Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 6 security and bug fix update

An update is now available for Red Hat JBoss Web Server 3.1. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

Fedora 28 : 1:tomcat (2018-b1832101b8)

This update includes a rebase from 8.5.30 up to 8.5.32 which resolves two CVEs along with various other bugs/features : - rhbz1579612 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins - rhbz1607586 CVE-2018-8034 tomcat: host name verification...

Security Bulletin: Apache Tomcat as used in IBM QRadar SIEM is vulnerable to publicly disclosed vulnerability. (CVE-2018-8034, CVE-2018-8037)

Summary Publicly disclosed vulnerabilities in Apache Tomcat. Vulnerability Details CVEID: CVE-2018-8034 Description: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by a missing host name verification when using TLS with the WebSocket client. An attacker could...

openSUSE: Security Advisory for tomcat (openSUSE-SU-2018:3054-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Bulletin: Rational DOORS Web Access is affected by Apache Tomcat vulnerabilities

Summary Rational DOORS Web Access has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2018-8034 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by a missing host name verification when using TLS with the WebSocket client. ...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), am.ik.servicebroker:cloud-karafka-service-broker (>=0.0.2, <=0.0.3) +2996 more potentially affected by CVE-2018-8034 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.31)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =0.0.1, =0.1.0, =1.0.0-rc, =1.1.0 - ca.pjer:parse-security-spring-boot-starter 1.1.0 and more Source cves: CVE-2018-8034 Source advisory: GHSA-46J3-R4PJ-4835...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), am.ik.servicebroker:cloud-karafka-service-broker (>=0.0.2, <=0.0.3) +2996 more potentially affected by CVE-2018-8034 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.31)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =0.0.1, =0.1.0, =1.0.0-rc, =1.1.0 - ca.pjer:parse-security-spring-boot-starter 1.1.0 and more Source cves: CVE-2018-8034 Source advisory: OSV:GHSA-46J3-R4PJ-4835...

au.com.mountain-pass:hyperstate (>=1, <=9), biz.dfch.j:activiti.wrapper (>=0.0.6, <=0.0.7) +1041 more potentially affected by CVE-2018-8034 via org.apache.tomcat.embed:tomcat-embed-core (>=8.0.1, <=8.0.52)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.0.1, =1, =0.0.6, =0.0.10, =2.0, =0.0.21, =0.0.21, =0.0.21, =0.0.25, =0.0.21, =0.0.21, =0.0.21, =0.0.21, =1.1, =1.1.2 and more Source cves: CVE-2018-8034 Source advisory: OSV:GHSA-46J3-R4PJ-4835...

com.brienwheeler.apps:apps-tomcat (>=1.10, <=1.11), com.brienwheeler.dist:dist-tomcat (>=1.10, <=1.11) +16 more potentially affected by CVE-2018-8034 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.1, <=9.0.8)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.1, =1.10, =1.10, =9.0.8.0, =9.0.8.0, =9.0.8.0, =9.0.8.0, =9.0.8.0, =0.60.0, =0.60.0, =5.0.5, =1.2, =9.0.1, =9.0.1, =9.0.8 - org.dbflute.tomcat:tomcat-boot 0.7.0-rc1 and more Source cves: CVE-2018-8034 Source advisory: GHSA-46J3-R4PJ-483...

com.brienwheeler.apps:apps-tomcat (>=1.10, <=1.11), com.brienwheeler.dist:dist-tomcat (>=1.10, <=1.11) +16 more potentially affected by CVE-2018-8034 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.1, <=9.0.8)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.1, =1.10, =1.10, =9.0.8.0, =9.0.8.0, =9.0.8.0, =9.0.8.0, =9.0.8.0, =0.60.0, =0.60.0, =5.0.5, =1.2, =9.0.1, =9.0.1, =9.0.8 - org.dbflute.tomcat:tomcat-boot 0.7.0-rc1 and more Source cves: CVE-2018-8034 Source advisory:...

ch.rasc:embeddedtc (>=1.4, <=1.29), ch.rasc:embeddedtc-maven-plugin (>=1.0, <=1.23) +176 more potentially affected by CVE-2018-8034 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.35, <=7.0.88)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.35, =1.4, =1.0, =1.0-beta-1, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =1.0.0, =1.0.0, =1.0.1 - com.definesys.mpaas:query-weblogic 1.0.0 - com.ebay:lightning-client 0.9.0 - com.ebay:lightning-core 0.9.0 and more Source cves:...

openSUSE Security Update : tomcat (openSUSE-2018-1129)

This update for tomcat to version 9.0.10 fixes the following issues : Security issues fixed : - CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with supplementary characters could have lead to an infinite loop in the decoder causing a Denial of Service bsc1102400. -...

openSUSE: Security Advisory for tomcat (openSUSE-SU-2018:2740-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for tomcat (moderate)

This update for tomcat to 8.0.53 fixes the following issues: Security issue fixed: - CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with supplementary characters could have lead to an infinite loop in the decoder causing a Denial of Service bsc1102400. - CVE-2018-8034: The ho...

Debian DLA-1491-1 : tomcat8 security update

Two security issues have been discovered in the Tomcat servlet and JSP engine. CVE-2018-1336 An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. CVE-2018-8034 The host name verification when...

Debian: Security Advisory (DLA-1491-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4281-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4281-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 29, 2018 https://www.debian.org/security/faq -...

Amazon Linux AMI : tomcat8 (ALAS-2018-1056)

The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore,...

Amazon Linux AMI : tomcat7 / tomcat80 (ALAS-2018-1055)

The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore,...

Important: tomcat8

Issue Overview: The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default...