The JmxRemoteLifecycleListener was not updated to take account of Oracle’s fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance.

References

bugzilla.redhat.com/show_bug.cgi?id=1397485

tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8

cvelist 2

nvd 2

attackerkb 2

osv 2

debiancve 2

github 1

prion 2

openvas 28

f5 4

cve 2

ubuntucve 2

cisa_kev 2