The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat8Upgrade tomcat7Upgrade tomcat80 | Feb 9, 2018 | Jan 31, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 7.0.84Upgrade Apache Tomcat to 8.5.24Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.2Upgrade Apache Tomcat to 8.0.48 | Feb 1, 2018 | Jan 31, 2018 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8 to version 8.5.28-0.175.3.31.0.1.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.28-0.175.3.31.0.1.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.28-0.175.3.31.0.1.0 on Solaris 11.3 | Apr 18, 2018 | Jan 31, 2018 |
| Suse | — | Upgrade tomcat-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-el-2_2-apiUpgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-libUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-docs-webappUpgrade tomcat | Mar 27, 2018 | Jan 31, 2018 |
| Ubuntu | — | Upgrade libtomcat8-javaUpgrade tomcat8Upgrade libtomcat7-javaUpgrade tomcat7 | Jun 8, 2018 | Jan 31, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub