When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade velocityUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade python3-nssUpgrade python-nss-docUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade slf4jUpgrade apache-commons-langUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade javassistUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade javassist-javadocUpgrade xerces-j2Upgrade glassfish-fastinfosetUpgrade relaxngDatatypeUpgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade xalan-j2Upgrade jakarta-commons-httpclient | May 13, 2022 | Oct 4, 2018 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-javadocUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-api | Apr 27, 2020 | Oct 4, 2018 |
| Amazon_linux | — | Upgrade tomcat8Upgrade tomcat7 | Nov 8, 2018 | Oct 4, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.12Upgrade Apache Tomcat to 8.5.34Upgrade Apache Tomcat to 7.0.91 | Oct 4, 2018 | Oct 4, 2018 |
| Centos_linux | — | Upgrade slf4j-jdk14Upgrade tomcat-el-2.2-apiUpgrade jackson-annotationsUpgrade glassfish-jaxb-apiUpgrade tomcat-admin-webappsUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade jakarta-commons-httpclientUpgrade tomcat-libUpgrade python3-nssUpgrade stax-exUpgrade tomcat-javadocUpgrade pki-servlet-containerUpgrade javassistUpgrade bea-stax-apiUpgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade xml-commons-apisUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade tomcat-docs-webappUpgrade jackson-databindUpgrade xml-commons-resolverUpgrade glassfish-jaxb-coreUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade apache-commons-langUpgrade jackson-coreUpgrade python3-nss-debuginfoUpgrade apache-commons-collectionsUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade javassist-javadocUpgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade tomcatUpgrade xmlstreambufferUpgrade glassfish-jaxb-runtimeUpgrade tomcat-servlet-3.0-apiUpgrade pki-servlet-4.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade resteasy | Apr 1, 2019 | Oct 4, 2018 |
| Debian | — | Upgrade tomcat7Upgrade tomcat9Upgrade tomcat8 | Feb 19, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat | Sep 25, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat | May 30, 2019 | Oct 4, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-api | Jul 26, 2019 | Oct 4, 2018 |
| Oracle Missing Cpu Oct 2019 | — | Apply the October 2019 Critical Patch Update (CPU) for Oracle Database | Oct 17, 2019 | Oct 4, 2018 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.34-11.4.3.0.1.4.0 on Solaris 11.4 | Nov 19, 2018 | Oct 4, 2018 |
| Oracle_linux | — | Upgrade jackson-coreUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-txw2Upgrade javassist-javadocUpgrade relaxngDatatypeUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade xsomUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcUpgrade pki-servlet-4.0-apiUpgrade jackson-annotationsUpgrade python-nss-docUpgrade slf4jUpgrade tomcatUpgrade glassfish-jaxb-runtimeUpgrade tomcat-docs-webappUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade javassistUpgrade pki-servlet-containerUpgrade xml-commons-apisUpgrade python3-nssUpgrade bea-stax-apiUpgrade glassfish-jaxb-coreUpgrade resteasyUpgrade xmlstreambufferUpgrade tomcat-javadocUpgrade xerces-j2Upgrade tomcat-webappsUpgrade velocityUpgrade jackson-databindUpgrade apache-commons-langUpgrade tomcat-libUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade glassfish-fastinfosetUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade jakarta-commons-httpclientUpgrade stax-exUpgrade jackson-jaxrs-providersUpgrade tomcat-admin-webapps | Mar 14, 2019 | Oct 3, 2018 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Oct 3, 2018 |
| Redhat_linux | — | Upgrade jackson-coreUpgrade xalan-j2Upgrade xsomUpgrade slf4jUpgrade python3-nss-debuginfoUpgrade relaxngDatatypeUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade python-nss-debugsourceUpgrade jackson-annotationsUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade jackson-module-jaxb-annotationsUpgrade pki-servlet-4.0-apiUpgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade pki-servlet-containerUpgrade jakarta-commons-httpclientUpgrade xmlstreambufferUpgrade javassistUpgrade slf4j-jdk14Upgrade glassfish-jaxb-apiUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-coreUpgrade jackson-databindUpgrade stax-exUpgrade xerces-j2Upgrade glassfish-fastinfosetUpgrade bea-stax-apiUpgrade velocityUpgrade apache-commons-langUpgrade python3-nssUpgrade resteasy | Mar 14, 2019 | Oct 4, 2018 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsource | Mar 12, 2024 | Oct 4, 2018 |
| Suse | — | Upgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade virtualbox-guest-x11Upgrade tomcatUpgrade tomcat-servlet-3_0-apiUpgrade tomcat6-servlet-2_5-apiUpgrade tomcat6-webappsUpgrade tomcat6Upgrade virtualbox-websrvUpgrade tomcat-el-3_0-apiUpgrade tomcat6-admin-webappsUpgrade tomcat6-docs-webappUpgrade virtualbox-develUpgrade tomcat-embedUpgrade tomcat-jsp-2_3-apiUpgrade virtualbox-host-kmp-defaultUpgrade virtualbox-guest-sourceUpgrade virtualbox-vncUpgrade python3-virtualboxUpgrade virtualbox-guest-desktop-iconsUpgrade tomcat6-javadocUpgrade virtualbox-guest-kmp-defaultUpgrade tomcat-javadocUpgrade tomcat-webappsUpgrade tomcat6-libUpgrade virtualboxUpgrade virtualbox-qtUpgrade tomcat-servlet-3_1-apiUpgrade tomcat6-jsp-2_1-apiUpgrade virtualbox-host-sourceUpgrade tomcat-el-2_2-apiUpgrade tomcat-libUpgrade tomcat-jsp-2_2-apiUpgrade virtualbox-guest-toolsUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4_0-api | Oct 20, 2018 | Oct 4, 2018 |
| Ubuntu | — | Upgrade libtomcat7-javaUpgrade tomcat7Upgrade libtomcat8-javaUpgrade tomcat8 | Oct 18, 2018 | Oct 4, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub