The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade glassfish-jaxb-runtimeUpgrade relaxngDatatypeUpgrade xsomUpgrade glassfish-fastinfosetUpgrade javassistUpgrade apache-commons-collectionsUpgrade xalan-j2Upgrade apache-commons-langUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade slf4jUpgrade glassfish-jaxb-txw2Upgrade xerces-j2Upgrade xml-commons-resolverUpgrade glassfish-jaxb-coreUpgrade xmlstreambufferUpgrade python3-nssUpgrade python-nss-docUpgrade slf4j-jdk14Upgrade jakarta-commons-httpclientUpgrade stax-exUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade xml-commons-apisUpgrade velocity | May 13, 2022 | Aug 1, 2018 |
| Amazon Linux Ami 2 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-jsvcUpgrade tomcat | Apr 27, 2020 | Aug 1, 2018 |
| Amazon_linux | — | Upgrade tomcat8Upgrade tomcat80Upgrade tomcat7 | Aug 11, 2018 | Aug 1, 2018 |
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 8.5.32Upgrade Apache Tomcat to 8.0.53Upgrade Apache Tomcat to 9.0.10Upgrade Apache Tomcat to 7.0.90 | Aug 1, 2018 | Aug 1, 2018 |
| Centos_linux | — | Upgrade pki-servlet-containerUpgrade jackson-coreUpgrade tomcat-jsp-2.2-apiUpgrade slf4jUpgrade glassfish-jaxb-apiUpgrade tomcat-libUpgrade resteasyUpgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade tomcat-el-2.2-apiUpgrade jackson-jaxrs-providersUpgrade tomcat-jsvcUpgrade jackson-jaxrs-json-providerUpgrade jackson-module-jaxb-annotationsUpgrade python3-nss-debuginfoUpgrade velocityUpgrade jackson-annotationsUpgrade xsomUpgrade apache-commons-langUpgrade slf4j-jdk14Upgrade stax-exUpgrade xml-commons-apisUpgrade tomcat-javadocUpgrade python-nss-docUpgrade tomcatUpgrade tomcat-webappsUpgrade bea-stax-apiUpgrade pki-servlet-4.0-apiUpgrade tomcat-admin-webappsUpgrade python3-nssUpgrade jackson-databindUpgrade javassistUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade xerces-j2Upgrade jakarta-commons-httpclientUpgrade xml-commons-resolverUpgrade javassist-javadocUpgrade xmlstreambufferUpgrade tomcat-servlet-3.0-apiUpgrade xalan-j2Upgrade tomcat-docs-webapp | Aug 28, 2019 | Aug 1, 2018 |
| Debian | — | Upgrade tomcat7Upgrade tomcat9Upgrade tomcat8 | Aug 30, 2018 | Aug 1, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade tomcat-webappsUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.2-api | Dec 4, 2019 | Aug 1, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-2.2-api | Dec 18, 2019 | Aug 1, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcatUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-webapps | Sep 24, 2019 | Aug 1, 2018 |
| Oracle Solaris | — | Upgrade database/sqlite-3 to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/speech/espeak to version 1.44.0.5-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/speech-dispatcher to version 0.8.6-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-526 to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol-526 to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple-526 to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-simple to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql-522 to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite-526 to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-34 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/client to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh-522 to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam to version 5.8.4-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 52.9.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay-526 to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/net-ssleay-522 to version 1.80-11.4.1.0.1.1.0 on Solaris 11.4Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark/wireshark-common to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/desktop/webkitgtk4 to version 2.18.6-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/desktop/dotconf to version 1.3-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI-522 to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark/tshark to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/perl-5/gettext to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser to version 5.12.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh-526 to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade diagnostic/wireshark to version 2.6.3-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/perl-5/xml-simple-522 to version 2.24-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade database/mysql-57 to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools-526 to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam-526 to version 0.16-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base-522 to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk-526 to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser-522 to version 2.44-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/liblouis to version 3.5.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/embedded to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/sqlite-3/documentation to version 3.24.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database-522 to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport-526 to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-tk-522 to version 804.33-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/CGI-526 to version 4.37-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext-526 to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade terminal/cssh to version 4.9-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/authen-pam-522 to version 0.16-11.4.1.0.1.1.0 on Solaris 11.4Upgrade image/library/libjpeg to version 6.0.2-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/perl-x11-protocol-522 to version 0.56-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-parser-526 to version 2.44-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/gettext-522 to version 1.0.7-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-522 to version 0.99-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-mysql-526 to version 4042-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/thunderbird to version 52.9.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-sax-base-526 to version 1.8-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.32-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/dbd-sqlite-522 to version 1.58-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database-526 to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml-526 to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/pmtools-522 to version 2.0.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8 to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade library/python/pyatspi2-35 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/database to version 1.636-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-libxml-522 to version 2.128-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.34-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/curl to version 7.61.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade mail/mailman to version 2.1.29.1-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/tests to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade system/display-manager/desktop-startup to version 0.38.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade database/mysql-57/library to version 5.7.23-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/python/pyatspi2-27 to version 2.18.0-11.4.1.0.1.1.0 on Solaris 11.4Upgrade library/perl-5/xml-namespacesupport-522 to version 1.11-11.4.1.0.1.1.0 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.51-0.175.3.36.0.20.0 on Solaris 11.3Upgrade system/display-manager/gdm to version 3.24.2-11.4.1.0.1.1.0 on Solaris 11.4 | Aug 24, 2018 | Aug 1, 2018 |
| Oracle_linux | — | Upgrade jackson-jaxrs-json-providerUpgrade tomcat-jsp-2.2-apiUpgrade slf4jUpgrade tomcat-el-2.2-apiUpgrade xerces-j2Upgrade relaxngDatatypeUpgrade tomcatUpgrade glassfish-jaxb-txw2Upgrade bea-stax-apiUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade resteasyUpgrade xmlstreambufferUpgrade jackson-coreUpgrade pki-servlet-containerUpgrade jackson-databindUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade xml-commons-apisUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-apiUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade tomcat-javadocUpgrade xalan-j2Upgrade tomcat-admin-webappsUpgrade glassfish-jaxb-runtimeUpgrade jackson-annotationsUpgrade javassistUpgrade tomcat-jsvcUpgrade tomcat-webappsUpgrade apache-commons-collectionsUpgrade python3-nssUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade velocityUpgrade jackson-jaxrs-providersUpgrade stax-exUpgrade tomcat-libUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade jakarta-commons-httpclient | Aug 15, 2019 | Jul 22, 2018 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jul 22, 2018 |
| Redhat_linux | — | Upgrade slf4j-jdk14Upgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade python-nss-docUpgrade javassistUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-webappsUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade tomcat-admin-webappsUpgrade javassist-javadocUpgrade tomcat-docs-webappUpgrade python3-nssUpgrade pki-servlet-4.0-apiUpgrade jakarta-commons-httpclientUpgrade velocityUpgrade bea-stax-apiUpgrade relaxngDatatypeUpgrade jackson-coreUpgrade tomcat-javadocUpgrade python3-nss-debuginfoUpgrade glassfish-jaxb-runtimeUpgrade tomcatUpgrade xsomUpgrade tomcat-el-2.2-apiUpgrade xmlstreambufferUpgrade tomcat-jsvcUpgrade apache-commons-langUpgrade tomcat-jsp-2.2-apiUpgrade glassfish-jaxb-apiUpgrade python-nss-debugsourceUpgrade xerces-j2Upgrade jackson-jaxrs-providersUpgrade jackson-annotationsUpgrade xalan-j2Upgrade resteasyUpgrade pki-servlet-containerUpgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade stax-exUpgrade glassfish-fastinfosetUpgrade jackson-module-jaxb-annotationsUpgrade tomcat-libUpgrade jackson-databindUpgrade slf4j | Jun 19, 2019 | Aug 1, 2018 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nss-debuginfo | Mar 12, 2024 | Aug 1, 2018 |
| Suse | — | Upgrade tomcat-webappsUpgrade tomcat-el-3_0-apiUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-servlet-3_0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-jsvcUpgrade tomcat-jsp-2_2-apiUpgrade tomcat-embedUpgrade tomcat-libUpgrade tomcat-el-2_2-apiUpgrade tomcat-javadoc | Sep 13, 2018 | Aug 1, 2018 |
| Ubuntu | — | Upgrade libtomcat7-javaUpgrade libtomcat8-javaUpgrade tomcat8Upgrade tomcat7 | Aug 4, 2018 | Jul 25, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 1, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub