The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcatUpgrade tomcat-docs-webapp | Oct 21, 2016 | Oct 11, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-admin-webapps | Nov 30, 2017 | Oct 13, 2016 |
| Oracle_linux | — | Upgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-lib | Oct 11, 2016 | Oct 10, 2016 |
| Redhat_linux | — | Upgrade tomcat-docs-webappUpgrade tomcat-javadocUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-servlet-3.0-api | Oct 21, 2016 | Oct 10, 2016 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub