The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jakarta-commons-httpclientUpgrade xalan-j2Upgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade pki-servlet-4.0-apiUpgrade javassist-javadocUpgrade javassistUpgrade glassfish-fastinfosetUpgrade apache-commons-netUpgrade xsomUpgrade slf4jUpgrade python-nss-docUpgrade xml-commons-resolverUpgrade jackson-coreUpgrade velocityUpgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade pki-servlet-engineUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade resteasyUpgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade jackson-jaxrs-providersUpgrade apache-commons-langUpgrade python3-nssUpgrade bea-stax-apiUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-apiUpgrade xerces-j2 | May 4, 2022 | Feb 24, 2020 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-lib | Aug 24, 2023 | Feb 24, 2020 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Mar 14, 2020 | Feb 24, 2020 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.31Upgrade Apache Tomcat to 7.0.100Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 8.5.51 | Feb 24, 2020 | Feb 24, 2020 |
| Centos_linux | — | Upgrade tomcat-javadocUpgrade xml-commons-resolverUpgrade tomcat-webappsUpgrade pki-core-debugsourceUpgrade pki-base-javaUpgrade pki-core-debuginfoUpgrade pki-servlet-engineUpgrade tomcat-servlet-3.0-apiUpgrade glassfish-jaxb-apiUpgrade pki-toolsUpgrade jakarta-commons-httpclientUpgrade xalan-j2Upgrade apache-commons-collectionsUpgrade tomcat-jsp-2.2-apiUpgrade javassist-javadocUpgrade ldapjdk-javadocUpgrade pki-serverUpgrade tomcatjssUpgrade glassfish-fastinfosetUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-txw2Upgrade python3-nss-debuginfoUpgrade xsomUpgrade python3-pkiUpgrade apache-commons-netUpgrade apache-commons-langUpgrade tomcatUpgrade pki-symkeyUpgrade pki-tools-debuginfoUpgrade resteasyUpgrade jss-debuginfoUpgrade pki-symkey-debuginfoUpgrade tomcat-jsvcUpgrade jss-javadocUpgrade ldapjdkUpgrade tomcat-docs-webappUpgrade pki-baseUpgrade tomcat-el-2.2-apiUpgrade python3-nssUpgrade slf4j-jdk14Upgrade pki-caUpgrade python-nss-docUpgrade javassistUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade jackson-annotationsUpgrade jss-debugsourceUpgrade relaxngDatatypeUpgrade tomcat-libUpgrade xmlstreambufferUpgrade velocityUpgrade pki-servlet-4.0-apiUpgrade bea-stax-apiUpgrade stax-exUpgrade xerces-j2Upgrade slf4jUpgrade pki-kraUpgrade jssUpgrade jackson-databindUpgrade jackson-coreUpgrade xml-commons-apisUpgrade glassfish-jaxb-runtimeUpgrade tomcat-admin-webapps | Nov 11, 2020 | Feb 24, 2020 |
| Debian | — | Upgrade tomcat9 | Mar 6, 2020 | Feb 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-libUpgrade tomcat-el-3.0-api | Mar 24, 2020 | Feb 24, 2020 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.51-11.4.20.0.1.3.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-11.4.20.0.1.3.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-11.4.20.0.1.3.0 on Solaris 11.4 | Jan 19, 2021 | Feb 24, 2020 |
| Oracle_linux | — | Upgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-javadoc | Nov 12, 2020 | Feb 24, 2020 |
| Redhat_linux | — | Upgrade pki-symkeyUpgrade tomcat-el-2.2-apiUpgrade xmlstreambufferUpgrade ldapjdkUpgrade slf4j-jdk14Upgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade bea-stax-apiUpgrade pki-tools-debuginfoUpgrade velocityNo solution existsUpgrade jackson-databindUpgrade stax-exUpgrade python-nss-docUpgrade jackson-coreUpgrade jssUpgrade xml-commons-apisUpgrade glassfish-jaxb-apiUpgrade pki-kraUpgrade tomcat-webappsUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade python3-nssUpgrade pki-symkey-debuginfoUpgrade jackson-jaxrs-providersUpgrade jackson-jaxrs-json-providerUpgrade jss-debuginfoUpgrade javassist-javadocUpgrade pki-core-debugsourceUpgrade xalan-j2Upgrade slf4jUpgrade javassistUpgrade relaxngDatatypeUpgrade tomcat-servlet-3.0-apiUpgrade glassfish-jaxb-txw2Upgrade tomcat-jsvcUpgrade xml-commons-resolverUpgrade python3-nss-debuginfoUpgrade pki-servlet-4.0-apiUpgrade glassfish-fastinfosetUpgrade ldapjdk-javadocUpgrade python3-pkiUpgrade jackson-module-jaxb-annotationsUpgrade pki-toolsUpgrade pki-baseUpgrade tomcat-javadocUpgrade tomcat-docs-webappUpgrade pki-serverUpgrade tomcatUpgrade jss-debugsourceUpgrade pki-servlet-engineUpgrade pki-base-javaUpgrade glassfish-jaxb-coreUpgrade pki-core-debuginfoUpgrade tomcat-jsp-2.2-apiUpgrade python-nss-debugsourceUpgrade apache-commons-collectionsUpgrade apache-commons-langUpgrade pki-caUpgrade jakarta-commons-httpclientUpgrade jackson-annotationsUpgrade xsomUpgrade resteasyUpgrade tomcatjssUpgrade jss-javadocUpgrade apache-commons-net | Nov 11, 2020 | Feb 24, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python-nss-debugsource | Mar 12, 2024 | Feb 24, 2020 |
| Suse | — | Upgrade tomcat-embedUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat-libUpgrade tomcat-el-3_0-apiUpgrade tomcatUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-servlet-4_0-api | Mar 6, 2020 | Feb 24, 2020 |
| Ubuntu | — | Upgrade libtomcat8-javaUpgrade tomcat8 | Aug 5, 2020 | Feb 24, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 24, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub