Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2015-5346
Vulnerability from cvelistv5
Published
2016-02-25 01:00
Modified
2024-08-06 06:41
Severity ?
EPSS score ?
Summary
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T06:41:09.411Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"name": "GLSA-201705-09",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"name": "20160222 [SECURITY] CVE-2015-5346 Apache Tomcat Session fixation",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/bugtraq/2016/Feb/143"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"name": "openSUSE-SU-2016:0865",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-9.html"
},
{
"name": "USN-3024-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-3024-1"
},
{
"name": "SUSE-SU-2016:0769",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"name": "DSA-3530",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713184"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "RHSA-2016:2046",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2046.html"
},
{
"name": "83323",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/83323"
},
{
"name": "RHSA-2016:1089",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "RHSA-2016:1087",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723414"
},
{
"name": "1035069",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1035069"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"name": "RHSA-2016:2807",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"name": "RHSA-2016:1088",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20180531-0001/"
},
{
"name": "RHSA-2016:2808",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"name": "SUSE-SU-2016:0822",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bz.apache.org/bugzilla/show_bug.cgi?id=58809"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713185"
},
{
"name": "DSA-3609",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723506"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713187"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"name": "DSA-3552",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-02-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-13T16:06:12",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"name": "GLSA-201705-09",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"name": "20160222 [SECURITY] CVE-2015-5346 Apache Tomcat Session fixation",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/bugtraq/2016/Feb/143"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"name": "openSUSE-SU-2016:0865",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-9.html"
},
{
"name": "USN-3024-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-3024-1"
},
{
"name": "SUSE-SU-2016:0769",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"name": "DSA-3530",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713184"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "RHSA-2016:2046",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2046.html"
},
{
"name": "83323",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/83323"
},
{
"name": "RHSA-2016:1089",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "RHSA-2016:1087",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723414"
},
{
"name": "1035069",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1035069"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"name": "RHSA-2016:2807",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"name": "RHSA-2016:1088",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20180531-0001/"
},
{
"name": "RHSA-2016:2808",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"name": "SUSE-SU-2016:0822",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bz.apache.org/bugzilla/show_bug.cgi?id=58809"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713185"
},
{
"name": "DSA-3609",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723506"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713187"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"name": "DSA-3552",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-5346",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"name": "GLSA-201705-09",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"name": "20160222 [SECURITY] CVE-2015-5346 Apache Tomcat Session fixation",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"name": "openSUSE-SU-2016:0865",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"name": "http://tomcat.apache.org/security-9.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-9.html"
},
{
"name": "USN-3024-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3024-1"
},
{
"name": "SUSE-SU-2016:0769",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"name": "DSA-3530",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713184",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713184"
},
{
"name": "http://tomcat.apache.org/security-7.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "RHSA-2016:2046",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2046.html"
},
{
"name": "83323",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/83323"
},
{
"name": "RHSA-2016:1089",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"name": "http://tomcat.apache.org/security-8.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "RHSA-2016:1087",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723414",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723414"
},
{
"name": "1035069",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1035069"
},
{
"name": "https://bto.bluecoat.com/security-advisory/sa118",
"refsource": "CONFIRM",
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442",
"refsource": "CONFIRM",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"name": "RHSA-2016:2807",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"name": "RHSA-2016:1088",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"name": "https://security.netapp.com/advisory/ntap-20180531-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20180531-0001/"
},
{
"name": "RHSA-2016:2808",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"name": "SUSE-SU-2016:0822",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"name": "https://bz.apache.org/bugzilla/show_bug.cgi?id=58809",
"refsource": "CONFIRM",
"url": "https://bz.apache.org/bugzilla/show_bug.cgi?id=58809"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713185",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713185"
},
{
"name": "DSA-3609",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723506",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723506"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713187",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713187"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626",
"refsource": "CONFIRM",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"name": "DSA-3552",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"name": "http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2015-5346",
"datePublished": "2016-02-25T01:00:00",
"dateReserved": "2015-07-01T00:00:00",
"dateUpdated": "2024-08-06T06:41:09.411Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2015-5346\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2016-02-25T01:59:02.167\",\"lastModified\":\"2024-11-21T02:32:50.300\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de fijaci\u00f3n de sesi\u00f3n en Apache Tomcat 7.x en versiones anteriores a 7.0.66, 8.x en versiones anteriores a 8.0.30 y 9.x en versiones anteriores a 9.0.0.M2, cuando se utilizan configuraciones de sesi\u00f3n diferentes para despliegues de m\u00faltiples versiones de la misma aplicaci\u00f3n web, podr\u00eda permitir a atacantes remotos secuestrar sesiones web aprovechando el uso de un campo requestedSessionSSL para una petici\u00f3n no intencionada, relacionado con CoyoteAdapter.java y Request.java.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"33E9607B-4D28-460D-896B-E4B7FA22441E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"81A31CA0-A209-4C49-AA06-C38E165E5B68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AA563BF-A67A-477D-956A-167ABEF885C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.5:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F1B937B-57E0-4E88-9E39-39012A924525\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8980E61E-27BE-4858-82B3-C0E8128AF521\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9731BAA-4C6C-4259-B786-F577D8A90FA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F74A421-D019-4248-84B8-C70D4D9A8A95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BA27FF9-4C66-4E17-95C0-1CB2DAA6AFC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"305688F2-50A6-41FB-8614-BC589DB9A789\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25966344-15D5-4101-9346-B06BFD2DFFF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D4F710E-06EA-48F4-AC6A-6F143950F015\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C4936C2-0B2D-4C44-98C3-443090965F5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48453405-2319-4327-9F4C-6F70B49452C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49DD9544-6424-41A6-AEC0-EC19B8A10E71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4670E65-2E11-49A4-B661-57C2F60D411F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31002A23-4788-4BC7-AE11-A3C2AA31716D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7144EDDF-8265-4642-8EEB-ED52527E0A26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF06B5C1-B9DD-4673-A101-56E1E593ACDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D731065-626B-4425-8E49-F708DD457824\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3D850EA-E537-42C8-93B9-96E15CB26747\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E037DA05-2BEF-4F64-B8BB-307247B6A05C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D395D95B-1F4A-420E-A0F6-609360AF7B69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BD221BA-0AB6-4972-8AD9-5D37AC07762F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E55B6565-96CB-4F6A-9A80-C3FB82F30546\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3300AFE-49A4-4904-B9A0-5679F09FA01E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD93669-1B30-4BF8-AD7D-F60DD8D63CC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8C8C97F-6C9D-4647-AB8A-ADAA5536DDE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C6109D1-BC36-40C5-A02A-7AEBC949BAC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA8A7333-B4C3-4876-AE01-62F2FD315504\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"92993E23-D805-407B-8B87-11CEEE8B212F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AA28D3A-3EE5-4F90-B8F5-4943F7607DA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C947E549-2459-4AFB-84A7-36BDA30B5F29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D55DF79-F9BE-4907-A4D8-96C4B11189ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14AB5787-82D7-4F78-BE93-4556AB7A7D0E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8E9453E-BC9B-4F77-85FA-BA15AC55C245\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7EF0518-73F9-47DB-8946-A8334936BEFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"95AA8778-7833-4572-A71B-5FD89938CE94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"242E47CE-EF69-4F8F-AB40-5AF2811674CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CDA1555C-E55A-4E14-B786-BFEE3F09220B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8075E9A-DA7F-4A0B-8B4D-0CD951369111\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"335A5320-6086-4B45-9903-82F6F92A584F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46B33408-C2E2-4E7C-9334-6AB98F13468C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F036676-9EFB-4A92-828E-A38905D594E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E9728EE8-6029-4DF3-942E-E4ACC09111A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4752862B-7D26-4285-B8A0-CF082C758353\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*\",\"matchCriteriaId\":\"58EA7199-3373-4F97-9907-3A479A02155E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F963D737-2E95-4D7C-92C7-DACF3F36D1E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BBBC5EA-012C-4C5D-A61B-BAF134B300DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A358FDF-C249-4D7A-9445-8B9E7D9D40AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AFF96F96-34DB-4EB3-BF59-11220673FA26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"701424A2-BB06-44B5-B468-7164E4F95529\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1BA6388C-5B6E-4651-8AE3-EBCCF61C27E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F9A5B7E-33A9-4651-9BE1-371A0064B661\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F99252E8-A59C-48E1-B251-718D7FB3E399\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E0DDEF6-A8EE-46C4-A046-A1F26E7C4E87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14B38892-9C00-4510-B7BA-F2A8F2CACCAE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7409B064-D43E-489E-AEC6-0A767FB21737\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F019268F-80C4-48FE-8164-E9DA0A3BAFF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EFBD214-FCFE-4F04-A903-66EFDA764B9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"425D86B3-6BB9-410D-8125-F7CF87290AD6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EE3BB0D-1002-41E4-9BE8-875D97330057\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6622472B-8644-4D45-A54B-A215C3D64B83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B338F95B-2924-435B-827F-E64420A93244\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"209D1349-7740-4DBE-80A5-E6343C62BAB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"09E77C24-C265-403D-A193-B3739713F6B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D0689FE-4BC0-4F53-8C79-34B21F9B86C2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B5A6F2F3-4894-4392-8296-3B8DD2679084\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E88A537F-F4D0-46B9-9E37-965233C2A355\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F59A04-14CF-49E2-9973-645477EA09DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1089.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2046.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2807.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2808.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://seclists.org/bugtraq/2016/Feb/143\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1713184\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1713185\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1713187\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1723414\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1723506\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://tomcat.apache.org/security-7.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-8.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-9.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3530\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.debian.org/security/2016/dsa-3552\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.debian.org/security/2016/dsa-3609\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/bid/83323\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securitytracker.com/id/1035069\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.ubuntu.com/usn/USN-3024-1\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1087\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1088\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bto.bluecoat.com/security-advisory/sa118\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bz.apache.org/bugzilla/show_bug.cgi?id=58809\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://security.gentoo.org/glsa/201705-09\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20180531-0001/\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1089.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2046.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2807.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2808.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://seclists.org/bugtraq/2016/Feb/143\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1713184\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1713185\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1713187\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1723414\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1723506\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://tomcat.apache.org/security-7.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-8.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-9.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3530\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2016/dsa-3552\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2016/dsa-3609\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/83323\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1035069\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-3024-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1087\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1088\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bto.bluecoat.com/security-advisory/sa118\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bz.apache.org/bugzilla/show_bug.cgi?id=58809\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/201705-09\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20180531-0001/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"evaluatorComment\":\"\u003ca href=\\\"https://cwe.mitre.org/data/definitions/384.html\\\"\u003eCWE-384: Session Fixation\u003c/a\u003e\"}}"
}
}
gsd-2015-5346
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2015-5346",
"description": "Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.",
"id": "GSD-2015-5346",
"references": [
"https://www.suse.com/security/cve/CVE-2015-5346.html",
"https://www.debian.org/security/2016/dsa-3609",
"https://www.debian.org/security/2016/dsa-3552",
"https://www.debian.org/security/2016/dsa-3530",
"https://access.redhat.com/errata/RHSA-2016:2808",
"https://access.redhat.com/errata/RHSA-2016:2807",
"https://access.redhat.com/errata/RHSA-2016:2046",
"https://access.redhat.com/errata/RHSA-2016:1089",
"https://access.redhat.com/errata/RHSA-2016:1088",
"https://access.redhat.com/errata/RHSA-2016:1087",
"https://ubuntu.com/security/CVE-2015-5346",
"https://advisories.mageia.org/CVE-2015-5346.html",
"https://alas.aws.amazon.com/cve/html/CVE-2015-5346.html",
"https://linux.oracle.com/cve/CVE-2015-5346.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2015-5346"
],
"details": "Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.",
"id": "GSD-2015-5346",
"modified": "2023-12-13T01:20:06.157793Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-5346",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"name": "GLSA-201705-09",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"name": "20160222 [SECURITY] CVE-2015-5346 Apache Tomcat Session fixation",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"name": "openSUSE-SU-2016:0865",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"name": "http://tomcat.apache.org/security-9.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-9.html"
},
{
"name": "USN-3024-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3024-1"
},
{
"name": "SUSE-SU-2016:0769",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"name": "DSA-3530",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713184",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713184"
},
{
"name": "http://tomcat.apache.org/security-7.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "RHSA-2016:2046",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2046.html"
},
{
"name": "83323",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/83323"
},
{
"name": "RHSA-2016:1089",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"name": "http://tomcat.apache.org/security-8.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "RHSA-2016:1087",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723414",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723414"
},
{
"name": "1035069",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1035069"
},
{
"name": "https://bto.bluecoat.com/security-advisory/sa118",
"refsource": "CONFIRM",
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442",
"refsource": "CONFIRM",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"name": "RHSA-2016:2807",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"name": "RHSA-2016:1088",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"name": "https://security.netapp.com/advisory/ntap-20180531-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20180531-0001/"
},
{
"name": "RHSA-2016:2808",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"name": "SUSE-SU-2016:0822",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"name": "https://bz.apache.org/bugzilla/show_bug.cgi?id=58809",
"refsource": "CONFIRM",
"url": "https://bz.apache.org/bugzilla/show_bug.cgi?id=58809"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713185",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713185"
},
{
"name": "DSA-3609",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723506",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723506"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713187",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713187"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626",
"refsource": "CONFIRM",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"name": "DSA-3552",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"name": "http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "[7.0.0,7.0.65],[8.0.0.RC1,8.0.30],[9.0.0.M1]",
"affected_versions": "All versions starting from 7.0.0 up to 7.0.65, all versions starting from 8.0.0.rc1 up to 8.0.30, version 9.0.0.m1",
"cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"cvss_v3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2022-07-06",
"description": "Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.",
"fixed_versions": [
"8.0.31",
"9.0.0.M2",
"7.0.66"
],
"identifier": "CVE-2015-5346",
"identifiers": [
"GHSA-jrcp-c39h-r29x",
"CVE-2015-5346"
],
"not_impacted": "All versions before 7.0.0, all versions after 7.0.65 before 8.0.0.rc1, all versions after 8.0.30 before 9.0.0.m1, all versions after 9.0.0.m1",
"package_slug": "maven/org.apache.tomcat/tomcat",
"pubdate": "2022-05-14",
"solution": "Upgrade to versions 8.0.31, 9.0.0.M2, 7.0.66 or above.",
"title": "Improper Neutralization of Input During Web Page Generation in Apache Tomcat",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2015-5346",
"https://access.redhat.com/errata/RHSA-2016:1087",
"https://access.redhat.com/errata/RHSA-2016:1088",
"https://bto.bluecoat.com/security-advisory/sa118",
"https://bz.apache.org/bugzilla/show_bug.cgi?id=58809",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626",
"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E",
"https://security.gentoo.org/glsa/201705-09",
"https://security.netapp.com/advisory/ntap-20180531-0001/",
"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html",
"http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html",
"http://rhn.redhat.com/errata/RHSA-2016-1089.html",
"http://rhn.redhat.com/errata/RHSA-2016-2046.html",
"http://rhn.redhat.com/errata/RHSA-2016-2807.html",
"http://rhn.redhat.com/errata/RHSA-2016-2808.html",
"http://seclists.org/bugtraq/2016/Feb/143",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1713184",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1713185",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1713187",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1723414",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1723506",
"http://tomcat.apache.org/security-7.html",
"http://tomcat.apache.org/security-8.html",
"http://tomcat.apache.org/security-9.html",
"http://www.debian.org/security/2016/dsa-3530",
"http://www.debian.org/security/2016/dsa-3552",
"http://www.debian.org/security/2016/dsa-3609",
"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
"http://www.ubuntu.com/usn/USN-3024-1",
"https://github.com/advisories/GHSA-jrcp-c39h-r29x"
],
"uuid": "65559b42-f6cc-47ce-a089-f8704e9ce0d6"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.5:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2015-5346"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713185",
"refsource": "CONFIRM",
"tags": [],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713185"
},
{
"name": "https://bz.apache.org/bugzilla/show_bug.cgi?id=58809",
"refsource": "CONFIRM",
"tags": [],
"url": "https://bz.apache.org/bugzilla/show_bug.cgi?id=58809"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713184",
"refsource": "CONFIRM",
"tags": [],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713184"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713187",
"refsource": "CONFIRM",
"tags": [],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713187"
},
{
"name": "http://tomcat.apache.org/security-8.html",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "http://tomcat.apache.org/security-9.html",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://tomcat.apache.org/security-9.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723414",
"refsource": "CONFIRM",
"tags": [],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723414"
},
{
"name": "http://tomcat.apache.org/security-7.html",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723506",
"refsource": "CONFIRM",
"tags": [],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723506"
},
{
"name": "20160222 [SECURITY] CVE-2015-5346 Apache Tomcat Session fixation",
"refsource": "BUGTRAQ",
"tags": [],
"url": "http://seclists.org/bugtraq/2016/Feb/143"
},
{
"name": "DSA-3530",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626",
"refsource": "CONFIRM",
"tags": [],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442",
"refsource": "CONFIRM",
"tags": [],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"name": "DSA-3609",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"name": "USN-3024-1",
"refsource": "UBUNTU",
"tags": [],
"url": "http://www.ubuntu.com/usn/USN-3024-1"
},
{
"name": "DSA-3552",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"
},
{
"name": "RHSA-2016:2046",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2046.html"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"name": "83323",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/83323"
},
{
"name": "RHSA-2016:1087",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"name": "RHSA-2016:1089",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"name": "RHSA-2016:1088",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"name": "SUSE-SU-2016:0769",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"name": "openSUSE-SU-2016:0865",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"name": "https://bto.bluecoat.com/security-advisory/sa118",
"refsource": "CONFIRM",
"tags": [],
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"name": "SUSE-SU-2016:0822",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"name": "1035069",
"refsource": "SECTRACK",
"tags": [],
"url": "http://www.securitytracker.com/id/1035069"
},
{
"name": "http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html",
"refsource": "MISC",
"tags": [],
"url": "http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html"
},
{
"name": "GLSA-201705-09",
"refsource": "GENTOO",
"tags": [],
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"name": "RHSA-2016:2808",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"name": "RHSA-2016:2807",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"name": "https://security.netapp.com/advisory/ntap-20180531-0001/",
"refsource": "CONFIRM",
"tags": [],
"url": "https://security.netapp.com/advisory/ntap-20180531-0001/"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
},
"lastModifiedDate": "2023-12-08T16:41Z",
"publishedDate": "2016-02-25T01:59Z"
}
}
}
rhsa-2016_2046
Vulnerability from csaf_redhat
Published
2016-10-10 20:38
Modified
2024-11-22 10:10
Summary
Red Hat Security Advisory: tomcat security update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-5425)
* It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)
* It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could use this flaw to bypass security manager protections. (CVE-2014-7810)
* It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5388)
* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
Red Hat would like to thank Dawid Golunski (http://legalhackers.com) for reporting CVE-2016-5425 and Scott Geary (VendHQ) for reporting CVE-2016-5388. The CVE-2016-6325 issue was discovered by Red Hat Product Security.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for tomcat is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-5425)\n\n* It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)\n\n* It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could use this flaw to bypass security manager protections. (CVE-2014-7810)\n\n* It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5388)\n\n* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)\n\nRed Hat would like to thank Dawid Golunski (http://legalhackers.com) for reporting CVE-2016-5425 and Scott Geary (VendHQ) for reporting CVE-2016-5388. The CVE-2016-6325 issue was discovered by Red Hat Product Security.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:2046",
"url": "https://access.redhat.com/errata/RHSA-2016:2046"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.59",
"url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.59"
},
{
"category": "external",
"summary": "1222573",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1222573"
},
{
"category": "external",
"summary": "1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "1353809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1353809"
},
{
"category": "external",
"summary": "1362545",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1362545"
},
{
"category": "external",
"summary": "1367447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1367447"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2046.json"
}
],
"title": "Red Hat Security Advisory: tomcat security update",
"tracking": {
"current_release_date": "2024-11-22T10:10:37+00:00",
"generator": {
"date": "2024-11-22T10:10:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:2046",
"initial_release_date": "2016-10-10T20:38:43+00:00",
"revision_history": [
{
"date": "2016-10-10T20:38:43+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-10-10T20:38:43+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T10:10:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"product": {
"name": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"product_id": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-jsp-2.2-api@7.0.54-8.el7_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"product": {
"name": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"product_id": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-servlet-3.0-api@7.0.54-8.el7_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"product": {
"name": "tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"product_id": "tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-webapps@7.0.54-8.el7_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-0:7.0.54-8.el7_2.noarch",
"product": {
"name": "tomcat-0:7.0.54-8.el7_2.noarch",
"product_id": "tomcat-0:7.0.54-8.el7_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat@7.0.54-8.el7_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"product": {
"name": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"product_id": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-el-2.2-api@7.0.54-8.el7_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"product": {
"name": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"product_id": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-admin-webapps@7.0.54-8.el7_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-lib-0:7.0.54-8.el7_2.noarch",
"product": {
"name": "tomcat-lib-0:7.0.54-8.el7_2.noarch",
"product_id": "tomcat-lib-0:7.0.54-8.el7_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-lib@7.0.54-8.el7_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"product": {
"name": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"product_id": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-docs-webapp@7.0.54-8.el7_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"product": {
"name": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"product_id": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-javadoc@7.0.54-8.el7_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"product": {
"name": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"product_id": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-jsvc@7.0.54-8.el7_2?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-0:7.0.54-8.el7_2.src",
"product": {
"name": "tomcat-0:7.0.54-8.el7_2.src",
"product_id": "tomcat-0:7.0.54-8.el7_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat@7.0.54-8.el7_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.src as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.src",
"relates_to_product_reference": "7Client-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-lib-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.src",
"relates_to_product_reference": "7Client-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-lib-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Client-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.src",
"relates_to_product_reference": "7ComputeNode-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-lib-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.src",
"relates_to_product_reference": "7ComputeNode-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-lib-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.src",
"relates_to_product_reference": "7Server-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-lib-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.src",
"relates_to_product_reference": "7Server-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-lib-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Server-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.src",
"relates_to_product_reference": "7Workstation-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-lib-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.54-8.el7_2.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src"
},
"product_reference": "tomcat-0:7.0.54-8.el7_2.src",
"relates_to_product_reference": "7Workstation-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-lib-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-optional-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.54-8.el7_2.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"relates_to_product_reference": "7Workstation-optional-7.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-7810",
"discovery_date": "2015-05-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1222573"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could use this flaw to bypass security manager protections.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat/JbossWeb: security manager bypass via EL expressions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-7810"
},
{
"category": "external",
"summary": "RHBZ#1222573",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1222573"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-7810",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-7810"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-7810",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7810"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44",
"url": "http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.59",
"url": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.59"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.17",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.17"
}
],
"release_date": "2015-05-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-10-10T20:38:43+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2046"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat/JbossWeb: security manager bypass via EL expressions"
},
{
"cve": "CVE-2015-5346",
"discovery_date": "2014-06-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311085"
}
],
"notes": [
{
"category": "description",
"text": "A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Session fixation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5346"
},
{
"category": "external",
"summary": "RHBZ#1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5346",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5346"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/143",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-10-10T20:38:43+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2046"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Session fixation"
},
{
"acknowledgments": [
{
"names": [
"Scott Geary"
],
"organization": "VendHQ"
}
],
"cve": "CVE-2016-5388",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-07-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1353809"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat: CGI sets environmental variable based on user supplied Proxy request header",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-5388"
},
{
"category": "external",
"summary": "RHBZ#1353809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1353809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-5388",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-5388"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-5388",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5388"
}
],
"release_date": "2016-07-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-10-10T20:38:43+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2046"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat: CGI sets environmental variable based on user supplied Proxy request header"
},
{
"acknowledgments": [
{
"names": [
"Dawid Golunski"
],
"organization": "http://legalhackers.com"
}
],
"cve": "CVE-2016-5425",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"discovery_date": "2016-07-30T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1362545"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the Tomcat packages installed configuration file /usr/lib/tmpfiles.d/tomcat.conf writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Local privilege escalation via systemd-tmpfiles service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-5425"
},
{
"category": "external",
"summary": "RHBZ#1362545",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1362545"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-5425",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-5425"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-5425",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5425"
},
{
"category": "external",
"summary": "http://legalhackers.com/advisories/Tomcat-RedHat-based-Root-Privilege-Escalation-Exploit.txt",
"url": "http://legalhackers.com/advisories/Tomcat-RedHat-based-Root-Privilege-Escalation-Exploit.txt"
}
],
"release_date": "2016-10-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-10-10T20:38:43+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2046"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Local privilege escalation via systemd-tmpfiles service"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2016-6325",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"discovery_date": "2016-08-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1367447"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: tomcat writable config files allow privilege escalation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6325"
},
{
"category": "external",
"summary": "RHBZ#1367447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1367447"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6325",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6325"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6325",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6325"
}
],
"release_date": "2016-10-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-10-10T20:38:43+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2046"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 1.9,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Client-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Client-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7ComputeNode-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7ComputeNode-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Server-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Server-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-0:7.0.54-8.el7_2.src",
"7Workstation-optional-7.2.Z:tomcat-admin-webapps-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-docs-webapp-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-el-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-javadoc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsp-2.2-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-jsvc-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-lib-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-servlet-3.0-api-0:7.0.54-8.el7_2.noarch",
"7Workstation-optional-7.2.Z:tomcat-webapps-0:7.0.54-8.el7_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: tomcat writable config files allow privilege escalation"
}
]
}
rhsa-2016_2807
Vulnerability from csaf_redhat
Published
2016-11-17 20:33
Modified
2024-11-22 09:43
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7
Notes
Topic
An update is now available for Red Hat JBoss Enterprise Web Server 2 for RHEL 6 and Red Hat JBoss Enterprise Web Server 2 for RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
This release of Red Hat JBoss Web Server 2.1.2 serves as a replacement for Red Hat JBoss Web Server 2.1.1. It contains security fixes for the Tomcat 7 component. Only users of the Tomcat 7 component in JBoss Web Server need to apply the fixes delivered in this release.
Security Fix(es):
* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
* A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)
* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Enterprise Web Server 2 for RHEL 6 and Red Hat JBoss Enterprise Web Server 2 for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nThis release of Red Hat JBoss Web Server 2.1.2 serves as a replacement for Red Hat JBoss Web Server 2.1.1. It contains security fixes for the Tomcat 7 component. Only users of the Tomcat 7 component in JBoss Web Server need to apply the fixes delivered in this release.\n\nSecurity Fix(es):\n\n* A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)\n\n* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)\n\n* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)\n\n* A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)\n\n* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)\n\n* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:2807",
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "1349468",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349468"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2807.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7",
"tracking": {
"current_release_date": "2024-11-22T09:43:48+00:00",
"generator": {
"date": "2024-11-22T09:43:48+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:2807",
"initial_release_date": "2016-11-17T20:33:11+00:00",
"revision_history": [
{
"date": "2016-11-17T20:33:11+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-11-17T21:53:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T09:43:48+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product": {
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product": {
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-maven-devel@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-maven-devel@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"product": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"product_id": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.54-23_patch_05.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"product": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"product_id": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.54-23_patch_05.ep6.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src"
},
"product_reference": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src"
},
"product_reference": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-5346",
"discovery_date": "2014-06-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311085"
}
],
"notes": [
{
"category": "description",
"text": "A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Session fixation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5346"
},
{
"category": "external",
"summary": "RHBZ#1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5346",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5346"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/143",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:33:11+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Session fixation"
},
{
"cve": "CVE-2015-5351",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311076"
}
],
"notes": [
{
"category": "description",
"text": "A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: CSRF token leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5351"
},
{
"category": "external",
"summary": "RHBZ#1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5351",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/148",
"url": "http://seclists.org/bugtraq/2016/Feb/148"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:33:11+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: CSRF token leak"
},
{
"cve": "CVE-2016-0706",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311087"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via StatusManagerServlet",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0706"
},
{
"category": "external",
"summary": "RHBZ#1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0706"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/144",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:33:11+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security manager bypass via StatusManagerServlet"
},
{
"cve": "CVE-2016-0714",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311082"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security Manager bypass via persistence mechanisms",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0714"
},
{
"category": "external",
"summary": "RHBZ#1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0714",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0714"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/145",
"url": "http://seclists.org/bugtraq/2016/Feb/145"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:33:11+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Security Manager bypass via persistence mechanisms"
},
{
"cve": "CVE-2016-0763",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311093"
}
],
"notes": [
{
"category": "description",
"text": "A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via setGlobalContext()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0763"
},
{
"category": "external",
"summary": "RHBZ#1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/147",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:33:11+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: security manager bypass via setGlobalContext()"
},
{
"cve": "CVE-2016-3092",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-06-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1349468"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Usage of vulnerable FileUpload package can result in denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-3092"
},
{
"category": "external",
"summary": "RHBZ#1349468",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349468"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-3092",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3092"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3092",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3092"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-7.html",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html",
"url": "http://tomcat.apache.org/security-8.html"
}
],
"release_date": "2016-06-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:33:11+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Usage of vulnerable FileUpload package can result in denial of service"
}
]
}
rhsa-2016_1088
Vulnerability from csaf_redhat
Published
2016-05-17 16:30
Modified
2024-11-22 09:43
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update
Notes
Topic
Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.
Security Fix(es):
* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.\n\nSecurity Fix(es):\n\n* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)\n\n* A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)\n\n* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)\n\n* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763) \n\n* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)\n\n* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1088",
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html"
},
{
"category": "external",
"summary": "1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "JWS-271",
"url": "https://issues.redhat.com/browse/JWS-271"
},
{
"category": "external",
"summary": "JWS-272",
"url": "https://issues.redhat.com/browse/JWS-272"
},
{
"category": "external",
"summary": "JWS-276",
"url": "https://issues.redhat.com/browse/JWS-276"
},
{
"category": "external",
"summary": "JWS-277",
"url": "https://issues.redhat.com/browse/JWS-277"
},
{
"category": "external",
"summary": "JWS-303",
"url": "https://issues.redhat.com/browse/JWS-303"
},
{
"category": "external",
"summary": "JWS-304",
"url": "https://issues.redhat.com/browse/JWS-304"
},
{
"category": "external",
"summary": "JWS-310",
"url": "https://issues.redhat.com/browse/JWS-310"
},
{
"category": "external",
"summary": "JWS-349",
"url": "https://issues.redhat.com/browse/JWS-349"
},
{
"category": "external",
"summary": "JWS-350",
"url": "https://issues.redhat.com/browse/JWS-350"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1088.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update",
"tracking": {
"current_release_date": "2024-11-22T09:43:39+00:00",
"generator": {
"date": "2024-11-22T09:43:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1088",
"initial_release_date": "2016-05-17T16:30:34+00:00",
"revision_history": [
{
"date": "2016-05-17T16:30:34+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-05-17T16:30:35+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T09:43:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 3.0 for RHEL 7",
"product": {
"name": "Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.0::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-0:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "httpd24-0:2.4.6-61.ep7.el7.x86_64",
"product_id": "httpd24-0:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24@2.4.6-61.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"product_id": "mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy24_html@2.4.6-61.ep7.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"product_id": "httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-devel@2.4.6-61.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"product_id": "mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session24@2.4.6-61.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"product_id": "httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-debuginfo@2.4.6-61.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"product_id": "mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap24@2.4.6-61.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"product_id": "mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl24@2.4.6-61.ep7.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"product_id": "httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-tools@2.4.6-61.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"product": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"product_id": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3@2.8.0-7.GA.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"product": {
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"product_id": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3-debuginfo@2.8.0-7.GA.ep7.el7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-0:2.4.6-61.ep7.el7.src",
"product": {
"name": "httpd24-0:2.4.6-61.ep7.el7.src",
"product_id": "httpd24-0:2.4.6-61.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24@2.4.6-61.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"product": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"product_id": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3@2.8.0-7.GA.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"product": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"product_id": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.59-50_patch_01.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"product": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"product_id": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8@8.0.18-61_patch_01.ep7.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"product": {
"name": "httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"product_id": "httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-manual@2.4.6-61.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-servlet-3.1-api@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-el-2.2-api@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-webapps@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-admin-webapps@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-docs-webapp@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-log4j@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-javadoc@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-lib@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-jsp-2.3-api@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-0:2.4.6-61.ep7.el7.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src"
},
"product_reference": "httpd24-0:2.4.6-61.ep7.el7.src",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-0:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "httpd24-0:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-devel-0:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-manual-0:2.4.6-61.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch"
},
"product_reference": "httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-tools-0:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap24-0:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src"
},
"product_reference": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64"
},
"product_reference": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64"
},
"product_reference": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session24-0:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl24-1:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src"
},
"product_reference": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src"
},
"product_reference": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-5345",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311089"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: directory disclosure",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5345"
},
{
"category": "external",
"summary": "RHBZ#1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5345",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5345"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/146",
"url": "http://seclists.org/bugtraq/2016/Feb/146"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: directory disclosure"
},
{
"cve": "CVE-2015-5346",
"discovery_date": "2014-06-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311085"
}
],
"notes": [
{
"category": "description",
"text": "A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Session fixation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5346"
},
{
"category": "external",
"summary": "RHBZ#1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5346",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5346"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/143",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Session fixation"
},
{
"cve": "CVE-2015-5351",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311076"
}
],
"notes": [
{
"category": "description",
"text": "A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: CSRF token leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5351"
},
{
"category": "external",
"summary": "RHBZ#1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5351",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/148",
"url": "http://seclists.org/bugtraq/2016/Feb/148"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: CSRF token leak"
},
{
"cve": "CVE-2016-0706",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311087"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via StatusManagerServlet",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0706"
},
{
"category": "external",
"summary": "RHBZ#1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0706"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/144",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security manager bypass via StatusManagerServlet"
},
{
"cve": "CVE-2016-0714",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311082"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security Manager bypass via persistence mechanisms",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0714"
},
{
"category": "external",
"summary": "RHBZ#1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0714",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0714"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/145",
"url": "http://seclists.org/bugtraq/2016/Feb/145"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Security Manager bypass via persistence mechanisms"
},
{
"cve": "CVE-2016-0763",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311093"
}
],
"notes": [
{
"category": "description",
"text": "A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via setGlobalContext()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0763"
},
{
"category": "external",
"summary": "RHBZ#1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/147",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: security manager bypass via setGlobalContext()"
}
]
}
rhsa-2016_2808
Vulnerability from csaf_redhat
Published
2016-11-17 20:32
Modified
2024-11-22 09:43
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7
Notes
Topic
An update is now available for Red Hat JBoss Web Server.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release of Red Hat JBoss Web Server 2.1.2 serves as a replacement for
Red Hat JBoss Web Server 2.1.1. It contains security fixes for the Tomcat 7 component. Only users of the Tomcat 7 component in JBoss Web Server need to apply the fixes delivered in this release.
Security Fix(es):
* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
* A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)
* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Web Server.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat JBoss Web Server 2.1.2 serves as a replacement for\nRed Hat JBoss Web Server 2.1.1. It contains security fixes for the Tomcat 7 component. Only users of the Tomcat 7 component in JBoss Web Server need to apply the fixes delivered in this release.\n\nSecurity Fix(es):\n\n* A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)\n\n* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)\n\n* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)\n\n* A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)\n\n* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)\n\n* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:2808",
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=distributions\u0026version=2.1.2",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=distributions\u0026version=2.1.2"
},
{
"category": "external",
"summary": "1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "1349468",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349468"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2808.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7",
"tracking": {
"current_release_date": "2024-11-22T09:43:53+00:00",
"generator": {
"date": "2024-11-22T09:43:53+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:2808",
"initial_release_date": "2016-11-17T20:32:58+00:00",
"revision_history": [
{
"date": "2016-11-17T20:32:58+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-11-17T22:03:17+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T09:43:53+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 2.1",
"product": {
"name": "Red Hat JBoss Web Server 2.1",
"product_id": "Red Hat JBoss Web Server 2.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-5346",
"discovery_date": "2014-06-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311085"
}
],
"notes": [
{
"category": "description",
"text": "A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Session fixation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5346"
},
{
"category": "external",
"summary": "RHBZ#1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5346",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5346"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/143",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:32:58+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Session fixation"
},
{
"cve": "CVE-2015-5351",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311076"
}
],
"notes": [
{
"category": "description",
"text": "A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: CSRF token leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5351"
},
{
"category": "external",
"summary": "RHBZ#1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5351",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/148",
"url": "http://seclists.org/bugtraq/2016/Feb/148"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:32:58+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: CSRF token leak"
},
{
"cve": "CVE-2016-0706",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311087"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via StatusManagerServlet",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0706"
},
{
"category": "external",
"summary": "RHBZ#1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0706"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/144",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:32:58+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security manager bypass via StatusManagerServlet"
},
{
"cve": "CVE-2016-0714",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311082"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security Manager bypass via persistence mechanisms",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0714"
},
{
"category": "external",
"summary": "RHBZ#1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0714",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0714"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/145",
"url": "http://seclists.org/bugtraq/2016/Feb/145"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:32:58+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Security Manager bypass via persistence mechanisms"
},
{
"cve": "CVE-2016-0763",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311093"
}
],
"notes": [
{
"category": "description",
"text": "A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via setGlobalContext()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0763"
},
{
"category": "external",
"summary": "RHBZ#1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/147",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:32:58+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: security manager bypass via setGlobalContext()"
},
{
"cve": "CVE-2016-3092",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-06-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1349468"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Usage of vulnerable FileUpload package can result in denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-3092"
},
{
"category": "external",
"summary": "RHBZ#1349468",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349468"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-3092",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3092"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3092",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3092"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-7.html",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html",
"url": "http://tomcat.apache.org/security-8.html"
}
],
"release_date": "2016-06-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:32:58+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Usage of vulnerable FileUpload package can result in denial of service"
}
]
}
rhsa-2016_1089
Vulnerability from csaf_redhat
Published
2016-05-17 16:12
Modified
2024-11-22 10:00
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 security update
Notes
Topic
Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6 and 7, Solaris, and Microsoft Windows from the Customer Portal.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.
Security Fix(es):
* Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or in certain cases crash the application. (CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-7942, CVE-2015-8035, CVE-2015-8710, CVE-2015-7941, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317)
* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
* A use-after-free flaw was found in the way OpenSSL imported malformed Elliptic Curve private keys. A specially crafted key file could cause an application using OpenSSL to crash when imported. (CVE-2015-0209)
* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)
Red Hat would like to thank the GNOME project for reporting CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-8241, CVE-2015-8242, and CVE-2015-8317. Upstream acknowledges Kostya Serebryany as the original reporter of CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, and CVE-2015-7500; Hugh Davenport as the original reporter of CVE-2015-8241 and CVE-2015-8242; and Hanno Boeck as the original reporter of CVE-2015-8317.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6 and 7, Solaris, and Microsoft Windows from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.\n\nSecurity Fix(es):\n\n* Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or in certain cases crash the application. (CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-7942, CVE-2015-8035, CVE-2015-8710, CVE-2015-7941, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317)\n\n* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)\n\n* A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)\n\n* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)\n\n* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)\n\n* A use-after-free flaw was found in the way OpenSSL imported malformed Elliptic Curve private keys. A specially crafted key file could cause an application using OpenSSL to crash when imported. (CVE-2015-0209)\n\n* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)\n\n* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)\n\nRed Hat would like to thank the GNOME project for reporting CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-8241, CVE-2015-8242, and CVE-2015-8317. Upstream acknowledges Kostya Serebryany as the original reporter of CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, and CVE-2015-7500; Hugh Davenport as the original reporter of CVE-2015-8241 and CVE-2015-8242; and Hanno Boeck as the original reporter of CVE-2015-8317.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1089",
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=webserver\u0026version=3.0.3",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=webserver\u0026version=3.0.3"
},
{
"category": "external",
"summary": "1196737",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1196737"
},
{
"category": "external",
"summary": "1213957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1213957"
},
{
"category": "external",
"summary": "1274222",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1274222"
},
{
"category": "external",
"summary": "1276297",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276297"
},
{
"category": "external",
"summary": "1276693",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276693"
},
{
"category": "external",
"summary": "1277146",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1277146"
},
{
"category": "external",
"summary": "1281862",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281862"
},
{
"category": "external",
"summary": "1281879",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281879"
},
{
"category": "external",
"summary": "1281925",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281925"
},
{
"category": "external",
"summary": "1281930",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281930"
},
{
"category": "external",
"summary": "1281936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281936"
},
{
"category": "external",
"summary": "1281943",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281943"
},
{
"category": "external",
"summary": "1281950",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281950"
},
{
"category": "external",
"summary": "1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "JWS-271",
"url": "https://issues.redhat.com/browse/JWS-271"
},
{
"category": "external",
"summary": "JWS-272",
"url": "https://issues.redhat.com/browse/JWS-272"
},
{
"category": "external",
"summary": "JWS-276",
"url": "https://issues.redhat.com/browse/JWS-276"
},
{
"category": "external",
"summary": "JWS-277",
"url": "https://issues.redhat.com/browse/JWS-277"
},
{
"category": "external",
"summary": "JWS-303",
"url": "https://issues.redhat.com/browse/JWS-303"
},
{
"category": "external",
"summary": "JWS-304",
"url": "https://issues.redhat.com/browse/JWS-304"
},
{
"category": "external",
"summary": "JWS-349",
"url": "https://issues.redhat.com/browse/JWS-349"
},
{
"category": "external",
"summary": "JWS-350",
"url": "https://issues.redhat.com/browse/JWS-350"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1089.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 security update",
"tracking": {
"current_release_date": "2024-11-22T10:00:11+00:00",
"generator": {
"date": "2024-11-22T10:00:11+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1089",
"initial_release_date": "2016-05-17T16:12:21+00:00",
"revision_history": [
{
"date": "2016-05-17T16:12:21+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-05-17T16:12:21+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T10:00:11+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 3.0",
"product": {
"name": "Red Hat JBoss Web Server 3.0",
"product_id": "Red Hat JBoss Web Server 3.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-0209",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2015-02-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1196737"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free flaw was found in the way OpenSSL imported malformed Elliptic Curve private keys. A specially crafted key file could cause an application using OpenSSL to crash when imported.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: use-after-free on invalid EC private key import",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-0209"
},
{
"category": "external",
"summary": "RHBZ#1196737",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1196737"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-0209",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0209"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0209",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0209"
},
{
"category": "external",
"summary": "https://access.redhat.com/articles/1384453",
"url": "https://access.redhat.com/articles/1384453"
},
{
"category": "external",
"summary": "https://openssl.org/news/secadv_20150319.txt",
"url": "https://openssl.org/news/secadv_20150319.txt"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: use-after-free on invalid EC private key import"
},
{
"cve": "CVE-2015-5312",
"discovery_date": "2015-10-30T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1276693"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: CPU exhaustion when processing specially crafted XML input",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5312"
},
{
"category": "external",
"summary": "RHBZ#1276693",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276693"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5312",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5312"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5312",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5312"
}
],
"release_date": "2015-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: CPU exhaustion when processing specially crafted XML input"
},
{
"cve": "CVE-2015-5345",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311089"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: directory disclosure",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5345"
},
{
"category": "external",
"summary": "RHBZ#1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5345",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5345"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/146",
"url": "http://seclists.org/bugtraq/2016/Feb/146"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: directory disclosure"
},
{
"cve": "CVE-2015-5346",
"discovery_date": "2014-06-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311085"
}
],
"notes": [
{
"category": "description",
"text": "A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Session fixation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5346"
},
{
"category": "external",
"summary": "RHBZ#1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5346",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5346"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/143",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Session fixation"
},
{
"cve": "CVE-2015-5351",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311076"
}
],
"notes": [
{
"category": "description",
"text": "A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: CSRF token leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5351"
},
{
"category": "external",
"summary": "RHBZ#1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5351",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/148",
"url": "http://seclists.org/bugtraq/2016/Feb/148"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: CSRF token leak"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Kostya Serebryany"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-7497",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281862"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Heap-based buffer overflow in xmlDictComputeFastQKey",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-7497"
},
{
"category": "external",
"summary": "RHBZ#1281862",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281862"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-7497",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7497"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7497",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7497"
}
],
"release_date": "2015-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: Heap-based buffer overflow in xmlDictComputeFastQKey"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Kostya Serebryany"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-7498",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281879"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Heap-based buffer overflow in xmlParseXmlDecl",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-7498"
},
{
"category": "external",
"summary": "RHBZ#1281879",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281879"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-7498",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7498"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7498",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7498"
}
],
"release_date": "2015-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: Heap-based buffer overflow in xmlParseXmlDecl"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Kostya Serebryany"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-7499",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281925"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Heap-based buffer overflow in xmlGROW",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-7499"
},
{
"category": "external",
"summary": "RHBZ#1281925",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281925"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-7499",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7499"
}
],
"release_date": "2015-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: Heap-based buffer overflow in xmlGROW"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Kostya Serebryany"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-7500",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281943"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Heap buffer overflow in xmlParseMisc",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-7500"
},
{
"category": "external",
"summary": "RHBZ#1281943",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281943"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-7500",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7500"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7500",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7500"
}
],
"release_date": "2015-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: Heap buffer overflow in xmlParseMisc"
},
{
"cve": "CVE-2015-7941",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2015-10-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1274222"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Out-of-bounds memory access",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-7941"
},
{
"category": "external",
"summary": "RHBZ#1274222",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1274222"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-7941",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7941"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7941",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7941"
}
],
"release_date": "2015-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Out-of-bounds memory access"
},
{
"cve": "CVE-2015-7942",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-10-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1276297"
}
],
"notes": [
{
"category": "description",
"text": "A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: heap-based buffer overflow in xmlParseConditionalSections()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-7942"
},
{
"category": "external",
"summary": "RHBZ#1276297",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276297"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-7942",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7942"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7942",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7942"
}
],
"release_date": "2015-10-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: heap-based buffer overflow in xmlParseConditionalSections()"
},
{
"cve": "CVE-2015-8035",
"cwe": {
"id": "CWE-252",
"name": "Unchecked Return Value"
},
"discovery_date": "2015-11-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1277146"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: DoS caused by incorrect error detection during XZ decompression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect the versions of libxml2 as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for LZMA compression support.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8035"
},
{
"category": "external",
"summary": "RHBZ#1277146",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1277146"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8035",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8035"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8035",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8035"
}
],
"release_date": "2015-11-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: DoS caused by incorrect error detection during XZ decompression"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Hugh Davenport"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8241",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281936"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Buffer overread with XML parser in xmlNextChar",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8241"
},
{
"category": "external",
"summary": "RHBZ#1281936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281936"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8241",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8241"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8241",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8241"
}
],
"release_date": "2015-10-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Buffer overread with XML parser in xmlNextChar"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Hugh Davenport"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8242",
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281950"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8242"
},
{
"category": "external",
"summary": "RHBZ#1281950",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281950"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8242",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8242"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8242",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8242"
}
],
"release_date": "2015-10-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Hanno Boeck"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8317",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281930"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Out-of-bounds heap read when parsing file with unfinished xml declaration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8317"
},
{
"category": "external",
"summary": "RHBZ#1281930",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281930"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8317",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8317"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8317",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8317"
}
],
"release_date": "2015-06-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Out-of-bounds heap read when parsing file with unfinished xml declaration"
},
{
"cve": "CVE-2015-8710",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2015-04-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1213957"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that libxml2 could access out-of-bounds memory when parsing unclosed HTML comments. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, could cause the application to disclose heap memory contents.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: out-of-bounds memory access when parsing an unclosed HTML comment",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8710"
},
{
"category": "external",
"summary": "RHBZ#1213957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1213957"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8710",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8710"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8710",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8710"
}
],
"release_date": "2015-04-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: out-of-bounds memory access when parsing an unclosed HTML comment"
},
{
"cve": "CVE-2016-0706",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311087"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via StatusManagerServlet",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0706"
},
{
"category": "external",
"summary": "RHBZ#1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0706"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/144",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security manager bypass via StatusManagerServlet"
},
{
"cve": "CVE-2016-0714",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311082"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security Manager bypass via persistence mechanisms",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0714"
},
{
"category": "external",
"summary": "RHBZ#1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0714",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0714"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/145",
"url": "http://seclists.org/bugtraq/2016/Feb/145"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Security Manager bypass via persistence mechanisms"
},
{
"cve": "CVE-2016-0763",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311093"
}
],
"notes": [
{
"category": "description",
"text": "A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via setGlobalContext()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0763"
},
{
"category": "external",
"summary": "RHBZ#1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/147",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: security manager bypass via setGlobalContext()"
}
]
}
rhsa-2016_1087
Vulnerability from csaf_redhat
Published
2016-05-17 16:31
Modified
2024-11-22 09:43
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update
Notes
Topic
Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.
Security Fix(es):
* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.\n\nSecurity Fix(es):\n\n* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)\n\n* A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)\n\n* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)\n\n* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763) \n\n* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)\n\n* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1087",
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html"
},
{
"category": "external",
"summary": "1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "JWS-271",
"url": "https://issues.redhat.com/browse/JWS-271"
},
{
"category": "external",
"summary": "JWS-272",
"url": "https://issues.redhat.com/browse/JWS-272"
},
{
"category": "external",
"summary": "JWS-276",
"url": "https://issues.redhat.com/browse/JWS-276"
},
{
"category": "external",
"summary": "JWS-277",
"url": "https://issues.redhat.com/browse/JWS-277"
},
{
"category": "external",
"summary": "JWS-303",
"url": "https://issues.redhat.com/browse/JWS-303"
},
{
"category": "external",
"summary": "JWS-304",
"url": "https://issues.redhat.com/browse/JWS-304"
},
{
"category": "external",
"summary": "JWS-309",
"url": "https://issues.redhat.com/browse/JWS-309"
},
{
"category": "external",
"summary": "JWS-349",
"url": "https://issues.redhat.com/browse/JWS-349"
},
{
"category": "external",
"summary": "JWS-350",
"url": "https://issues.redhat.com/browse/JWS-350"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1087.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update",
"tracking": {
"current_release_date": "2024-11-22T09:43:34+00:00",
"generator": {
"date": "2024-11-22T09:43:34+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1087",
"initial_release_date": "2016-05-17T16:31:38+00:00",
"revision_history": [
{
"date": "2016-05-17T16:31:38+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-05-17T16:31:38+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T09:43:34+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 3.0 for RHEL 6",
"product": {
"name": "Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.0::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"product_id": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-debuginfo@2.4.6-61.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"product_id": "httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-devel@2.4.6-61.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"product_id": "mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap24@2.4.6-61.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"product_id": "mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session24@2.4.6-61.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"product_id": "httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-tools@2.4.6-61.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd24-0:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "httpd24-0:2.4.6-61.ep7.el6.x86_64",
"product_id": "httpd24-0:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24@2.4.6-61.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"product_id": "mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy24_html@2.4.6-61.ep7.el6?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"product_id": "mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl24@2.4.6-61.ep7.el6?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"product": {
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"product_id": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3-debuginfo@2.8.0-7.GA.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"product": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"product_id": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3@2.8.0-7.GA.ep7.el6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"product": {
"name": "httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"product_id": "httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-tools@2.4.6-61.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"product": {
"name": "mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"product_id": "mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap24@2.4.6-61.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"product": {
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"product_id": "mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy24_html@2.4.6-61.ep7.el6?arch=i686\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"product": {
"name": "httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"product_id": "httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-devel@2.4.6-61.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "mod_session24-0:2.4.6-61.ep7.el6.i686",
"product": {
"name": "mod_session24-0:2.4.6-61.ep7.el6.i686",
"product_id": "mod_session24-0:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session24@2.4.6-61.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "httpd24-0:2.4.6-61.ep7.el6.i686",
"product": {
"name": "httpd24-0:2.4.6-61.ep7.el6.i686",
"product_id": "httpd24-0:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24@2.4.6-61.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"product": {
"name": "mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"product_id": "mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl24@2.4.6-61.ep7.el6?arch=i686\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"product": {
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"product_id": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-debuginfo@2.4.6-61.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"product": {
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"product_id": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3-debuginfo@2.8.0-7.GA.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"product": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"product_id": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3@2.8.0-7.GA.ep7.el6?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-0:2.4.6-61.ep7.el6.src",
"product": {
"name": "httpd24-0:2.4.6-61.ep7.el6.src",
"product_id": "httpd24-0:2.4.6-61.ep7.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24@2.4.6-61.ep7.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"product": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"product_id": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3@2.8.0-7.GA.ep7.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"product": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"product_id": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.59-50_patch_01.ep7.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"product": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"product_id": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8@8.0.18-61_patch_01.ep7.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"product": {
"name": "httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"product_id": "httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-manual@2.4.6-61.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-log4j@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-jsp-2.3-api@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-javadoc@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-lib@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-docs-webapp@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-el-2.2-api@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-webapps@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-admin-webapps@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-servlet-3.1-api@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686"
},
"product_reference": "httpd24-0:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-0:2.4.6-61.ep7.el6.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src"
},
"product_reference": "httpd24-0:2.4.6-61.ep7.el6.src",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "httpd24-0:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686"
},
"product_reference": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-devel-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686"
},
"product_reference": "httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-devel-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-manual-0:2.4.6-61.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch"
},
"product_reference": "httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-tools-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686"
},
"product_reference": "httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-tools-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap24-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686"
},
"product_reference": "mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap24-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686"
},
"product_reference": "mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686"
},
"product_reference": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src"
},
"product_reference": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64"
},
"product_reference": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686"
},
"product_reference": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64"
},
"product_reference": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session24-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686"
},
"product_reference": "mod_session24-0:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session24-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl24-1:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686"
},
"product_reference": "mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl24-1:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src"
},
"product_reference": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src"
},
"product_reference": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-5345",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311089"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: directory disclosure",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5345"
},
{
"category": "external",
"summary": "RHBZ#1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5345",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5345"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/146",
"url": "http://seclists.org/bugtraq/2016/Feb/146"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:31:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: directory disclosure"
},
{
"cve": "CVE-2015-5346",
"discovery_date": "2014-06-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311085"
}
],
"notes": [
{
"category": "description",
"text": "A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Session fixation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5346"
},
{
"category": "external",
"summary": "RHBZ#1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5346",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5346"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/143",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:31:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Session fixation"
},
{
"cve": "CVE-2015-5351",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311076"
}
],
"notes": [
{
"category": "description",
"text": "A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: CSRF token leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5351"
},
{
"category": "external",
"summary": "RHBZ#1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5351",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/148",
"url": "http://seclists.org/bugtraq/2016/Feb/148"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:31:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: CSRF token leak"
},
{
"cve": "CVE-2016-0706",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311087"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via StatusManagerServlet",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0706"
},
{
"category": "external",
"summary": "RHBZ#1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0706"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/144",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:31:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security manager bypass via StatusManagerServlet"
},
{
"cve": "CVE-2016-0714",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311082"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security Manager bypass via persistence mechanisms",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0714"
},
{
"category": "external",
"summary": "RHBZ#1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0714",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0714"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/145",
"url": "http://seclists.org/bugtraq/2016/Feb/145"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:31:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Security Manager bypass via persistence mechanisms"
},
{
"cve": "CVE-2016-0763",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311093"
}
],
"notes": [
{
"category": "description",
"text": "A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via setGlobalContext()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0763"
},
{
"category": "external",
"summary": "RHBZ#1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/147",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:31:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: security manager bypass via setGlobalContext()"
}
]
}
ghsa-jrcp-c39h-r29x
Vulnerability from github
Published
2022-05-14 03:13
Modified
2024-02-22 18:33
Severity ?
Summary
Improper Neutralization of Input During Web Page Generation in Apache Tomcat
Details
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0.M1"
},
{
"fixed": "9.0.0.M2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"9.0.0.M1"
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.0.30"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0.RC1"
},
{
"fixed": "8.0.31"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.0.65"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.66"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-5346"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-06T20:12:06Z",
"nvd_published_at": "2016-02-25T01:59:00Z",
"severity": "HIGH"
},
"details": "Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.",
"id": "GHSA-jrcp-c39h-r29x",
"modified": "2024-02-22T18:33:36Z",
"published": "2022-05-14T03:13:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/04164c1f01b973e548d95511d417f414ca723cb8"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/6287be37d8d06c320215c45f7e2b8380411692e0"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/83679b99cd40caa401d173c8f8e72fc98eb5d5be"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat80/commit/41fbee7ba15435a831f765597ff907c56ebf2169"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat80/commit/c39b7ffc2145644f7f3cf9e3cd4aada5048e56a0"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160912063818/http://www.securityfocus.com/bid/83323"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160321234551/http://www.securitytracker.com/id/1035069"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20180531-0001"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://bz.apache.org/bugzilla/show_bug.cgi?id=58809"
},
{
"type": "WEB",
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/135890/Apache-Tomcat-Session-Fixation.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2046.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"type": "WEB",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713184"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713185"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1713187"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723414"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1723506"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-8.html"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-9.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3024-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Neutralization of Input During Web Page Generation in Apache Tomcat"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.