The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-tomcatamazon-linux-ami-2-upgrade-tomcat-admin-webappsamazon-linux-ami-2-upgrade-tomcat-docs-webappamazon-linux-ami-2-upgrade-tomcat-el-3-0-apiamazon-linux-ami-2-upgrade-tomcat-javadocamazon-linux-ami-2-upgrade-tomcat-jsp-2-3-apiamazon-linux-ami-2-upgrade-tomcat-jsvcamazon-linux-ami-2-upgrade-tomcat-libamazon-linux-ami-2-upgrade-tomcat-servlet-3-1-apiamazon-linux-ami-2-upgrade-tomcat-webapps | Sep 28, 2023 | Mar 1, 2021 | |
| Amazon_linux | — | amazon-linux-upgrade-tomcat7 | Apr 8, 2021 | Mar 1, 2021 |
| Apache Tomcat | apache-tomcat-upgrade-7_0_108apache-tomcat-upgrade-8_5_62apache-tomcat-upgrade-9_0_42apache-tomcat-upgrade-10_0_1apache-tomcat-upgrade-latest | Jul 8, 2021 | Mar 1, 2021 | |
| Debian | debian-upgrade-tomcat9 | Mar 17, 2021 | Mar 1, 2021 | |
| Gentoo Linux | gentoo-linux-upgrade-www-servers-tomcat | Aug 22, 2022 | Mar 1, 2021 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-tomcathuawei-euleros-2_0_sp2-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp2-upgrade-tomcat-el-2.2-apihuawei-euleros-2_0_sp2-upgrade-tomcat-jsp-2.2-apihuawei-euleros-2_0_sp2-upgrade-tomcat-libhuawei-euleros-2_0_sp2-upgrade-tomcat-servlet-3.0-apihuawei-euleros-2_0_sp2-upgrade-tomcat-webapps | Sep 16, 2021 | Mar 1, 2021 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-tomcathuawei-euleros-2_0_sp3-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp3-upgrade-tomcat-el-2.2-apihuawei-euleros-2_0_sp3-upgrade-tomcat-jsp-2.2-apihuawei-euleros-2_0_sp3-upgrade-tomcat-libhuawei-euleros-2_0_sp3-upgrade-tomcat-servlet-3.0-apihuawei-euleros-2_0_sp3-upgrade-tomcat-webapps | Apr 30, 2021 | Mar 1, 2021 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-tomcathuawei-euleros-2_0_sp5-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp5-upgrade-tomcat-el-2.2-apihuawei-euleros-2_0_sp5-upgrade-tomcat-jsp-2.2-apihuawei-euleros-2_0_sp5-upgrade-tomcat-libhuawei-euleros-2_0_sp5-upgrade-tomcat-servlet-3.0-apihuawei-euleros-2_0_sp5-upgrade-tomcat-webapps | May 19, 2021 | Mar 1, 2021 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-tomcathuawei-euleros-2_0_sp8-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp8-upgrade-tomcat-el-3.0-apihuawei-euleros-2_0_sp8-upgrade-tomcat-jsp-2.3-apihuawei-euleros-2_0_sp8-upgrade-tomcat-libhuawei-euleros-2_0_sp8-upgrade-tomcat-servlet-4.0-api | May 18, 2021 | Mar 1, 2021 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-8-5-64-11-4-32-0-1-88-2oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-5-64-11-4-32-0-1-88-2oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-5-64-11-4-32-0-1-88-2 | Apr 21, 2021 | Mar 1, 2021 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Mar 1, 2021 | |
| Suse | — | suse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-embedsuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-jsvcsuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-3_1-apisuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webappssuse-upgrade-tomcat6suse-upgrade-tomcat6-admin-webappssuse-upgrade-tomcat6-docs-webappsuse-upgrade-tomcat6-javadocsuse-upgrade-tomcat6-jsp-2_1-apisuse-upgrade-tomcat6-libsuse-upgrade-tomcat6-servlet-2_5-apisuse-upgrade-tomcat6-webapps | Mar 31, 2021 | Mar 1, 2021 |
| Ubuntu | ubuntu-pro-upgrade-libservlet3-0-javaubuntu-pro-upgrade-libtomcat7-javaubuntu-pro-upgrade-tomcat7ubuntu-upgrade-libtomcat9-embed-javaubuntu-upgrade-libtomcat9-javaubuntu-upgrade-tomcat9ubuntu-upgrade-tomcat9-common | Apr 1, 2022 | Mar 1, 2021 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Mar 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub