories

  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2020:4847 Released 2020-11-04 · Red Hat rating Moderate
    pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2020:2840 Released 2020-07-07 · Red Hat rating Important
    tomcat security update
    • Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) tomcat-7.0.76-10.el7_6, tomcat-servlet-3.0-api-7.0.76-10.el7_6
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) tomcat-7.0.76-10.el7_6, tomcat-admin-webapps-7.0.76-10.el7_6, tomcat-docs-webapp-7.0.76-10.el7_6 +6
    • Red Hat Enterprise Linux Server EUS (v. 7.6) tomcat-7.0.76-10.el7_6, tomcat-admin-webapps-7.0.76-10.el7_6, tomcat-el-2.2-api-7.0.76-10.el7_6 +4
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.6) tomcat-7.0.76-10.el7_6, tomcat-admin-webapps-7.0.76-10.el7_6, tomcat-docs-webapp-7.0.76-10.el7_6 +6
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) tomcat-7.0.76-10.el7_6, tomcat-admin-webapps-7.0.76-10.el7_6, tomcat-el-2.2-api-7.0.76-10.el7_6 +4
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) tomcat-7.0.76-10.el7_6, tomcat-admin-webapps-7.0.76-10.el7_6, tomcat-docs-webapp-7.0.76-10.el7_6 +6
Show 13 more Red Hat advisories
  • RHSA-2020:2783 Released 2020-07-01 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.23 security update
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2020:2779 Released 2020-07-01 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.23 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server glassfish-jsf12-eap6-1.2.15-11.b01_SP2_redhat_2.1.ep6.el6, hornetq-2.3.25-29.SP31_redhat_00001.1.ep6.el6, ironjacamar-common-api-eap6-1.0.44-1.Final_redhat_00001.1.ep6.el6 +47
  • RHSA-2020:2781 Released 2020-07-01 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.23 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server glassfish-jsf12-eap6-1.2.15-11.b01_SP2_redhat_2.1.ep6.el5, hornetq-2.3.25-29.SP31_redhat_00001.1.ep6.el5, ironjacamar-common-api-eap6-1.0.44-1.Final_redhat_00001.1.ep6.el5 +47
  • RHSA-2020:2780 Released 2020-07-01 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.23 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server glassfish-jsf12-eap6-1.2.15-11.b01_SP2_redhat_2.1.ep6.el7, hornetq-2.3.25-29.SP31_redhat_00001.1.ep6.el7, ironjacamar-common-api-eap6-1.0.44-1.Final_redhat_00001.1.ep6.el7 +47
  • RHSA-2020:2367 Released 2020-06-04 · Red Hat rating Important
    Red Hat support for Spring Boot 2.1.13 security and bug fix update
    • Red Hat Runtimes Spring Boot 2.1.13
  • RHSA-2020:1520 Released 2020-04-21 · Red Hat rating Important
    Red Hat JBoss Web Server 5.3 release
    • Red Hat JBoss Web Server 5.3 for RHEL 6 Server jws5-tomcat-9.0.30-3.redhat_4.1.el6jws, jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el6jws, jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el6jws +8
    • Red Hat JBoss Web Server 5.3 for RHEL 7 Server jws5-tomcat-9.0.30-3.redhat_4.1.el7jws, jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el7jws, jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el7jws +8
    • Red Hat JBoss Web Server 5.3 for RHEL 8 jws5-tomcat-9.0.30-3.redhat_4.1.el8jws, jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el8jws, jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el8jws +8
  • RHSA-2020:1521 Released 2020-04-21 · Red Hat rating Important
    Red Hat JBoss Web Server 5.3 release
    • Red Hat JBoss Web Server (JWS) 5.3
  • RHSA-2020:1478 Released 2020-04-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4 security update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server jbossweb-7.5.30-2.Final_redhat_2.1.ep6.el5
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jbossweb-7.5.30-2.Final_redhat_2.1.ep6.el6
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server jbossweb-7.5.30-2.Final_redhat_2.1.ep6.el7
  • RHSA-2020:1479 Released 2020-04-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4 security update
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2020:0912 Released 2020-03-23 · Red Hat rating Important
    tomcat6 security update
    • Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6-6.0.24-114.el6_10, tomcat6-admin-webapps-6.0.24-114.el6_10, tomcat6-docs-webapp-6.0.24-114.el6_10 +6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6-6.0.24-114.el6_10, tomcat6-admin-webapps-6.0.24-114.el6_10, tomcat6-docs-webapp-6.0.24-114.el6_10 +6
    • Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-114.el6_10, tomcat6-el-2.1-api-6.0.24-114.el6_10, tomcat6-jsp-2.1-api-6.0.24-114.el6_10 +2
    • Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-admin-webapps-6.0.24-114.el6_10, tomcat6-docs-webapp-6.0.24-114.el6_10, tomcat6-javadoc-6.0.24-114.el6_10 +1
    • Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-114.el6_10, tomcat6-el-2.1-api-6.0.24-114.el6_10, tomcat6-jsp-2.1-api-6.0.24-114.el6_10 +2
    • Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-admin-webapps-6.0.24-114.el6_10, tomcat6-docs-webapp-6.0.24-114.el6_10, tomcat6-javadoc-6.0.24-114.el6_10 +1
  • RHSA-2020:0855 Released 2020-03-17 · Red Hat rating Important
    tomcat security update
    • Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-11.el7_7, tomcat-servlet-3.0-api-7.0.76-11.el7_7
    • Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-11.el7_7, tomcat-admin-webapps-7.0.76-11.el7_7, tomcat-docs-webapp-7.0.76-11.el7_7 +6
    • Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.76-11.el7_7, tomcat-servlet-3.0-api-7.0.76-11.el7_7
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-11.el7_7, tomcat-admin-webapps-7.0.76-11.el7_7, tomcat-docs-webapp-7.0.76-11.el7_7 +6
    • Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-11.el7_7, tomcat-admin-webapps-7.0.76-11.el7_7, tomcat-el-2.2-api-7.0.76-11.el7_7 +4
    • Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-11.el7_7, tomcat-admin-webapps-7.0.76-11.el7_7, tomcat-docs-webapp-7.0.76-11.el7_7 +6
    • Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-11.el7_7, tomcat-admin-webapps-7.0.76-11.el7_7, tomcat-el-2.2-api-7.0.76-11.el7_7 +4
    • Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-11.el7_7, tomcat-javadoc-7.0.76-11.el7_7, tomcat-jsvc-7.0.76-11.el7_7
  • RHSA-2020:0861 Released 2020-03-17 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1 Service Pack 8 security update
    • Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat-native-1.2.23-21.redhat_21.ep7.el6, tomcat7-7.0.70-38.ep7.el6, tomcat7-admin-webapps-7.0.70-38.ep7.el6 +22
    • Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat-native-1.2.23-21.redhat_21.ep7.el7, tomcat7-7.0.70-38.ep7.el7, tomcat7-admin-webapps-7.0.70-38.ep7.el7 +22
  • RHSA-2020:0860 Released 2020-03-17 · Red Hat rating Important
    Red Hat JBoss Web Server 3.1 Service Pack 8 security update
    • Red Hat JBoss Web Server 3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Tomcat — openSUSE-SU-2020:0345

    3 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2020-01859 In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header…Priority MEDIUM 40
    • TI-2019-13111 The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to…Priority LOW 33
    Show all 3 records → Advisory →
  • Advisory ·

    Apache Tomcat — DSA-4673

    3 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2020-01859 In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header…Priority MEDIUM 40
    • TI-2019-13111 The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to…Priority LOW 33
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4847
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:0855
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:0855
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2020:0855
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)Fixed RHSA-2020:2840
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:0855
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)Fixed RHSA-2020:2840
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2020:0912
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2020:0912
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2020:0912
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:0855
Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:2840
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2020:0912
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2020:0855
Red Hat Enterprise Linux Server Optional EUS (v. 7.6)Fixed RHSA-2020:2840
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2020:0912
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:0855
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2020:0912
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2020:0855
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2020:2840
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2020:2840
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2020:1479
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2020:1478, RHSA-2020:2781
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2020:1478, RHSA-2020:2779
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2020:1478, RHSA-2020:2780
Red Hat JBoss Web Server (JWS) 5.3Fixed RHSA-2020:1521
Red Hat JBoss Web Server 3.1Fixed RHSA-2020:0860
Red Hat JBoss Web Server 3.1 for RHEL 6Fixed RHSA-2020:0861
Red Hat JBoss Web Server 3.1 for RHEL 7Fixed RHSA-2020:0861
Red Hat JBoss Web Server 5.3 for RHEL 6 ServerFixed RHSA-2020:1520
Red Hat JBoss Web Server 5.3 for RHEL 7 ServerFixed RHSA-2020:1520
Red Hat JBoss Web Server 5.3 for RHEL 8Fixed RHSA-2020:1520
Red Hat Runtimes Spring Boot 2.1.13Fixed RHSA-2020:2367
Not affected: 5 products
  • Red Hat Decision Manager 7
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Fuse 6
  • Red Hat Process Automation 7
  • Red Hat Software Collections

Timeline

  1. 2022-03-03 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2020-1938
  3. 2026-10-03 Alias added: GHSA-c9hw-wf7x-jp9j

References

Exploit 1

Patch 6

Advisory 19

Other 70

  • TI-2019-11833 Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by… KEVCVSS 3.1HIGH 7.8
  • TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2014-00046 Improper input validation in docker.io CVSS 3.1CRITICAL 9.8
  • TI-2017-11466 Deserialization of untrusted data in Apache Geode CVSS 3.0CRITICAL 9.8
  • TI-2022-17225 Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8. CVSS 3.1CRITICAL 9.8
  • TI-2017-11469 Incorrect authorization in Apache Geode CVSS 3.0HIGH 8.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences