Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade tomcat-jsvcUpgrade tomcat-el-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-webapps | Apr 27, 2020 | Feb 23, 2018 |
| Amazon_linux | — | Upgrade tomcat80Upgrade tomcat7Upgrade tomcat8 | Mar 25, 2018 | Feb 23, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 7.0.85Upgrade Apache Tomcat to 8.5.28Upgrade Apache Tomcat to 8.0.50Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.5 | Feb 26, 2018 | Feb 23, 2018 |
| Centos_linux | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-javadocUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsvcUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-webapps | Aug 28, 2019 | Feb 23, 2018 |
| Debian | — | Upgrade tomcat7 | Aug 30, 2018 | Feb 23, 2018 |
| Freebsd | — | Upgrade tomcat | Feb 28, 2018 | Feb 23, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webapps | Dec 4, 2019 | Feb 23, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-api | Dec 18, 2019 | Feb 23, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-webapps | Sep 24, 2019 | Feb 23, 2018 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.28-0.175.3.31.0.1.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.28-0.175.3.31.0.1.0 on Solaris 11.3Upgrade web/java-servlet/tomcat-8 to version 8.5.28-0.175.3.31.0.1.0 on Solaris 11.3 | Apr 18, 2018 | Feb 23, 2018 |
| Oracle_linux | — | Upgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade tomcat-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-javadoc | Aug 15, 2019 | Feb 23, 2018 |
| Redhat_linux | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade tomcat-webappsUpgrade tomcat-lib | Aug 7, 2019 | Feb 23, 2018 |
| Suse | — | Upgrade tomcat-libUpgrade tomcatUpgrade tomcat-el-3_0-apiUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcat-el-2_2-apiUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-webappsUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-javadoc | Mar 27, 2018 | Feb 23, 2018 |
| Ubuntu | — | Upgrade libtomcat7-javaUpgrade tomcat7Upgrade tomcat8Upgrade libtomcat8-java | Jun 8, 2018 | Feb 23, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub