PT-2022-7464 · Apache +3 · Apache Tomcat +3

Name of the Vulnerable Software and Affected Versions: pgjdbc versions prior to 42.3.3 Description: The issue is related to the creation of arbitrary files through the loggerFile and loggerLevel connection properties in the pgjdbc driver. An attacker who controls the jdbc URL or properties can ca...

Low: Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 14 Security Update

An update is now available for Red Hat JBoss Web Server 3.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this release as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Critical Photon OS Security Update - PHSA-2022-3.0-0361

Updates of 'mariadb', 'linux-aws', 'linux', 'strongswan', 'linux-secure', 'linux-esx', 'linux-rt', 'apache-tomcat', 'go' packages of Photon OS have been released...

Huawei EulerOS: Security Advisory for tomcat (EulerOS-SA-2022-1053)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

Apache Tomcat Deserialization Vulnerability CVE-2020-9484...

GHSA-F268-65QC-98VG Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection in violation of the HTTP/2 protocol, it was possible that a subsequent request made on that connection could...

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection in violation of the HTTP/2 protocol, it was possible that a subsequent request made on that connection could...

Incorrect Default Permissions in Apache Tomcat

Withdrawn As per https://lists.apache.org/thread/0z644xfjo49pn2oxcp9qslkvhhw4tb7q this issue only affects the SUSE built artifacts of tomcat and is not relevant for the artifacts on maven central. Original Advisory A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE...

Uncontrolled Resource Consumption in Apache Tomcat

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become...

GHSA-53HP-JPWQ-2JGQ Uncontrolled Resource Consumption in Apache Tomcat

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become...

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this...

GHSA-VVW4-RFWF-P6HX Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this...

Security Bulletin: IBM UrbanCode Build is affected by CVE-2021-25122 and CVE-2021-25329

Summary IBM UrbanCode Build is affected by CVE-2021-25122 and CVE-2021-25329 Vulnerability Details CVEID: CVE-2021-25122 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by a flaw when responding to new h2c connection requests. By sending a...

Security Bulletin: IBM UrbanCode Build is affected by CVE-2021-33037

Summary IBM UrbanCode Build is affected by CVE-2021-33037 Vulnerability Details CVEID: CVE-2021-33037 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially-crafted HTTPS transfer-encoding...

Security Bulletin: IBM UrbanCode Build is affected by CVE-2021-41079

Summary IBM UrbanCode Build is affected by CVE-2021-41079 Vulnerability Details CVEID: CVE-2021-41079 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by improper input validation of TLS packets. By sending a specially-crafted TLS packet, a remote attacker could exploit thi...

Security Bulletin: IBM UrbanCode Build is affected by CVE-2021-30640

Summary IBM UrbanCode Build is affected by CVE-2021-30640 Vulnerability Details CVEID: CVE-2021-30640 DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by improper authentication validation in the JNDI Realm. By sending a specially-crafted request...

Critical Photon OS Security Update - PHSA-2022-0361

Updates of 'linux-aws', 'linux-secure', 'linux', 'apache-tomcat', 'linux-rt', 'linux-esx', 'go', 'strongswan', 'mariadb' packages of Photon OS have been released...

Infinite Loop in Apache Tomcat

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of...

GHSA-VF77-8H7G-GGHP Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service...

Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service...