Advisory ROSA-SA-2021-1988

Software: tomcat 7.0.76
OS: Cobalt 7.9

CVE-ID: CVE-2012-5568
CVE-Crit: CRITICAL
CVE-DESC: Apache Tomcat via 7.0.x allows remote attackers to cause a denial of service (disabling the daemon) via partial HTTP requests, as demonstrated by Slowloris.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2017-12616
CVE-Crit: HIGH
CVE-DESC: When using VirtualDirContext with Apache Tomcat 7.0.0-7.0.80, it was possible to bypass security restrictions and/or view JSP source code for resources served by VirtualDirContext using a specially crafted query.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2019-0221
CVE-Crit: MEDIUM
CVE-DESC: The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.0.17, 8.5.0 to 8.5.39, and 7.0.0 to 7.0.93 displays user-supplied data without escaping and is therefore vulnerable to XSS. . SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present on a working website.
CVE-STATUS: Default
CVE-REV: default

CVE-ID: CVE-2019-12418
CVE-Crit: HIGH
CVE-DESC: When Apache Tomcat 9.0.0.0.M1 - 9.0.28, 8.5.0 - 8.5.47, 7.0.0 and 7.0.97 are configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files can manipulate the RMI registry to perform an attacker-in-the-middle attack to capture usernames and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain full control of the Tomcat instance.
CVE-STATUS: Default
CVE-REV: Default

CVE-ID: CVE-2021-24122
CVE-Crit: MEDIUM
CVE-DESC: When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 through 10.0.0-M9, 9.0.0.0.M1 through 9.0.39, 8.5.0 through 8.5.59, and Versions 7.0.0 through 7.0.106 were prone to JSP source code disclosure in some configurations. The main cause was unexpected behavior of the JRE API File.getCanonicalPath (), which in turn was caused by inconsistent behavior of the Windows API (FindFirstFileW) in some circumstances.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2021-25329
CVE-Crit: HIGH
CVE-DESC: the fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0.0-M1 to 10.0.0, 9.0.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61, or 7.0.0. to 7.0.107 with a configuration boundary case that is unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
CVE-STATUS: default
CVE-REV: Default