Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
atlassian[email protected]JRASERVER-59887
HistoryFeb 19, 2016 - 12:04 a.m.

Upgrade Tomcat to the latest 8.0.x release

2016-02-1900:04:16
[email protected]
jira.atlassian.com
11

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

82.9%

JSON

h3. Summary

We are currently on 8.0.17 and have already been bitten by a bug in it:

https://bz.apache.org/bugzilla/show_bug.cgi?id=57476

We should upgrade to the latest to get the latest bugfixes.

Also, there have been a number of recent CVEs involving Tomcat, most of which involve SecurityManager, which I believe we do not currently use.

https://vulners.com/cve/CVE-2015-5174
https://vulners.com/cve/CVE-2016-0706
https://vulners.com/cve/CVE-2016-0714
https://vulners.com/cve/CVE-2016-0763

However, these are related to other aspects of Tomcat:

https://vulners.com/cve/CVE-2015-5345
https://vulners.com/cve/CVE-2015-5346
https://vulners.com/cve/CVE-2015-5351 (probably doesn’t affect us)

Updating Tomcat to one of these versions would appear to patch all of the above CVEs:

  • Apache Tomcat 9.0.0.M3
  • Apache Tomcat 8.0.32
  • Apache Tomcat 7.0.68
  • Apache Tomcat 6.0.45

Related

ibm 30
suse 4
mageia 1
atlassian 2
openvas 33
nessus 43
symantec 1
redhat 6
tomcat 8
debian 4
osv 8
ubuntu 1
amazon 5
oraclelinux 3
f5 7
freebsd 2
centos 2
cloudfoundry 1
gentoo 1
prion 7
cve 7
veracode 3
ubuntucve 6
github 7
debiancve 6
fedora 1
ibm
ibm
Security Bulletin: Security vulnerabilities in Apache Tomcat affects multiple IBM Rational products based on IBM's Jazz technology (CVE-2015-5345, CVE-2015-5346, CVE-2015-5351, CVE-2016-0706, CVE-2015-5174, others)
2021-04-28 18:35:50
Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2015-5345, CVE-2015-5346, CVE-2015-5351, CVE-2016-0706, CVE-2016-0714, CVE-2016-0763, CVE-2015-5174)
2018-06-17 05:10:46
Security Bulletin: Multiple vulnerabilities in Apache Tomcat affect IBM SAN Volume Controller and Storwize Family
2023-03-29 01:48:02
suse
suse
Security update for tomcat (important)
2016-03-15 15:12:43
Security update for tomcat (important)
2016-03-18 19:13:35
Security update for tomcat (important)
2016-03-23 18:09:46
mageia
mageia
Updated tomcat packages fix security vulnerabilities
2016-03-02 21:28:46
atlassian
atlassian
Upgrade Tomcat to the latest 8.0.x release
2016-02-19 00:04:16
Upgrade Tomcat to the latest 8.0.x release
2016-02-19 00:04:16
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2016:0822-1)
2021-04-19 00:00:00
SUSE: Security Advisory (SUSE-SU-2016:0769-1)
2021-04-19 00:00:00
openSUSE: Security Advisory for tomcat (openSUSE-SU-2016:0865-1)
2016-03-24 00:00:00
nessus
nessus
openSUSE Security Update : tomcat (openSUSE-2016-384)
2016-03-24 00:00:00
Apache Tomcat < 9.0.0.M3 Multiple Vulnerabilities
2019-01-11 00:00:00
Apache Tomcat 9.0.x < 9.0.0.M3 Multiple Vulnerabilities
2019-05-13 00:00:00
symantec
symantec
SA118 : February 2016 Apache Tomcat Vulnerabilities
2016-03-15 08:00:00
redhat
redhat
(RHSA-2016:1088) Moderate: Red Hat JBoss Web Server 3.0.3 update
2016-05-17 16:10:14
(RHSA-2016:1087) Moderate: Red Hat JBoss Web Server 3.0.3 update
2016-05-17 16:09:53
(RHSA-2016:2807) Important: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7
2016-11-17 20:28:33
tomcat
tomcat
Fixed in Apache Tomcat 9.0.0.M3
2016-01-05 00:00:00
Fixed in Apache Tomcat 8.0.32
2016-02-08 00:00:00
Fixed in Apache Tomcat 7.0.68
2016-02-16 00:00:00
debian
debian
[SECURITY] [DLA 435-1] tomcat6 security update
2016-02-27 19:09:41
[SECURITY] [DSA 3609-1] tomcat8 security update
2016-06-29 19:54:21
[SECURITY] [DSA 3552-1] tomcat7 security update
2016-04-17 18:44:26
osv
osv
tomcat6 - security update
2016-02-27 00:00:00
tomcat7 - security update
2016-04-17 00:00:00
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
2022-05-14 01:10:16
ubuntu
ubuntu
Tomcat vulnerabilities
2016-07-05 00:00:00
amazon
amazon
Medium: tomcat8
2016-03-29 15:30:00
Medium: tomcat7
2016-03-29 15:30:00
Medium: tomcat6
2016-03-29 15:30:00
oraclelinux
oraclelinux
tomcat security, bug fix, and enhancement update
2016-11-09 00:00:00
tomcat6 security and bug fix update
2016-10-10 00:00:00
tomcat security, bug fix, and enhancement update
2017-08-07 00:00:00
f5
f5
SOL30971148 - Apache Tomcat 6.x vulnerabilities CVE-2015-5174, CVE-2015-5345, CVE-2016-0706, and CVE-2016-0714
2016-03-22 00:00:00
K51025324 : Apache Tomcat 7.x vulnerabilities CVE-2015-5346, CVE-2015-5351, and CVE-2016-0763
2016-03-22 00:00:00
SOL51025324 - Apache Tomcat 7.x vulnerabilities CVE-2015-5346, CVE-2015-5351, and CVE-2016-0763
2016-03-22 00:00:00
freebsd
freebsd
tomcat -- multiple vulnerabilities
2016-02-22 00:00:00
tomcat -- multiple vulnerabilities
2016-02-22 00:00:00
centos
centos
tomcat security update
2016-11-25 15:49:52
tomcat6 security update
2016-10-11 18:36:02
cloudfoundry
cloudfoundry
USN-3024-1: tomcat6, tomcat7 vulnerabilities | Cloud Foundry
2017-01-19 00:00:00
gentoo
gentoo
Apache Tomcat: Multiple vulnerabilities
2017-05-18 00:00:00
prion
prion
Session fixation
2016-02-25 01:59:00
Cross site request forgery (csrf)
2016-02-25 01:59:00
Directory traversal
2016-02-25 01:59:00
cve
cve
CVE-2015-5346
2016-02-25 01:59:00
CVE-2016-0763
2016-02-25 01:59:00
CVE-2015-5174
2016-02-25 01:59:00
veracode
veracode
Information Disclosure
2019-01-15 09:14:42
Directory Traversal
2019-01-15 09:09:27
Directory Information Disclosure
2019-01-15 09:11:49
ubuntucve
ubuntucve
CVE-2015-5346
2016-02-24 00:00:00
CVE-2015-5174
2016-02-24 00:00:00
CVE-2015-5351
2016-02-24 00:00:00
github
github
Improper Neutralization of Input During Web Page Generation in Apache Tomcat
2022-05-14 03:13:01
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
2022-05-14 01:10:16
Improper Verification of Source of a Communication Channel in Apache Tomcat
2022-05-14 01:18:35
debiancve
debiancve
CVE-2015-5346
2016-02-25 01:59:00
CVE-2015-5351
2016-02-25 01:59:00
CVE-2016-0714
2016-02-25 01:59:00
fedora
fedora
[SECURITY] Fedora 22 Update: tomcat-7.0.68-3.fc22
2016-03-25 22:27:03

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

82.9%

JSON
Related for JRASERVER-59887
ibm30suse4mageia1atlassian2openvas33nessus43symantec1redhat6tomcat8debian4osv8ubuntu1amazon5oraclelinux3f57freebsd2centos2cloudfoundry1gentoo1prion7cve7veracode3ubuntucve6github7debiancve6fedora1