A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 9 | all | tomcat7 | <Â 7.0.75-1 | tomcat7_7.0.75-1_all.deb |
Debian | 9 | all | tomcat8 | <Â 8.5.54-0+deb9u1 | tomcat8_8.5.54-0+deb9u1_all.deb |