The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python-nss-docUpgrade relaxngDatatypeUpgrade javassistUpgrade javassist-javadocUpgrade stax-exUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade apache-commons-collectionsUpgrade velocityUpgrade glassfish-fastinfosetUpgrade python3-nssUpgrade glassfish-jaxb-apiUpgrade xalan-j2Upgrade slf4jUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-runtimeUpgrade xmlstreambufferUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-txw2Upgrade xml-commons-apisUpgrade xml-commons-resolverUpgrade apache-commons-langUpgrade slf4j-jdk14Upgrade xsomUpgrade xerces-j2 | May 13, 2022 | May 16, 2018 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat | Apr 27, 2020 | May 16, 2018 |
| Amazon_linux | — | Upgrade tomcat7Upgrade tomcat80Upgrade tomcat8 | Aug 11, 2018 | May 16, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.0.52Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 7.0.88Upgrade Apache Tomcat to 9.0.8Upgrade Apache Tomcat to 8.5.31 | May 17, 2018 | May 16, 2018 |
| Centos_linux | — | Upgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-apiUpgrade glassfish-fastinfosetUpgrade jakarta-commons-httpclientUpgrade tomcat-javadocUpgrade javassistUpgrade javassist-javadocUpgrade relaxngDatatypeUpgrade tomcat-jsp-2.2-apiUpgrade xalan-j2Upgrade tomcat-admin-webappsUpgrade tomcatUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-txw2Upgrade apache-commons-collectionsUpgrade tomcat-webappsUpgrade bea-stax-apiUpgrade tomcat-docs-webappUpgrade jackson-annotationsUpgrade pki-servlet-4.0-apiUpgrade python3-nss-debuginfoUpgrade tomcat-servlet-3.0-apiUpgrade python-nss-docUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-runtimeUpgrade tomcat-el-2.2-apiUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade tomcat-jsvcUpgrade xml-commons-apisUpgrade python3-nssUpgrade xmlstreambufferUpgrade tomcat-libUpgrade resteasyUpgrade jackson-databindUpgrade velocityUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade apache-commons-langUpgrade slf4jUpgrade xml-commons-resolverUpgrade pki-servlet-container | Aug 28, 2019 | May 16, 2018 |
| Debian | — | Upgrade tomcat9Upgrade tomcat7Upgrade tomcat8 | Feb 19, 2019 | May 16, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-webapps | Jul 23, 2018 | May 16, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-api | Aug 10, 2018 | May 16, 2018 |
| Oracle Solaris | — | Upgrade image/library/libjpeg to version 6.0.2-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.32-0.175.3.35.0.4.0 on Solaris 11.3Upgrade library/perl-5/perl-x11-protocol-526 to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/embedded to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/liblouis to version 3.5.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark/wireshark-common to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base-522 to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-522 to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay-526 to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple-522 to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 52.9.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.32-0.175.3.35.0.4.0 on Solaris 11.3Upgrade web/server/apache-24/module/apache-gss to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport-526 to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser-522 to version 2.44-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base-526 to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57 to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI-522 to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/webkitgtk4 to version 2.18.6-11.4.1.0.1.1.0 on Solaris 11.4Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-34 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/curl to version 7.61.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-526 to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol-522 to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade diagnostic/wireshark/tshark to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade terminal/cssh-526 to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml-526 to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/speech-dispatcher to version 0.8.6-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite-526 to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql-522 to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple-526 to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk-522 to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/sqlite-3/documentation to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam to version 5.8.4-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.32-0.175.3.35.0.4.0 on Solaris 11.3Upgrade library/perl-5/authen-pam-526 to version 0.16-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/dotconf to version 1.3-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-27 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext-522 to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database-522 to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml-522 to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade system/display-manager/desktop-startup to version 0.38.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam-522 to version 0.16-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI-526 to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools-522 to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/sqlite-3 to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/speech/espeak to version 1.44.0.5-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay-522 to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/library to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database-526 to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser to version 5.12.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/thunderbird to version 52.9.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk-526 to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade system/display-manager/gdm to version 3.24.2-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite-522 to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql-526 to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext-526 to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser-526 to version 2.44-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/tests to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/client to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh-522 to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/mailman to version 2.1.29.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-35 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport-522 to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools-526 to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4 | Aug 24, 2018 | May 16, 2018 |
| Oracle_linux | — | Upgrade pki-servlet-containerUpgrade apache-commons-langUpgrade tomcat-libUpgrade tomcat-jsvcUpgrade jackson-jaxrs-providersUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade xsomUpgrade tomcat-jsp-2.2-apiUpgrade glassfish-jaxb-apiUpgrade tomcat-el-2.2-apiUpgrade relaxngDatatypeUpgrade slf4j-jdk14Upgrade xalan-j2Upgrade jackson-coreUpgrade xml-commons-apisUpgrade slf4jUpgrade jackson-annotationsUpgrade velocityUpgrade tomcat-javadocUpgrade resteasyUpgrade stax-exUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade javassist-javadocUpgrade jackson-jaxrs-json-providerUpgrade tomcatUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-4.0-apiUpgrade bea-stax-apiUpgrade javassistUpgrade tomcat-servlet-3.0-apiUpgrade apache-commons-collectionsUpgrade python-nss-docUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade glassfish-fastinfosetUpgrade tomcat-docs-webappUpgrade python3-nssUpgrade jackson-databindUpgrade xerces-j2Upgrade glassfish-jaxb-coreUpgrade xml-commons-resolver | Aug 15, 2019 | May 17, 2018 |
| Redhat_linux | — | Upgrade xsomUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade python3-nss-debuginfoUpgrade tomcat-webappsUpgrade jackson-coreUpgrade python3-nssUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade pki-servlet-4.0-apiUpgrade tomcat-libUpgrade python-nss-debugsourceUpgrade velocityUpgrade stax-exUpgrade python-nss-docUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-runtimeUpgrade tomcat-jsvcUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade pki-servlet-containerUpgrade javassist-javadocUpgrade relaxngDatatypeUpgrade glassfish-jaxb-txw2Upgrade xerces-j2Upgrade tomcat-jsp-2.2-apiUpgrade slf4jUpgrade jackson-annotationsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade xmlstreambufferUpgrade javassistUpgrade jackson-databindUpgrade resteasyUpgrade jakarta-commons-httpclientUpgrade xalan-j2Upgrade glassfish-jaxb-apiUpgrade jackson-jaxrs-json-providerUpgrade tomcatUpgrade xml-commons-apisUpgrade tomcat-el-2.2-apiUpgrade tomcat-javadocUpgrade apache-commons-langUpgrade bea-stax-apiUpgrade tomcat-admin-webapps | Jun 19, 2019 | May 16, 2018 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade python-nss-debugsource | Mar 12, 2024 | May 16, 2018 |
| Suse | — | Upgrade tomcat-el-2_2-apiUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-libUpgrade tomcat-jsp-2_2-apiUpgrade tomcatUpgrade tomcat-embedUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-javadocUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-el-3_0-apiUpgrade tomcat-admin-webapps | Sep 14, 2018 | May 16, 2018 |
| Ubuntu | — | Upgrade tomcat7Upgrade libtomcat7-javaUpgrade tomcat8Upgrade libtomcat8-java | Jun 8, 2018 | May 16, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 16, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub