GHSA-C9HW-WF7X-JP9J Improper Privilege Management in Tomcat

When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that...

Apache Tomcat Denial of Service vulnerability

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servle...

GHSA-QCXH-W3J9-58QR Apache Tomcat Denial of Service vulnerability

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servle...

Apache Tomcat: Remote code execution

Background Apache Tomcat is a Servlet-3.0/JSP-2.2 Container. Description Apache Tomcat improperly handles deserialization of files under specific circumstances. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service conditio...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Spectrum Protect Plus (CVE-2020-1938)

Summary An Apache Tomcat vulnerability which could allow a remote attacker to execute arbitrary code on the system affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-1938 DESCRIPTION: Apache Tomcat could allow a remote attacker to execute arbitrary code on the system, caused...

tomcat6 security update

0:6.0.24-115 - Resolves: CVE-2020-9484 tomcat6: tomcat: Apache Tomcat Remote Code Execution via session persistence...

tomcat security update

CentOS Errata and Security Advisory CESA-2020:2530 An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

PT-2022-2876

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 10.1.0-M1 through 10.1.0-M14 Apache Tomcat versions 10.0.0-M1 through 10.0.20 Apache Tomcat versions 9.0.13 through 9.0.62 Apache Tomcat versions 8.5.38 through 8.5.78 Description The issue is related to the...

PT-2022-3076

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.50 through 8.5.81 Apache Tomcat versions 9.0.30 through 9.0.64 Apache Tomcat versions 10.0.0-M1 through 10.0.22 Apache Tomcat versions 10.1.0-M1 through 10.1.0-M16 Description The Form authentication example in the...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 5.3.1 security update

Updated Red Hat JBoss Web Server 5.3.1 packages are now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and Windows. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System CVS...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 5.3.1 security update

Updated Red Hat JBoss Web Server 5.3.1 packages are now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 9 security update

An update is now available for Red Hat JBoss Web Server 3.1, for RHEL 6, RHEL 7 and Windows. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

Apache Tomcat 8.5.x < 8.5.55 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 or 7.0.0 to 7.0.103. It is, therefore, affected by a remote code execution via session persistence. Note that the scanner has not attempted to exploit these issues but has...

Apache Tomcat 7.0.x < 7.0.104 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 or 7.0.0 to 7.0.103. It is, therefore, affected by a remote code execution via session persistence. Note that the scanner has not attempted to exploit these issues but has...

Apache Tomcat 10.0.0-M1 < 10.0.0-M5 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 or 7.0.0 to 7.0.103. It is, therefore, affected by a remote code execution via session persistence. Note that the scanner has not attempted to exploit these issues but has...

Apache Tomcat 9.0.0.M1 < 9.0.35 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 or 7.0.0 to 7.0.103. It is, therefore, affected by a remote code execution via session persistence. Note that the scanner has not attempted to exploit these issues but has...

Fixed in Apache Tomcat 9.0.36

Important: HTTP/2 DoS CVE-2020-11996 A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. This was fixed with commit 9a023168. Thi...

Fixed in Apache Tomcat 8.5.56

Important: HTTP/2 DoS CVE-2020-11996 A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. This was fixed with commit c8acd2ab. Thi...

KLA11823 CPU usage vulnerability in Apache Tomcat

CPU usage vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to cause denial of service. Original advisories Apache Tomcat 8.5.x vulnerabilities Apache Tomcat 9.x vulnerabilities Related products Apache-Tomcat CVE list CVE-2020-11996 warning Solution Update t...