While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat8 | Apr 20, 2017 | Apr 17, 2017 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 7.0.76Upgrade Apache Tomcat to 9.0.0Upgrade Apache Tomcat to 8.0.42Upgrade Apache Tomcat to 8.5.12Upgrade Apache Tomcat to the latest available version | Apr 17, 2017 | Apr 17, 2017 |
| Centos_linux | — | Upgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-javadocUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-jsvcUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-webapps | Jul 28, 2017 | Apr 17, 2017 |
| Debian | — | Upgrade tomcat7 | May 1, 2017 | Apr 17, 2017 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Oct 30, 2017 | Apr 17, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat | Nov 30, 2017 | Apr 17, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-servlet-3.0-api | Nov 30, 2017 | Apr 17, 2017 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.13-0.175.3.21.0.1.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.13-0.175.3.21.0.1.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.13-0.175.3.21.0.1.0 on Solaris 11.3 | Jun 20, 2017 | Apr 17, 2017 |
| Oracle_linux | — | Upgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-docs-webappUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat | Jul 28, 2017 | Apr 10, 2017 |
| Redhat_linux | — | Upgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade tomcat | Aug 4, 2017 | Apr 17, 2017 |
| Suse | — | Upgrade tomcatUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-webappsUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-libUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-el-2_2-apiUpgrade tomcat-javadocUpgrade tomcat-el-3_0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2_2-api | May 10, 2017 | Apr 17, 2017 |
| Ubuntu | — | Upgrade tomcat7Upgrade tomcat8Upgrade libtomcat7-javaUpgrade libtomcat8-java | Jan 9, 2018 | Apr 17, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub