Action not permitted
Modal body text goes here.
cve-2016-0706
Vulnerability from cvelistv5
Published
2016-02-25 01:00
Modified
2024-08-05 22:30
Severity ?
EPSS score ?
Summary
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T22:30:03.533Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722800"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"name": "GLSA-201705-09",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"name": "openSUSE-SU-2016:0865",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-9.html"
},
{
"name": "USN-3024-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-3024-1"
},
{
"name": "SUSE-SU-2016:0769",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"name": "RHSA-2016:2045",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2045.html"
},
{
"name": "DSA-3530",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "HPSBUX03561",
"tags": [
"vendor-advisory",
"x_refsource_HP",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=145974991225029\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722802"
},
{
"name": "RHSA-2016:1089",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "RHSA-2016:1087",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"name": "1035069",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1035069"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"name": "RHSA-2016:2807",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"name": "RHSA-2016:1088",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20180531-0001/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://tomcat.apache.org/security-6.html"
},
{
"name": "RHSA-2016:2808",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"name": "SUSE-SU-2016:0822",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"name": "83324",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/83324"
},
{
"name": "RHSA-2016:2599",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2599.html"
},
{
"name": "DSA-3609",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"name": "SUSE-SU-2016:0839",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html"
},
{
"name": "20160222 [SECURITY] CVE-2016-0706 Apache Tomcat Security Manager bypass",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/bugtraq/2016/Feb/144"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722799"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"name": "DSA-3552",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722801"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-02-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-13T16:09:43",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722800"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"name": "GLSA-201705-09",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"name": "openSUSE-SU-2016:0865",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-9.html"
},
{
"name": "USN-3024-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-3024-1"
},
{
"name": "SUSE-SU-2016:0769",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"name": "RHSA-2016:2045",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2045.html"
},
{
"name": "DSA-3530",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "HPSBUX03561",
"tags": [
"vendor-advisory",
"x_refsource_HP"
],
"url": "http://marc.info/?l=bugtraq\u0026m=145974991225029\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722802"
},
{
"name": "RHSA-2016:1089",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "RHSA-2016:1087",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"name": "1035069",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1035069"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"name": "RHSA-2016:2807",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"name": "RHSA-2016:1088",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20180531-0001/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://tomcat.apache.org/security-6.html"
},
{
"name": "RHSA-2016:2808",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"name": "SUSE-SU-2016:0822",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"name": "83324",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/83324"
},
{
"name": "RHSA-2016:2599",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2599.html"
},
{
"name": "DSA-3609",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"name": "SUSE-SU-2016:0839",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html"
},
{
"name": "20160222 [SECURITY] CVE-2016-0706 Apache Tomcat Security Manager bypass",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/bugtraq/2016/Feb/144"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722799"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"name": "DSA-3552",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722801"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-0706",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964",
"refsource": "CONFIRM",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722800",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722800"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"name": "GLSA-201705-09",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"name": "openSUSE-SU-2016:0865",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"name": "http://tomcat.apache.org/security-9.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-9.html"
},
{
"name": "USN-3024-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3024-1"
},
{
"name": "SUSE-SU-2016:0769",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"name": "RHSA-2016:2045",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2045.html"
},
{
"name": "DSA-3530",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "http://tomcat.apache.org/security-7.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "HPSBUX03561",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=145974991225029\u0026w=2"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722802",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722802"
},
{
"name": "RHSA-2016:1089",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"name": "http://tomcat.apache.org/security-8.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "RHSA-2016:1087",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"name": "1035069",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1035069"
},
{
"name": "https://bto.bluecoat.com/security-advisory/sa118",
"refsource": "CONFIRM",
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442",
"refsource": "CONFIRM",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"name": "RHSA-2016:2807",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"name": "RHSA-2016:1088",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"name": "https://security.netapp.com/advisory/ntap-20180531-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20180531-0001/"
},
{
"name": "http://tomcat.apache.org/security-6.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-6.html"
},
{
"name": "RHSA-2016:2808",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"name": "SUSE-SU-2016:0822",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"name": "83324",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/83324"
},
{
"name": "RHSA-2016:2599",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2599.html"
},
{
"name": "DSA-3609",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"name": "SUSE-SU-2016:0839",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html"
},
{
"name": "20160222 [SECURITY] CVE-2016-0706 Apache Tomcat Security Manager bypass",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722799",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722799"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626",
"refsource": "CONFIRM",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"name": "DSA-3552",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722801",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722801"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2016-0706",
"datePublished": "2016-02-25T01:00:00",
"dateReserved": "2015-12-16T00:00:00",
"dateUpdated": "2024-08-05T22:30:03.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2016-0706\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2016-02-25T01:59:04.340\",\"lastModified\":\"2023-12-08T16:41:18.860\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.\"},{\"lang\":\"es\",\"value\":\"Apache Tomcat 6.x en versiones anteriores a 6.0.45, 7.x en versiones anteriores a 7.0.68, 8.x en versiones anteriores a 8.0.31 y 9.x en versiones anteriores a 9.0.0.M2 no sit\u00faa org.apache.catalina.manager.StatusManagerServlet en la lista org/apache/catalina/core/RestrictedServlets.properties, lo que permite a usuarios remotos autenticados eludir las restricciones de SecurityManager previstas y leer peticiones HTTP arbitrarias, y consecuentemente descubrir valores de ID de sesi\u00f3n, a trav\u00e9s de una aplicaci\u00f3n web manipulada.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B5A6F2F3-4894-4392-8296-3B8DD2679084\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E88A537F-F4D0-46B9-9E37-965233C2A355\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F59A04-14CF-49E2-9973-645477EA09DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49E3C039-A949-4F1B-892A-57147EECB249\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"0A354C34-A3FE-4B8A-9985-8874A0634BC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F28C7801-41B9-4552-BA1E-577967BCBBEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"CFE300CC-FD4A-444E-8506-E5E269D0A0A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25B21085-7259-4685-9D1F-FF98E6489E10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"F50A3EC9-516E-48A7-839B-A73F491B5B9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C28F09D-5CAA-4CA7-A2B5-3B2820F5F409\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A81B035-8598-4D2C-B45F-C6C9D4B10C2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:*\",\"matchCriteriaId\":\"FAC2FC75-97D2-4EA1-A1A0-F592A6D7C1F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"351E5BCF-A56B-4D91-BA3C-21A4B77D529A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2DC2BBB4-171E-4EFF-A575-A5B7FF031755\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE81AD36-ACD1-4C6C-8E7C-5326D1DA3045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D903956B-14F5-4177-AF12-0A5F1846D3C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF3EBD00-1E1E-452D-AFFB-08A6BD111DDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD8802B2-57E0-4AA6-BC8E-00DE60468569\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F4C9BCF-9C73-4991-B02F-E08C5DA06EBA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2823789C-2CB6-4300-94DB-BDBE83ABA8E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5416C76-46ED-4CB1-A7F8-F24EA16DE7F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31B3593F-CEDF-423C-90F8-F88EED87DC3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE7862B2-E1FA-4E16-92CD-8918AB461D9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9E03BE3-60CC-4415-B993-D0BB00F87A30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BFD64FE7-ABAF-49F3-B8D0-91C37C822F4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48E5E8C3-21AD-4230-B945-AB7DE66307B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4945C8C1-C71B-448B-9075-07C6C92599CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED4730B0-2E09-408B-AFD4-FE00F73700FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8DE8A8A-7643-4292-BCC1-758AE0940207\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E9B54FCD-CF7C-47E2-8513-40419E47AF49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.41:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D87EFB6D-B626-469F-907C-40C771A55833\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.43:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6330B97B-8FC5-4D7E-A960-5D94EDD0C378\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:6.0.44:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A0B2FA4-772E-4B23-8B3F-CC86515E4226\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"33E9607B-4D28-460D-896B-E4B7FA22441E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"81A31CA0-A209-4C49-AA06-C38E165E5B68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AA563BF-A67A-477D-956A-167ABEF885C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.5:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F1B937B-57E0-4E88-9E39-39012A924525\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8980E61E-27BE-4858-82B3-C0E8128AF521\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A9731BAA-4C6C-4259-B786-F577D8A90FA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F74A421-D019-4248-84B8-C70D4D9A8A95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BA27FF9-4C66-4E17-95C0-1CB2DAA6AFC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"305688F2-50A6-41FB-8614-BC589DB9A789\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25966344-15D5-4101-9346-B06BFD2DFFF5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D4F710E-06EA-48F4-AC6A-6F143950F015\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C4936C2-0B2D-4C44-98C3-443090965F5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48453405-2319-4327-9F4C-6F70B49452C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49DD9544-6424-41A6-AEC0-EC19B8A10E71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4670E65-2E11-49A4-B661-57C2F60D411F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31002A23-4788-4BC7-AE11-A3C2AA31716D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7144EDDF-8265-4642-8EEB-ED52527E0A26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF06B5C1-B9DD-4673-A101-56E1E593ACDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D731065-626B-4425-8E49-F708DD457824\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3D850EA-E537-42C8-93B9-96E15CB26747\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E037DA05-2BEF-4F64-B8BB-307247B6A05C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D395D95B-1F4A-420E-A0F6-609360AF7B69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BD221BA-0AB6-4972-8AD9-5D37AC07762F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E55B6565-96CB-4F6A-9A80-C3FB82F30546\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3300AFE-49A4-4904-B9A0-5679F09FA01E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BD93669-1B30-4BF8-AD7D-F60DD8D63CC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8C8C97F-6C9D-4647-AB8A-ADAA5536DDE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C6109D1-BC36-40C5-A02A-7AEBC949BAC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA8A7333-B4C3-4876-AE01-62F2FD315504\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"92993E23-D805-407B-8B87-11CEEE8B212F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AA28D3A-3EE5-4F90-B8F5-4943F7607DA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C947E549-2459-4AFB-84A7-36BDA30B5F29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D55DF79-F9BE-4907-A4D8-96C4B11189ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14AB5787-82D7-4F78-BE93-4556AB7A7D0E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8E9453E-BC9B-4F77-85FA-BA15AC55C245\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7EF0518-73F9-47DB-8946-A8334936BEFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"95AA8778-7833-4572-A71B-5FD89938CE94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"242E47CE-EF69-4F8F-AB40-5AF2811674CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CDA1555C-E55A-4E14-B786-BFEE3F09220B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8075E9A-DA7F-4A0B-8B4D-0CD951369111\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"335A5320-6086-4B45-9903-82F6F92A584F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46B33408-C2E2-4E7C-9334-6AB98F13468C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F036676-9EFB-4A92-828E-A38905D594E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E9728EE8-6029-4DF3-942E-E4ACC09111A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"34E7DAC8-8419-45D1-A28F-14CF2FE1B6EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4752862B-7D26-4285-B8A0-CF082C758353\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*\",\"matchCriteriaId\":\"58EA7199-3373-4F97-9907-3A479A02155E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F963D737-2E95-4D7C-92C7-DACF3F36D1E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BBBC5EA-012C-4C5D-A61B-BAF134B300DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A358FDF-C249-4D7A-9445-8B9E7D9D40AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AFF96F96-34DB-4EB3-BF59-11220673FA26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"701424A2-BB06-44B5-B468-7164E4F95529\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1BA6388C-5B6E-4651-8AE3-EBCCF61C27E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F9A5B7E-33A9-4651-9BE1-371A0064B661\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F99252E8-A59C-48E1-B251-718D7FB3E399\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E0DDEF6-A8EE-46C4-A046-A1F26E7C4E87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14B38892-9C00-4510-B7BA-F2A8F2CACCAE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7409B064-D43E-489E-AEC6-0A767FB21737\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F019268F-80C4-48FE-8164-E9DA0A3BAFF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EFBD214-FCFE-4F04-A903-66EFDA764B9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"425D86B3-6BB9-410D-8125-F7CF87290AD6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EE3BB0D-1002-41E4-9BE8-875D97330057\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6622472B-8644-4D45-A54B-A215C3D64B83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B338F95B-2924-435B-827F-E64420A93244\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"209D1349-7740-4DBE-80A5-E6343C62BAB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"09E77C24-C265-403D-A193-B3739713F6B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.0.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28616FA3-9A98-4AAE-9F94-3E77A14156EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D0689FE-4BC0-4F53-8C79-34B21F9B86C2\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=145974991225029\u0026w=2\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1089.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2045.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2599.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2807.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-2808.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://seclists.org/bugtraq/2016/Feb/144\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1722799\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1722800\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1722801\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"http://svn.apache.org/viewvc?view=revision\u0026revision=1722802\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"http://tomcat.apache.org/security-6.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-7.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-8.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://tomcat.apache.org/security-9.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3530\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3552\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3609\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/bid/83324\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securitytracker.com/id/1035069\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.ubuntu.com/usn/USN-3024-1\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1087\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1088\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bto.bluecoat.com/security-advisory/sa118\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://security.gentoo.org/glsa/201705-09\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20180531-0001/\",\"source\":\"secalert@redhat.com\"}]}}"
}
}
rhsa-2016_1088
Vulnerability from csaf_redhat
Published
2016-05-17 16:30
Modified
2024-11-05 19:20
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update
Notes
Topic
Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.
Security Fix(es):
* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.\n\nSecurity Fix(es):\n\n* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)\n\n* A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)\n\n* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)\n\n* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763) \n\n* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)\n\n* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1088",
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html"
},
{
"category": "external",
"summary": "1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "JWS-271",
"url": "https://issues.redhat.com/browse/JWS-271"
},
{
"category": "external",
"summary": "JWS-272",
"url": "https://issues.redhat.com/browse/JWS-272"
},
{
"category": "external",
"summary": "JWS-276",
"url": "https://issues.redhat.com/browse/JWS-276"
},
{
"category": "external",
"summary": "JWS-277",
"url": "https://issues.redhat.com/browse/JWS-277"
},
{
"category": "external",
"summary": "JWS-303",
"url": "https://issues.redhat.com/browse/JWS-303"
},
{
"category": "external",
"summary": "JWS-304",
"url": "https://issues.redhat.com/browse/JWS-304"
},
{
"category": "external",
"summary": "JWS-310",
"url": "https://issues.redhat.com/browse/JWS-310"
},
{
"category": "external",
"summary": "JWS-349",
"url": "https://issues.redhat.com/browse/JWS-349"
},
{
"category": "external",
"summary": "JWS-350",
"url": "https://issues.redhat.com/browse/JWS-350"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1088.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update",
"tracking": {
"current_release_date": "2024-11-05T19:20:33+00:00",
"generator": {
"date": "2024-11-05T19:20:33+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2016:1088",
"initial_release_date": "2016-05-17T16:30:34+00:00",
"revision_history": [
{
"date": "2016-05-17T16:30:34+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-05-17T16:30:35+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:20:33+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 3.0 for RHEL 7",
"product": {
"name": "Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.0::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-0:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "httpd24-0:2.4.6-61.ep7.el7.x86_64",
"product_id": "httpd24-0:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24@2.4.6-61.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"product_id": "mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy24_html@2.4.6-61.ep7.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"product_id": "httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-devel@2.4.6-61.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"product_id": "mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session24@2.4.6-61.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"product_id": "httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-debuginfo@2.4.6-61.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"product_id": "mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap24@2.4.6-61.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"product_id": "mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl24@2.4.6-61.ep7.el7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"product": {
"name": "httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"product_id": "httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-tools@2.4.6-61.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"product": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"product_id": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3@2.8.0-7.GA.ep7.el7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"product": {
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"product_id": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3-debuginfo@2.8.0-7.GA.ep7.el7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-0:2.4.6-61.ep7.el7.src",
"product": {
"name": "httpd24-0:2.4.6-61.ep7.el7.src",
"product_id": "httpd24-0:2.4.6-61.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24@2.4.6-61.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"product": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"product_id": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3@2.8.0-7.GA.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"product": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"product_id": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.59-50_patch_01.ep7.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"product": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"product_id": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8@8.0.18-61_patch_01.ep7.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"product": {
"name": "httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"product_id": "httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-manual@2.4.6-61.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.59-50_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-servlet-3.1-api@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-el-2.2-api@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-webapps@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-admin-webapps@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-docs-webapp@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-log4j@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-javadoc@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-lib@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-jsp-2.3-api@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_id": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8@8.0.18-61_patch_01.ep7.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-0:2.4.6-61.ep7.el7.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src"
},
"product_reference": "httpd24-0:2.4.6-61.ep7.el7.src",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-0:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "httpd24-0:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-devel-0:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-manual-0:2.4.6-61.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch"
},
"product_reference": "httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-tools-0:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap24-0:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src"
},
"product_reference": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64"
},
"product_reference": "mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64"
},
"product_reference": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session24-0:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl24-1:2.4.6-61.ep7.el7.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64"
},
"product_reference": "mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src"
},
"product_reference": "tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src"
},
"product_reference": "tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 7",
"product_id": "7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
},
"product_reference": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"relates_to_product_reference": "7Server-JWS-3.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-5345",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311089"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: directory disclosure",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5345"
},
{
"category": "external",
"summary": "RHBZ#1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5345",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5345"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/146",
"url": "http://seclists.org/bugtraq/2016/Feb/146"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: directory disclosure"
},
{
"cve": "CVE-2015-5346",
"discovery_date": "2014-06-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311085"
}
],
"notes": [
{
"category": "description",
"text": "A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Session fixation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5346"
},
{
"category": "external",
"summary": "RHBZ#1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5346",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5346"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/143",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Session fixation"
},
{
"cve": "CVE-2015-5351",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311076"
}
],
"notes": [
{
"category": "description",
"text": "A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: CSRF token leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5351"
},
{
"category": "external",
"summary": "RHBZ#1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5351",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/148",
"url": "http://seclists.org/bugtraq/2016/Feb/148"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: CSRF token leak"
},
{
"cve": "CVE-2016-0706",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311087"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via StatusManagerServlet",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0706"
},
{
"category": "external",
"summary": "RHBZ#1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0706"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/144",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security manager bypass via StatusManagerServlet"
},
{
"cve": "CVE-2016-0714",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311082"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security Manager bypass via persistence mechanisms",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0714"
},
{
"category": "external",
"summary": "RHBZ#1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0714",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0714"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/145",
"url": "http://seclists.org/bugtraq/2016/Feb/145"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Security Manager bypass via persistence mechanisms"
},
{
"cve": "CVE-2016-0763",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311093"
}
],
"notes": [
{
"category": "description",
"text": "A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via setGlobalContext()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0763"
},
{
"category": "external",
"summary": "RHBZ#1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/147",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:30:34+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.src",
"7Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el7.noarch",
"7Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.src",
"7Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el7.x86_64",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el7.src",
"7Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el7.noarch",
"7Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: security manager bypass via setGlobalContext()"
}
]
}
rhsa-2016_2807
Vulnerability from csaf_redhat
Published
2016-11-17 20:33
Modified
2024-11-05 19:47
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7
Notes
Topic
An update is now available for Red Hat JBoss Enterprise Web Server 2 for RHEL 6 and Red Hat JBoss Enterprise Web Server 2 for RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
This release of Red Hat JBoss Web Server 2.1.2 serves as a replacement for Red Hat JBoss Web Server 2.1.1. It contains security fixes for the Tomcat 7 component. Only users of the Tomcat 7 component in JBoss Web Server need to apply the fixes delivered in this release.
Security Fix(es):
* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
* A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)
* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Enterprise Web Server 2 for RHEL 6 and Red Hat JBoss Enterprise Web Server 2 for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nThis release of Red Hat JBoss Web Server 2.1.2 serves as a replacement for Red Hat JBoss Web Server 2.1.1. It contains security fixes for the Tomcat 7 component. Only users of the Tomcat 7 component in JBoss Web Server need to apply the fixes delivered in this release.\n\nSecurity Fix(es):\n\n* A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)\n\n* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)\n\n* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)\n\n* A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)\n\n* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)\n\n* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:2807",
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "1349468",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349468"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2807.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7",
"tracking": {
"current_release_date": "2024-11-05T19:47:54+00:00",
"generator": {
"date": "2024-11-05T19:47:54+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2016:2807",
"initial_release_date": "2016-11-17T20:33:11+00:00",
"revision_history": [
{
"date": "2016-11-17T20:33:11+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-11-17T21:53:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:47:54+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product": {
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product": {
"name": "Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product": {
"name": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_id": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-maven-devel@7.0.54-23_patch_05.ep6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-maven-devel@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.54-23_patch_05.ep6.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"product": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"product_id": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.54-23_patch_05.ep6.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"product": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"product_id": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.54-23_patch_05.ep6.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src"
},
"product_reference": "tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server",
"product_id": "6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"relates_to_product_reference": "6Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.src as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src"
},
"product_reference": "tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch as a component of Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server",
"product_id": "7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"relates_to_product_reference": "7Server-JBEWS-2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-5346",
"discovery_date": "2014-06-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311085"
}
],
"notes": [
{
"category": "description",
"text": "A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Session fixation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5346"
},
{
"category": "external",
"summary": "RHBZ#1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5346",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5346"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/143",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:33:11+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Session fixation"
},
{
"cve": "CVE-2015-5351",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311076"
}
],
"notes": [
{
"category": "description",
"text": "A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: CSRF token leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5351"
},
{
"category": "external",
"summary": "RHBZ#1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5351",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/148",
"url": "http://seclists.org/bugtraq/2016/Feb/148"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:33:11+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: CSRF token leak"
},
{
"cve": "CVE-2016-0706",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311087"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via StatusManagerServlet",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0706"
},
{
"category": "external",
"summary": "RHBZ#1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0706"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/144",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:33:11+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security manager bypass via StatusManagerServlet"
},
{
"cve": "CVE-2016-0714",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311082"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security Manager bypass via persistence mechanisms",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0714"
},
{
"category": "external",
"summary": "RHBZ#1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0714",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0714"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/145",
"url": "http://seclists.org/bugtraq/2016/Feb/145"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:33:11+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Security Manager bypass via persistence mechanisms"
},
{
"cve": "CVE-2016-0763",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311093"
}
],
"notes": [
{
"category": "description",
"text": "A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via setGlobalContext()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0763"
},
{
"category": "external",
"summary": "RHBZ#1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/147",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:33:11+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: security manager bypass via setGlobalContext()"
},
{
"cve": "CVE-2016-3092",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-06-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1349468"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Usage of vulnerable FileUpload package can result in denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-3092"
},
{
"category": "external",
"summary": "RHBZ#1349468",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349468"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-3092",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3092"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3092",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3092"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-7.html",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html",
"url": "http://tomcat.apache.org/security-8.html"
}
],
"release_date": "2016-06-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:33:11+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2807"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el6.src",
"6Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el6.noarch",
"6Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el6.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-0:7.0.54-23_patch_05.ep6.el7.src",
"7Server-JBEWS-2:tomcat7-admin-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-docs-webapp-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-el-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-javadoc-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-jsp-2.2-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-lib-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-log4j-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-maven-devel-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-servlet-3.0-api-0:7.0.54-23_patch_05.ep6.el7.noarch",
"7Server-JBEWS-2:tomcat7-webapps-0:7.0.54-23_patch_05.ep6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Usage of vulnerable FileUpload package can result in denial of service"
}
]
}
rhsa-2016_2599
Vulnerability from csaf_redhat
Published
2016-11-03 08:12
Modified
2024-11-05 19:45
Summary
Red Hat Security Advisory: tomcat security, bug fix, and enhancement update
Notes
Topic
An update for tomcat is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
The following packages have been upgraded to a newer upstream version: tomcat (7.0.69). (BZ#1287928)
Security Fix(es):
* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
* A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)
* A directory traversal flaw was found in Tomcat's RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a '/..' in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call. (CVE-2015-5174)
* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for tomcat is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nThe following packages have been upgraded to a newer upstream version: tomcat (7.0.69). (BZ#1287928)\n\nSecurity Fix(es):\n\n* A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)\n\n* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)\n\n* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)\n\n* A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)\n\n* A directory traversal flaw was found in Tomcat\u0027s RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a \u0027/..\u0027 in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call. (CVE-2015-5174)\n\n* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)\n\n* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:2599",
"url": "https://access.redhat.com/errata/RHSA-2016:2599"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html"
},
{
"category": "external",
"summary": "1133070",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1133070"
},
{
"category": "external",
"summary": "1201409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1201409"
},
{
"category": "external",
"summary": "1208402",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1208402"
},
{
"category": "external",
"summary": "1221896",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1221896"
},
{
"category": "external",
"summary": "1229476",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1229476"
},
{
"category": "external",
"summary": "1240279",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1240279"
},
{
"category": "external",
"summary": "1265698",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1265698"
},
{
"category": "external",
"summary": "1277197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1277197"
},
{
"category": "external",
"summary": "1287928",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1287928"
},
{
"category": "external",
"summary": "1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "1311622",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311622"
},
{
"category": "external",
"summary": "1320853",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1320853"
},
{
"category": "external",
"summary": "1327326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1327326"
},
{
"category": "external",
"summary": "1347774",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1347774"
},
{
"category": "external",
"summary": "1347860",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1347860"
},
{
"category": "external",
"summary": "1349468",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349468"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2599.json"
}
],
"title": "Red Hat Security Advisory: tomcat security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2024-11-05T19:45:59+00:00",
"generator": {
"date": "2024-11-05T19:45:59+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2016:2599",
"initial_release_date": "2016-11-03T08:12:12+00:00",
"revision_history": [
{
"date": "2016-11-03T08:12:12+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-11-03T08:12:12+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:45:59+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-webapps-0:7.0.69-10.el7.noarch",
"product": {
"name": "tomcat-webapps-0:7.0.69-10.el7.noarch",
"product_id": "tomcat-webapps-0:7.0.69-10.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-webapps@7.0.69-10.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"product": {
"name": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"product_id": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-jsp-2.2-api@7.0.69-10.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-0:7.0.69-10.el7.noarch",
"product": {
"name": "tomcat-0:7.0.69-10.el7.noarch",
"product_id": "tomcat-0:7.0.69-10.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat@7.0.69-10.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"product": {
"name": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"product_id": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-admin-webapps@7.0.69-10.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"product": {
"name": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"product_id": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-servlet-3.0-api@7.0.69-10.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-lib-0:7.0.69-10.el7.noarch",
"product": {
"name": "tomcat-lib-0:7.0.69-10.el7.noarch",
"product_id": "tomcat-lib-0:7.0.69-10.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-lib@7.0.69-10.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"product": {
"name": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"product_id": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-el-2.2-api@7.0.69-10.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-javadoc-0:7.0.69-10.el7.noarch",
"product": {
"name": "tomcat-javadoc-0:7.0.69-10.el7.noarch",
"product_id": "tomcat-javadoc-0:7.0.69-10.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-javadoc@7.0.69-10.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-jsvc-0:7.0.69-10.el7.noarch",
"product": {
"name": "tomcat-jsvc-0:7.0.69-10.el7.noarch",
"product_id": "tomcat-jsvc-0:7.0.69-10.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-jsvc@7.0.69-10.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"product": {
"name": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"product_id": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-docs-webapp@7.0.69-10.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-0:7.0.69-10.el7.src",
"product": {
"name": "tomcat-0:7.0.69-10.el7.src",
"product_id": "tomcat-0:7.0.69-10.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat@7.0.69-10.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional:tomcat-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional:tomcat-0:7.0.69-10.el7.src"
},
"product_reference": "tomcat-0:7.0.69-10.el7.src",
"relates_to_product_reference": "7Client-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-lib-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client:tomcat-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client:tomcat-0:7.0.69-10.el7.src"
},
"product_reference": "tomcat-0:7.0.69-10.el7.src",
"relates_to_product_reference": "7Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client:tomcat-lib-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-lib-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client (v. 7)",
"product_id": "7Client:tomcat-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Client"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src"
},
"product_reference": "tomcat-0:7.0.69-10.el7.src",
"relates_to_product_reference": "7ComputeNode-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-lib-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode:tomcat-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode:tomcat-0:7.0.69-10.el7.src"
},
"product_reference": "tomcat-0:7.0.69-10.el7.src",
"relates_to_product_reference": "7ComputeNode"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-lib-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode (v. 7)",
"product_id": "7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7ComputeNode"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional:tomcat-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional:tomcat-0:7.0.69-10.el7.src"
},
"product_reference": "tomcat-0:7.0.69-10.el7.src",
"relates_to_product_reference": "7Server-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-lib-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)",
"product_id": "7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:tomcat-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:tomcat-0:7.0.69-10.el7.src"
},
"product_reference": "tomcat-0:7.0.69-10.el7.src",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:tomcat-lib-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-lib-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server:tomcat-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Server"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional:tomcat-0:7.0.69-10.el7.src"
},
"product_reference": "tomcat-0:7.0.69-10.el7.src",
"relates_to_product_reference": "7Workstation-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-lib-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)",
"product_id": "7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation-optional"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation:tomcat-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-0:7.0.69-10.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation:tomcat-0:7.0.69-10.el7.src"
},
"product_reference": "tomcat-0:7.0.69-10.el7.src",
"relates_to_product_reference": "7Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-javadoc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-javadoc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsvc-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-jsvc-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-lib-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
},
"product_reference": "tomcat-webapps-0:7.0.69-10.el7.noarch",
"relates_to_product_reference": "7Workstation"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-0230",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2015-02-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1191200"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat would keep connections open after processing requests with a large enough request body. A remote attacker could potentially use this flaw to exhaust the pool of available connections and preventing further, legitimate connections to the Tomcat server to be made.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: non-persistent DoS attack by feeding data by aborting an upload",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0230"
},
{
"category": "external",
"summary": "RHBZ#1191200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1191200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0230",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0230"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44",
"url": "http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55",
"url": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.9",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.9"
}
],
"release_date": "2014-07-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-03T08:12:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2599"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: non-persistent DoS attack by feeding data by aborting an upload"
},
{
"cve": "CVE-2015-5174",
"discovery_date": "2015-08-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1265698"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in Tomcat\u0027s RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a \u0027/..\u0027 in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: URL Normalization issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5174"
},
{
"category": "external",
"summary": "RHBZ#1265698",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1265698"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5174",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5174"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5174",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5174"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/149",
"url": "http://seclists.org/bugtraq/2016/Feb/149"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-03T08:12:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2599"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: URL Normalization issue"
},
{
"cve": "CVE-2015-5345",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311089"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: directory disclosure",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5345"
},
{
"category": "external",
"summary": "RHBZ#1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5345",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5345"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/146",
"url": "http://seclists.org/bugtraq/2016/Feb/146"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-03T08:12:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2599"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: directory disclosure"
},
{
"cve": "CVE-2015-5351",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311076"
}
],
"notes": [
{
"category": "description",
"text": "A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: CSRF token leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5351"
},
{
"category": "external",
"summary": "RHBZ#1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5351",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/148",
"url": "http://seclists.org/bugtraq/2016/Feb/148"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-03T08:12:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2599"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: CSRF token leak"
},
{
"cve": "CVE-2016-0706",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311087"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via StatusManagerServlet",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0706"
},
{
"category": "external",
"summary": "RHBZ#1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0706"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/144",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-03T08:12:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2599"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security manager bypass via StatusManagerServlet"
},
{
"cve": "CVE-2016-0714",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311082"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security Manager bypass via persistence mechanisms",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0714"
},
{
"category": "external",
"summary": "RHBZ#1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0714",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0714"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/145",
"url": "http://seclists.org/bugtraq/2016/Feb/145"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-03T08:12:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2599"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Security Manager bypass via persistence mechanisms"
},
{
"cve": "CVE-2016-0763",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311093"
}
],
"notes": [
{
"category": "description",
"text": "A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via setGlobalContext()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0763"
},
{
"category": "external",
"summary": "RHBZ#1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/147",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-03T08:12:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2599"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: security manager bypass via setGlobalContext()"
},
{
"cve": "CVE-2016-3092",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-06-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1349468"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Usage of vulnerable FileUpload package can result in denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-3092"
},
{
"category": "external",
"summary": "RHBZ#1349468",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349468"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-3092",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3092"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3092",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3092"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-7.html",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html",
"url": "http://tomcat.apache.org/security-8.html"
}
],
"release_date": "2016-06-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-03T08:12:12+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2599"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"7Client-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-0:7.0.69-10.el7.src",
"7Client-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.noarch",
"7Client:tomcat-0:7.0.69-10.el7.src",
"7Client:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Client:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Client:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Client:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Client:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Client:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-0:7.0.69-10.el7.src",
"7ComputeNode:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-lib-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7ComputeNode:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-0:7.0.69-10.el7.src",
"7Server-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.noarch",
"7Server:tomcat-0:7.0.69-10.el7.src",
"7Server:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Server:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Server:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Server:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Server:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Server:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-0:7.0.69-10.el7.src",
"7Workstation-optional:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation-optional:tomcat-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-0:7.0.69-10.el7.src",
"7Workstation:tomcat-admin-webapps-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-docs-webapp-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-el-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-javadoc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsp-2.2-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-jsvc-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-lib-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-servlet-3.0-api-0:7.0.69-10.el7.noarch",
"7Workstation:tomcat-webapps-0:7.0.69-10.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Usage of vulnerable FileUpload package can result in denial of service"
}
]
}
rhsa-2016_1087
Vulnerability from csaf_redhat
Published
2016-05-17 16:31
Modified
2024-11-05 19:20
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update
Notes
Topic
Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.
Security Fix(es):
* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.\n\nSecurity Fix(es):\n\n* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)\n\n* A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)\n\n* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)\n\n* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763) \n\n* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)\n\n* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1087",
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html"
},
{
"category": "external",
"summary": "1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "JWS-271",
"url": "https://issues.redhat.com/browse/JWS-271"
},
{
"category": "external",
"summary": "JWS-272",
"url": "https://issues.redhat.com/browse/JWS-272"
},
{
"category": "external",
"summary": "JWS-276",
"url": "https://issues.redhat.com/browse/JWS-276"
},
{
"category": "external",
"summary": "JWS-277",
"url": "https://issues.redhat.com/browse/JWS-277"
},
{
"category": "external",
"summary": "JWS-303",
"url": "https://issues.redhat.com/browse/JWS-303"
},
{
"category": "external",
"summary": "JWS-304",
"url": "https://issues.redhat.com/browse/JWS-304"
},
{
"category": "external",
"summary": "JWS-309",
"url": "https://issues.redhat.com/browse/JWS-309"
},
{
"category": "external",
"summary": "JWS-349",
"url": "https://issues.redhat.com/browse/JWS-349"
},
{
"category": "external",
"summary": "JWS-350",
"url": "https://issues.redhat.com/browse/JWS-350"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1087.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update",
"tracking": {
"current_release_date": "2024-11-05T19:20:27+00:00",
"generator": {
"date": "2024-11-05T19:20:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2016:1087",
"initial_release_date": "2016-05-17T16:31:38+00:00",
"revision_history": [
{
"date": "2016-05-17T16:31:38+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-05-17T16:31:38+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:20:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 3.0 for RHEL 6",
"product": {
"name": "Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.0::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"product_id": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-debuginfo@2.4.6-61.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"product_id": "httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-devel@2.4.6-61.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"product_id": "mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap24@2.4.6-61.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"product_id": "mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session24@2.4.6-61.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"product_id": "httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-tools@2.4.6-61.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "httpd24-0:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "httpd24-0:2.4.6-61.ep7.el6.x86_64",
"product_id": "httpd24-0:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24@2.4.6-61.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"product_id": "mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy24_html@2.4.6-61.ep7.el6?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"product": {
"name": "mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"product_id": "mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl24@2.4.6-61.ep7.el6?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"product": {
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"product_id": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3-debuginfo@2.8.0-7.GA.ep7.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"product": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"product_id": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3@2.8.0-7.GA.ep7.el6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"product": {
"name": "httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"product_id": "httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-tools@2.4.6-61.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"product": {
"name": "mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"product_id": "mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ldap24@2.4.6-61.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"product": {
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"product_id": "mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_proxy24_html@2.4.6-61.ep7.el6?arch=i686\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"product": {
"name": "httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"product_id": "httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-devel@2.4.6-61.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "mod_session24-0:2.4.6-61.ep7.el6.i686",
"product": {
"name": "mod_session24-0:2.4.6-61.ep7.el6.i686",
"product_id": "mod_session24-0:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_session24@2.4.6-61.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "httpd24-0:2.4.6-61.ep7.el6.i686",
"product": {
"name": "httpd24-0:2.4.6-61.ep7.el6.i686",
"product_id": "httpd24-0:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24@2.4.6-61.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"product": {
"name": "mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"product_id": "mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_ssl24@2.4.6-61.ep7.el6?arch=i686\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"product": {
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"product_id": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-debuginfo@2.4.6-61.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"product": {
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"product_id": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3-debuginfo@2.8.0-7.GA.ep7.el6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"product": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"product_id": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3@2.8.0-7.GA.ep7.el6?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-0:2.4.6-61.ep7.el6.src",
"product": {
"name": "httpd24-0:2.4.6-61.ep7.el6.src",
"product_id": "httpd24-0:2.4.6-61.ep7.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24@2.4.6-61.ep7.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"product": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"product_id": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mod_security-jws3@2.8.0-7.GA.ep7.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"product": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"product_id": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.59-50_patch_01.ep7.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"product": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"product_id": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8@8.0.18-61_patch_01.ep7.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"product": {
"name": "httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"product_id": "httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/httpd24-manual@2.4.6-61.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-webapps@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-jsp-2.2-api@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-lib@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-log4j@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-javadoc@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-admin-webapps@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-docs-webapp@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-servlet-3.0-api@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_id": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat7-el-2.2-api@7.0.59-50_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-log4j@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-jsp-2.3-api@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-javadoc@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-lib@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-docs-webapp@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-el-2.2-api@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-webapps@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-admin-webapps@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8-servlet-3.1-api@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_id": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat8@8.0.18-61_patch_01.ep7.el6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686"
},
"product_reference": "httpd24-0:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-0:2.4.6-61.ep7.el6.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src"
},
"product_reference": "httpd24-0:2.4.6-61.ep7.el6.src",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "httpd24-0:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686"
},
"product_reference": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-devel-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686"
},
"product_reference": "httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-devel-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-manual-0:2.4.6-61.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch"
},
"product_reference": "httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-tools-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686"
},
"product_reference": "httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd24-tools-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap24-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686"
},
"product_reference": "mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap24-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686"
},
"product_reference": "mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686"
},
"product_reference": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src"
},
"product_reference": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64"
},
"product_reference": "mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686"
},
"product_reference": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64"
},
"product_reference": "mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session24-0:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686"
},
"product_reference": "mod_session24-0:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session24-0:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl24-1:2.4.6-61.ep7.el6.i686 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686"
},
"product_reference": "mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl24-1:2.4.6-61.ep7.el6.x86_64 as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64"
},
"product_reference": "mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src"
},
"product_reference": "tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.src as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src"
},
"product_reference": "tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch as a component of Red Hat JBoss Web Server 3.0 for RHEL 6",
"product_id": "6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
},
"product_reference": "tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"relates_to_product_reference": "6Server-JWS-3.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-5345",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311089"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: directory disclosure",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5345"
},
{
"category": "external",
"summary": "RHBZ#1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5345",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5345"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/146",
"url": "http://seclists.org/bugtraq/2016/Feb/146"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:31:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: directory disclosure"
},
{
"cve": "CVE-2015-5346",
"discovery_date": "2014-06-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311085"
}
],
"notes": [
{
"category": "description",
"text": "A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Session fixation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5346"
},
{
"category": "external",
"summary": "RHBZ#1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5346",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5346"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/143",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:31:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Session fixation"
},
{
"cve": "CVE-2015-5351",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311076"
}
],
"notes": [
{
"category": "description",
"text": "A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: CSRF token leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5351"
},
{
"category": "external",
"summary": "RHBZ#1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5351",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/148",
"url": "http://seclists.org/bugtraq/2016/Feb/148"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:31:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: CSRF token leak"
},
{
"cve": "CVE-2016-0706",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311087"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via StatusManagerServlet",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0706"
},
{
"category": "external",
"summary": "RHBZ#1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0706"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/144",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:31:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security manager bypass via StatusManagerServlet"
},
{
"cve": "CVE-2016-0714",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311082"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security Manager bypass via persistence mechanisms",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0714"
},
{
"category": "external",
"summary": "RHBZ#1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0714",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0714"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/145",
"url": "http://seclists.org/bugtraq/2016/Feb/145"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:31:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Security Manager bypass via persistence mechanisms"
},
{
"cve": "CVE-2016-0763",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311093"
}
],
"notes": [
{
"category": "description",
"text": "A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via setGlobalContext()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0763"
},
{
"category": "external",
"summary": "RHBZ#1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/147",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:31:38+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.src",
"6Server-JWS-3.0:httpd24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-debuginfo-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-devel-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:httpd24-manual-0:2.4.6-61.ep7.el6.noarch",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:httpd24-tools-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ldap24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_proxy24_html-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.src",
"6Server-JWS-3.0:mod_security-jws3-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.i686",
"6Server-JWS-3.0:mod_security-jws3-debuginfo-0:2.8.0-7.GA.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_session24-0:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.i686",
"6Server-JWS-3.0:mod_ssl24-1:2.4.6-61.ep7.el6.x86_64",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-0:7.0.59-50_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat7-admin-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-docs-webapp-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-el-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-javadoc-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-jsp-2.2-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-lib-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-log4j-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-servlet-3.0-api-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat7-webapps-0:7.0.59-50_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-0:8.0.18-61_patch_01.ep7.el6.src",
"6Server-JWS-3.0:tomcat8-admin-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-docs-webapp-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-el-2.2-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-javadoc-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-jsp-2.3-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-lib-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-log4j-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-servlet-3.1-api-0:8.0.18-61_patch_01.ep7.el6.noarch",
"6Server-JWS-3.0:tomcat8-webapps-0:8.0.18-61_patch_01.ep7.el6.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: security manager bypass via setGlobalContext()"
}
]
}
rhsa-2016_2808
Vulnerability from csaf_redhat
Published
2016-11-17 20:32
Modified
2024-11-05 19:47
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7
Notes
Topic
An update is now available for Red Hat JBoss Web Server.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release of Red Hat JBoss Web Server 2.1.2 serves as a replacement for
Red Hat JBoss Web Server 2.1.1. It contains security fixes for the Tomcat 7 component. Only users of the Tomcat 7 component in JBoss Web Server need to apply the fixes delivered in this release.
Security Fix(es):
* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
* A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)
* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat JBoss Web Server.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat JBoss Web Server 2.1.2 serves as a replacement for\nRed Hat JBoss Web Server 2.1.1. It contains security fixes for the Tomcat 7 component. Only users of the Tomcat 7 component in JBoss Web Server need to apply the fixes delivered in this release.\n\nSecurity Fix(es):\n\n* A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)\n\n* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)\n\n* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)\n\n* A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)\n\n* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)\n\n* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:2808",
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=distributions\u0026version=2.1.2",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=distributions\u0026version=2.1.2"
},
{
"category": "external",
"summary": "1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "1349468",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349468"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2808.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7",
"tracking": {
"current_release_date": "2024-11-05T19:47:59+00:00",
"generator": {
"date": "2024-11-05T19:47:59+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2016:2808",
"initial_release_date": "2016-11-17T20:32:58+00:00",
"revision_history": [
{
"date": "2016-11-17T20:32:58+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-11-17T22:03:17+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:47:59+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 2.1",
"product": {
"name": "Red Hat JBoss Web Server 2.1",
"product_id": "Red Hat JBoss Web Server 2.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-5346",
"discovery_date": "2014-06-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311085"
}
],
"notes": [
{
"category": "description",
"text": "A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Session fixation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5346"
},
{
"category": "external",
"summary": "RHBZ#1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5346",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5346"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/143",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:32:58+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Session fixation"
},
{
"cve": "CVE-2015-5351",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311076"
}
],
"notes": [
{
"category": "description",
"text": "A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: CSRF token leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5351"
},
{
"category": "external",
"summary": "RHBZ#1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5351",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/148",
"url": "http://seclists.org/bugtraq/2016/Feb/148"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:32:58+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: CSRF token leak"
},
{
"cve": "CVE-2016-0706",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311087"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via StatusManagerServlet",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0706"
},
{
"category": "external",
"summary": "RHBZ#1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0706"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/144",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:32:58+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security manager bypass via StatusManagerServlet"
},
{
"cve": "CVE-2016-0714",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311082"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security Manager bypass via persistence mechanisms",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0714"
},
{
"category": "external",
"summary": "RHBZ#1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0714",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0714"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/145",
"url": "http://seclists.org/bugtraq/2016/Feb/145"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:32:58+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Security Manager bypass via persistence mechanisms"
},
{
"cve": "CVE-2016-0763",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311093"
}
],
"notes": [
{
"category": "description",
"text": "A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via setGlobalContext()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0763"
},
{
"category": "external",
"summary": "RHBZ#1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/147",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:32:58+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: security manager bypass via setGlobalContext()"
},
{
"cve": "CVE-2016-3092",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-06-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1349468"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Usage of vulnerable FileUpload package can result in denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-3092"
},
{
"category": "external",
"summary": "RHBZ#1349468",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1349468"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-3092",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3092"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3092",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3092"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-7.html",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html",
"url": "http://tomcat.apache.org/security-8.html"
}
],
"release_date": "2016-06-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-11-17T20:32:58+00:00",
"details": "Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat JBoss Web Server 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2808"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 2.1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Usage of vulnerable FileUpload package can result in denial of service"
}
]
}
rhsa-2016_1089
Vulnerability from csaf_redhat
Published
2016-05-17 16:12
Modified
2024-11-05 19:20
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 security update
Notes
Topic
Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6 and 7, Solaris, and Microsoft Windows from the Customer Portal.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.
Security Fix(es):
* Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or in certain cases crash the application. (CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-7942, CVE-2015-8035, CVE-2015-8710, CVE-2015-7941, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317)
* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
* A use-after-free flaw was found in the way OpenSSL imported malformed Elliptic Curve private keys. A specially crafted key file could cause an application using OpenSSL to crash when imported. (CVE-2015-0209)
* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)
Red Hat would like to thank the GNOME project for reporting CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-8241, CVE-2015-8242, and CVE-2015-8317. Upstream acknowledges Kostya Serebryany as the original reporter of CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, and CVE-2015-7500; Hugh Davenport as the original reporter of CVE-2015-8241 and CVE-2015-8242; and Hanno Boeck as the original reporter of CVE-2015-8317.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6 and 7, Solaris, and Microsoft Windows from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.\n\nSecurity Fix(es):\n\n* Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or in certain cases crash the application. (CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-7942, CVE-2015-8035, CVE-2015-8710, CVE-2015-7941, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317)\n\n* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)\n\n* A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)\n\n* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)\n\n* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)\n\n* A use-after-free flaw was found in the way OpenSSL imported malformed Elliptic Curve private keys. A specially crafted key file could cause an application using OpenSSL to crash when imported. (CVE-2015-0209)\n\n* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)\n\n* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)\n\nRed Hat would like to thank the GNOME project for reporting CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-8241, CVE-2015-8242, and CVE-2015-8317. Upstream acknowledges Kostya Serebryany as the original reporter of CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, and CVE-2015-7500; Hugh Davenport as the original reporter of CVE-2015-8241 and CVE-2015-8242; and Hanno Boeck as the original reporter of CVE-2015-8317.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1089",
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=webserver\u0026version=3.0.3",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=webserver\u0026version=3.0.3"
},
{
"category": "external",
"summary": "1196737",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1196737"
},
{
"category": "external",
"summary": "1213957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1213957"
},
{
"category": "external",
"summary": "1274222",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1274222"
},
{
"category": "external",
"summary": "1276297",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276297"
},
{
"category": "external",
"summary": "1276693",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276693"
},
{
"category": "external",
"summary": "1277146",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1277146"
},
{
"category": "external",
"summary": "1281862",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281862"
},
{
"category": "external",
"summary": "1281879",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281879"
},
{
"category": "external",
"summary": "1281925",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281925"
},
{
"category": "external",
"summary": "1281930",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281930"
},
{
"category": "external",
"summary": "1281936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281936"
},
{
"category": "external",
"summary": "1281943",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281943"
},
{
"category": "external",
"summary": "1281950",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281950"
},
{
"category": "external",
"summary": "1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "JWS-271",
"url": "https://issues.redhat.com/browse/JWS-271"
},
{
"category": "external",
"summary": "JWS-272",
"url": "https://issues.redhat.com/browse/JWS-272"
},
{
"category": "external",
"summary": "JWS-276",
"url": "https://issues.redhat.com/browse/JWS-276"
},
{
"category": "external",
"summary": "JWS-277",
"url": "https://issues.redhat.com/browse/JWS-277"
},
{
"category": "external",
"summary": "JWS-303",
"url": "https://issues.redhat.com/browse/JWS-303"
},
{
"category": "external",
"summary": "JWS-304",
"url": "https://issues.redhat.com/browse/JWS-304"
},
{
"category": "external",
"summary": "JWS-349",
"url": "https://issues.redhat.com/browse/JWS-349"
},
{
"category": "external",
"summary": "JWS-350",
"url": "https://issues.redhat.com/browse/JWS-350"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1089.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 security update",
"tracking": {
"current_release_date": "2024-11-05T19:20:46+00:00",
"generator": {
"date": "2024-11-05T19:20:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2016:1089",
"initial_release_date": "2016-05-17T16:12:21+00:00",
"revision_history": [
{
"date": "2016-05-17T16:12:21+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-05-17T16:12:21+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:20:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 3.0",
"product": {
"name": "Red Hat JBoss Web Server 3.0",
"product_id": "Red Hat JBoss Web Server 3.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-0209",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2015-02-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1196737"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free flaw was found in the way OpenSSL imported malformed Elliptic Curve private keys. A specially crafted key file could cause an application using OpenSSL to crash when imported.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: use-after-free on invalid EC private key import",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-0209"
},
{
"category": "external",
"summary": "RHBZ#1196737",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1196737"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-0209",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-0209"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0209",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0209"
},
{
"category": "external",
"summary": "https://access.redhat.com/articles/1384453",
"url": "https://access.redhat.com/articles/1384453"
},
{
"category": "external",
"summary": "https://openssl.org/news/secadv_20150319.txt",
"url": "https://openssl.org/news/secadv_20150319.txt"
}
],
"release_date": "2015-02-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: use-after-free on invalid EC private key import"
},
{
"cve": "CVE-2015-5312",
"discovery_date": "2015-10-30T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1276693"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: CPU exhaustion when processing specially crafted XML input",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5312"
},
{
"category": "external",
"summary": "RHBZ#1276693",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276693"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5312",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5312"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5312",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5312"
}
],
"release_date": "2015-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: CPU exhaustion when processing specially crafted XML input"
},
{
"cve": "CVE-2015-5345",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311089"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: directory disclosure",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5345"
},
{
"category": "external",
"summary": "RHBZ#1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5345",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5345"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/146",
"url": "http://seclists.org/bugtraq/2016/Feb/146"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: directory disclosure"
},
{
"cve": "CVE-2015-5346",
"discovery_date": "2014-06-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311085"
}
],
"notes": [
{
"category": "description",
"text": "A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Session fixation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5346"
},
{
"category": "external",
"summary": "RHBZ#1311085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5346",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5346"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5346"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/143",
"url": "http://seclists.org/bugtraq/2016/Feb/143"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Session fixation"
},
{
"cve": "CVE-2015-5351",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311076"
}
],
"notes": [
{
"category": "description",
"text": "A CSRF flaw was found in Tomcat\u0027s the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: CSRF token leak",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5351"
},
{
"category": "external",
"summary": "RHBZ#1311076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5351",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5351"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/148",
"url": "http://seclists.org/bugtraq/2016/Feb/148"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: CSRF token leak"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Kostya Serebryany"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-7497",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281862"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Heap-based buffer overflow in xmlDictComputeFastQKey",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-7497"
},
{
"category": "external",
"summary": "RHBZ#1281862",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281862"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-7497",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7497"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7497",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7497"
}
],
"release_date": "2015-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: Heap-based buffer overflow in xmlDictComputeFastQKey"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Kostya Serebryany"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-7498",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281879"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Heap-based buffer overflow in xmlParseXmlDecl",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-7498"
},
{
"category": "external",
"summary": "RHBZ#1281879",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281879"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-7498",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7498"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7498",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7498"
}
],
"release_date": "2015-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: Heap-based buffer overflow in xmlParseXmlDecl"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Kostya Serebryany"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-7499",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281925"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Heap-based buffer overflow in xmlGROW",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-7499"
},
{
"category": "external",
"summary": "RHBZ#1281925",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281925"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-7499",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7499"
}
],
"release_date": "2015-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: Heap-based buffer overflow in xmlGROW"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Kostya Serebryany"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-7500",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281943"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Heap buffer overflow in xmlParseMisc",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-7500"
},
{
"category": "external",
"summary": "RHBZ#1281943",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281943"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-7500",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7500"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7500",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7500"
}
],
"release_date": "2015-12-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: Heap buffer overflow in xmlParseMisc"
},
{
"cve": "CVE-2015-7941",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2015-10-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1274222"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Out-of-bounds memory access",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-7941"
},
{
"category": "external",
"summary": "RHBZ#1274222",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1274222"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-7941",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7941"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7941",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7941"
}
],
"release_date": "2015-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Out-of-bounds memory access"
},
{
"cve": "CVE-2015-7942",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2015-10-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1276297"
}
],
"notes": [
{
"category": "description",
"text": "A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: heap-based buffer overflow in xmlParseConditionalSections()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-7942"
},
{
"category": "external",
"summary": "RHBZ#1276297",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276297"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-7942",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-7942"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7942",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7942"
}
],
"release_date": "2015-10-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: heap-based buffer overflow in xmlParseConditionalSections()"
},
{
"cve": "CVE-2015-8035",
"cwe": {
"id": "CWE-252",
"name": "Unchecked Return Value"
},
"discovery_date": "2015-11-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1277146"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: DoS caused by incorrect error detection during XZ decompression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect the versions of libxml2 as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for LZMA compression support.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8035"
},
{
"category": "external",
"summary": "RHBZ#1277146",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1277146"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8035",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8035"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8035",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8035"
}
],
"release_date": "2015-11-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: DoS caused by incorrect error detection during XZ decompression"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Hugh Davenport"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8241",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281936"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Buffer overread with XML parser in xmlNextChar",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8241"
},
{
"category": "external",
"summary": "RHBZ#1281936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281936"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8241",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8241"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8241",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8241"
}
],
"release_date": "2015-10-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Buffer overread with XML parser in xmlNextChar"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Hugh Davenport"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8242",
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281950"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8242"
},
{
"category": "external",
"summary": "RHBZ#1281950",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281950"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8242",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8242"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8242",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8242"
}
],
"release_date": "2015-10-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode"
},
{
"acknowledgments": [
{
"names": [
"the GNOME project"
]
},
{
"names": [
"Hanno Boeck"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8317",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2015-11-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1281930"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Out-of-bounds heap read when parsing file with unfinished xml declaration",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8317"
},
{
"category": "external",
"summary": "RHBZ#1281930",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281930"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8317",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8317"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8317",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8317"
}
],
"release_date": "2015-06-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Out-of-bounds heap read when parsing file with unfinished xml declaration"
},
{
"cve": "CVE-2015-8710",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"discovery_date": "2015-04-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1213957"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that libxml2 could access out-of-bounds memory when parsing unclosed HTML comments. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, could cause the application to disclose heap memory contents.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: out-of-bounds memory access when parsing an unclosed HTML comment",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8710"
},
{
"category": "external",
"summary": "RHBZ#1213957",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1213957"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8710",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8710"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8710",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8710"
}
],
"release_date": "2015-04-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: out-of-bounds memory access when parsing an unclosed HTML comment"
},
{
"cve": "CVE-2016-0706",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311087"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via StatusManagerServlet",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0706"
},
{
"category": "external",
"summary": "RHBZ#1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0706"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/144",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security manager bypass via StatusManagerServlet"
},
{
"cve": "CVE-2016-0714",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311082"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security Manager bypass via persistence mechanisms",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0714"
},
{
"category": "external",
"summary": "RHBZ#1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0714",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0714"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/145",
"url": "http://seclists.org/bugtraq/2016/Feb/145"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Security Manager bypass via persistence mechanisms"
},
{
"cve": "CVE-2016-0763",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311093"
}
],
"notes": [
{
"category": "description",
"text": "A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via setGlobalContext()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 3.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0763"
},
{
"category": "external",
"summary": "RHBZ#1311093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0763"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/147",
"url": "http://seclists.org/bugtraq/2016/Feb/147"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-05-17T16:12:21+00:00",
"details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
"product_ids": [
"Red Hat JBoss Web Server 3.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 3.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: security manager bypass via setGlobalContext()"
}
]
}
rhsa-2016_2045
Vulnerability from csaf_redhat
Published
2016-10-10 20:38
Modified
2024-11-05 19:39
Summary
Red Hat Security Advisory: tomcat6 security and bug fix update
Notes
Topic
An update for tomcat6 is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)
* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
* It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5388)
* A directory traversal flaw was found in Tomcat's RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a '/..' in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (CVE-2015-5174)
* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)
* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)
Red Hat would like to thank Scott Geary (VendHQ) for reporting CVE-2016-5388. The CVE-2016-6325 issue was discovered by Red Hat Product Security.
Bug Fix(es):
* Due to a bug in the tomcat6 spec file, the catalina.out file's md5sum, size, and mtime attributes were compared to the file's attributes at installation time. Because these attributes change after the service is started, the "rpm -V" command previously failed. With this update, the attributes mentioned above are ignored in the RPM verification and the catalina.out file now passes the verification check. (BZ#1357123)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for tomcat6 is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)\n\n* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)\n\n* It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5388)\n\n* A directory traversal flaw was found in Tomcat\u0027s RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a \u0027/..\u0027 in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (CVE-2015-5174)\n\n* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)\n\n* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)\n\nRed Hat would like to thank Scott Geary (VendHQ) for reporting CVE-2016-5388. The CVE-2016-6325 issue was discovered by Red Hat Product Security.\n\nBug Fix(es):\n\n* Due to a bug in the tomcat6 spec file, the catalina.out file\u0027s md5sum, size, and mtime attributes were compared to the file\u0027s attributes at installation time. Because these attributes change after the service is started, the \"rpm -V\" command previously failed. With this update, the attributes mentioned above are ignored in the RPM verification and the catalina.out file now passes the verification check. (BZ#1357123)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:2045",
"url": "https://access.redhat.com/errata/RHSA-2016:2045"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.45",
"url": "https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.45"
},
{
"category": "external",
"summary": "1265698",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1265698"
},
{
"category": "external",
"summary": "1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "1353809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1353809"
},
{
"category": "external",
"summary": "1357123",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1357123"
},
{
"category": "external",
"summary": "1367447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1367447"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2045.json"
}
],
"title": "Red Hat Security Advisory: tomcat6 security and bug fix update",
"tracking": {
"current_release_date": "2024-11-05T19:39:23+00:00",
"generator": {
"date": "2024-11-05T19:39:23+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2016:2045",
"initial_release_date": "2016-10-10T20:38:52+00:00",
"revision_history": [
{
"date": "2016-10-10T20:38:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-10-10T20:38:52+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T19:39:23+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux HPC Node (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"product": {
"name": "tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"product_id": "tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-javadoc@6.0.24-98.el6_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"product": {
"name": "tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"product_id": "tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-admin-webapps@6.0.24-98.el6_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"product": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"product_id": "tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-servlet-2.5-api@6.0.24-98.el6_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"product": {
"name": "tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"product_id": "tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-lib@6.0.24-98.el6_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"product": {
"name": "tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"product_id": "tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-el-2.1-api@6.0.24-98.el6_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"product": {
"name": "tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"product_id": "tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-docs-webapp@6.0.24-98.el6_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"product": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"product_id": "tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-jsp-2.1-api@6.0.24-98.el6_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"product": {
"name": "tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"product_id": "tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6-webapps@6.0.24-98.el6_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "tomcat6-0:6.0.24-98.el6_8.noarch",
"product": {
"name": "tomcat6-0:6.0.24-98.el6_8.noarch",
"product_id": "tomcat6-0:6.0.24-98.el6_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.24-98.el6_8?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat6-0:6.0.24-98.el6_8.src",
"product": {
"name": "tomcat6-0:6.0.24-98.el6_8.src",
"product_id": "tomcat6-0:6.0.24-98.el6_8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat6@6.0.24-98.el6_8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-98.el6_8.src as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src"
},
"product_reference": "tomcat6-0:6.0.24-98.el6_8.src",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Desktop (v. 6)",
"product_id": "6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Client-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-98.el6_8.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src"
},
"product_reference": "tomcat6-0:6.0.24-98.el6_8.src",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
"product_id": "6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6ComputeNode-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-98.el6_8.src as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src"
},
"product_reference": "tomcat6-0:6.0.24-98.el6_8.src",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Server-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-0:6.0.24-98.el6_8.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src"
},
"product_reference": "tomcat6-0:6.0.24-98.el6_8.src",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-javadoc-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-lib-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Workstation-6.8.z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat6-webapps-0:6.0.24-98.el6_8.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
},
"product_reference": "tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"relates_to_product_reference": "6Workstation-6.8.z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-5174",
"discovery_date": "2015-08-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1265698"
}
],
"notes": [
{
"category": "description",
"text": "A directory traversal flaw was found in Tomcat\u0027s RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a \u0027/..\u0027 in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: URL Normalization issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5174"
},
{
"category": "external",
"summary": "RHBZ#1265698",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1265698"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5174",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5174"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5174",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5174"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/149",
"url": "http://seclists.org/bugtraq/2016/Feb/149"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-10-10T20:38:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2045"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: URL Normalization issue"
},
{
"cve": "CVE-2015-5345",
"cwe": {
"id": "CWE-552",
"name": "Files or Directories Accessible to External Parties"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311089"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: directory disclosure",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-5345"
},
{
"category": "external",
"summary": "RHBZ#1311089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311089"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-5345",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-5345"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5345"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/146",
"url": "http://seclists.org/bugtraq/2016/Feb/146"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-10-10T20:38:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2045"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: directory disclosure"
},
{
"cve": "CVE-2016-0706",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311087"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: security manager bypass via StatusManagerServlet",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0706"
},
{
"category": "external",
"summary": "RHBZ#1311087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311087"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0706",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0706"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/144",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-10-10T20:38:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2045"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: security manager bypass via StatusManagerServlet"
},
{
"cve": "CVE-2016-0714",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2016-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1311082"
}
],
"notes": [
{
"category": "description",
"text": "It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Security Manager bypass via persistence mechanisms",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-0714"
},
{
"category": "external",
"summary": "RHBZ#1311082",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1311082"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-0714",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-0714"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0714"
},
{
"category": "external",
"summary": "http://seclists.org/bugtraq/2016/Feb/145",
"url": "http://seclists.org/bugtraq/2016/Feb/145"
}
],
"release_date": "2016-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-10-10T20:38:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2045"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Security Manager bypass via persistence mechanisms"
},
{
"acknowledgments": [
{
"names": [
"Scott Geary"
],
"organization": "VendHQ"
}
],
"cve": "CVE-2016-5388",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-07-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1353809"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat: CGI sets environmental variable based on user supplied Proxy request header",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-5388"
},
{
"category": "external",
"summary": "RHBZ#1353809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1353809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-5388",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-5388"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-5388",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5388"
}
],
"release_date": "2016-07-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-10-10T20:38:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2045"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Tomcat: CGI sets environmental variable based on user supplied Proxy request header"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2016-6325",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"discovery_date": "2016-08-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1367447"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: tomcat writable config files allow privilege escalation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6325"
},
{
"category": "external",
"summary": "RHBZ#1367447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1367447"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6325",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6325"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6325",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6325"
}
],
"release_date": "2016-10-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-10-10T20:38:52+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:2045"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Client-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Client-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6ComputeNode-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6ComputeNode-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Server-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Server-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-0:6.0.24-98.el6_8.src",
"6Workstation-6.8.z:tomcat6-admin-webapps-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-docs-webapp-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-el-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-javadoc-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-jsp-2.1-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-lib-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-servlet-2.5-api-0:6.0.24-98.el6_8.noarch",
"6Workstation-6.8.z:tomcat6-webapps-0:6.0.24-98.el6_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: tomcat writable config files allow privilege escalation"
}
]
}
ghsa-6vx3-hr43-cfrh
Vulnerability from github
Published
2022-05-14 01:10
Modified
2023-12-08 20:03
Severity ?
Summary
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Details
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0.M1"
},
{
"fixed": "9.0.0.M2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"9.0.0.M1"
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.0.30"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0.RC1"
},
{
"fixed": "8.0.31"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.0.44"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.45"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-0706"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-06T20:07:37Z",
"nvd_published_at": "2016-02-25T01:59:00Z",
"severity": "MODERATE"
},
"details": "Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.",
"id": "GHSA-6vx3-hr43-cfrh",
"modified": "2023-12-08T20:03:04Z",
"published": "2022-05-14T01:10:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0706"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160321234551/http://www.securitytracker.com/id/1035069"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160226210040/http://www.securityfocus.com/bid/83324"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20180531-0001"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"type": "WEB",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=145974991225029\u0026w=2"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2045.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2599.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"type": "WEB",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722799"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722800"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722801"
},
{
"type": "WEB",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722802"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-6.html"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-8.html"
},
{
"type": "WEB",
"url": "http://tomcat.apache.org/security-9.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3024-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat"
}
gsd-2016-0706
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2016-0706",
"description": "Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.",
"id": "GSD-2016-0706",
"references": [
"https://www.suse.com/security/cve/CVE-2016-0706.html",
"https://www.debian.org/security/2016/dsa-3609",
"https://www.debian.org/security/2016/dsa-3552",
"https://www.debian.org/security/2016/dsa-3530",
"https://access.redhat.com/errata/RHSA-2016:2808",
"https://access.redhat.com/errata/RHSA-2016:2807",
"https://access.redhat.com/errata/RHSA-2016:2599",
"https://access.redhat.com/errata/RHSA-2016:2045",
"https://access.redhat.com/errata/RHSA-2016:1089",
"https://access.redhat.com/errata/RHSA-2016:1088",
"https://access.redhat.com/errata/RHSA-2016:1087",
"https://ubuntu.com/security/CVE-2016-0706",
"https://advisories.mageia.org/CVE-2016-0706.html",
"https://alas.aws.amazon.com/cve/html/CVE-2016-0706.html",
"https://linux.oracle.com/cve/CVE-2016-0706.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2016-0706"
],
"details": "Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.",
"id": "GSD-2016-0706",
"modified": "2023-12-13T01:21:17.450140Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-0706",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964",
"refsource": "CONFIRM",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722800",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722800"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"name": "GLSA-201705-09",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"name": "openSUSE-SU-2016:0865",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"name": "http://tomcat.apache.org/security-9.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-9.html"
},
{
"name": "USN-3024-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3024-1"
},
{
"name": "SUSE-SU-2016:0769",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"name": "RHSA-2016:2045",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2045.html"
},
{
"name": "DSA-3530",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "http://tomcat.apache.org/security-7.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "HPSBUX03561",
"refsource": "HP",
"url": "http://marc.info/?l=bugtraq\u0026m=145974991225029\u0026w=2"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722802",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722802"
},
{
"name": "RHSA-2016:1089",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"name": "http://tomcat.apache.org/security-8.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "RHSA-2016:1087",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"name": "1035069",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1035069"
},
{
"name": "https://bto.bluecoat.com/security-advisory/sa118",
"refsource": "CONFIRM",
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442",
"refsource": "CONFIRM",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"name": "RHSA-2016:2807",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"name": "RHSA-2016:1088",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"name": "https://security.netapp.com/advisory/ntap-20180531-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20180531-0001/"
},
{
"name": "http://tomcat.apache.org/security-6.html",
"refsource": "CONFIRM",
"url": "http://tomcat.apache.org/security-6.html"
},
{
"name": "RHSA-2016:2808",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"name": "SUSE-SU-2016:0822",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"name": "83324",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/83324"
},
{
"name": "RHSA-2016:2599",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-2599.html"
},
{
"name": "DSA-3609",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"name": "SUSE-SU-2016:0839",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html"
},
{
"name": "20160222 [SECURITY] CVE-2016-0706 Apache Tomcat Security Manager bypass",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/bugtraq/2016/Feb/144"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722799",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722799"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626",
"refsource": "CONFIRM",
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"name": "DSA-3552",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722801",
"refsource": "CONFIRM",
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722801"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "[6.0.0,6.0.44],[8.0.0.RC1,8.0.30],[9.0.0.M1]",
"affected_versions": "All versions starting from 6.0.0 up to 6.0.44, all versions starting from 8.0.0.rc1 up to 8.0.30, version 9.0.0.m1",
"cvss_v2": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-200",
"CWE-937"
],
"date": "2022-07-06",
"description": "Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.",
"fixed_versions": [
"8.0.31",
"9.0.0.M2",
"6.0.45"
],
"identifier": "CVE-2016-0706",
"identifiers": [
"GHSA-6vx3-hr43-cfrh",
"CVE-2016-0706"
],
"not_impacted": "All versions before 6.0.0, all versions after 6.0.44 before 8.0.0.rc1, all versions after 8.0.30 before 9.0.0.m1, all versions after 9.0.0.m1",
"package_slug": "maven/org.apache.tomcat/tomcat",
"pubdate": "2022-05-14",
"solution": "Upgrade to versions 8.0.31, 9.0.0.M2, 6.0.45 or above.",
"title": "Exposure of Sensitive Information to an Unauthorized Actor",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2016-0706",
"https://access.redhat.com/errata/RHSA-2016:1087",
"https://access.redhat.com/errata/RHSA-2016:1088",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626",
"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E",
"https://security.gentoo.org/glsa/201705-09",
"https://security.netapp.com/advisory/ntap-20180531-0001/",
"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html",
"http://marc.info/?l=bugtraq\u0026m=145974991225029\u0026w=2",
"http://rhn.redhat.com/errata/RHSA-2016-2045.html",
"http://rhn.redhat.com/errata/RHSA-2016-2599.html",
"http://rhn.redhat.com/errata/RHSA-2016-2807.html",
"http://rhn.redhat.com/errata/RHSA-2016-2808.html",
"http://seclists.org/bugtraq/2016/Feb/144",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1722799",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1722800",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1722801",
"http://svn.apache.org/viewvc?view=revision\u0026revision=1722802",
"http://tomcat.apache.org/security-6.html",
"http://tomcat.apache.org/security-7.html",
"http://tomcat.apache.org/security-8.html",
"http://tomcat.apache.org/security-9.html",
"http://www.debian.org/security/2016/dsa-3530",
"http://www.debian.org/security/2016/dsa-3552",
"http://www.debian.org/security/2016/dsa-3609",
"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
"http://www.ubuntu.com/usn/USN-3024-1",
"https://github.com/advisories/GHSA-6vx3-hr43-cfrh"
],
"uuid": "cb72dbb6-757a-4314-a23b-199680d9f2e6"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.39:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.44:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.37:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.5:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.41:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.43:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-0706"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722800",
"refsource": "CONFIRM",
"tags": [],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722800"
},
{
"name": "http://tomcat.apache.org/security-6.html",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://tomcat.apache.org/security-6.html"
},
{
"name": "http://tomcat.apache.org/security-8.html",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://tomcat.apache.org/security-8.html"
},
{
"name": "http://tomcat.apache.org/security-9.html",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://tomcat.apache.org/security-9.html"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722801",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722801"
},
{
"name": "http://tomcat.apache.org/security-7.html",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://tomcat.apache.org/security-7.html"
},
{
"name": "20160222 [SECURITY] CVE-2016-0706 Apache Tomcat Security Manager bypass",
"refsource": "BUGTRAQ",
"tags": [
"Mailing List"
],
"url": "http://seclists.org/bugtraq/2016/Feb/144"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722799",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722799"
},
{
"name": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722802",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking"
],
"url": "http://svn.apache.org/viewvc?view=revision\u0026revision=1722802"
},
{
"name": "DSA-3530",
"refsource": "DEBIAN",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3530"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442"
},
{
"name": "DSA-3609",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3609"
},
{
"name": "USN-3024-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-3024-1"
},
{
"name": "DSA-3552",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3552"
},
{
"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964"
},
{
"name": "HPSBUX03561",
"refsource": "HP",
"tags": [
"Third Party Advisory"
],
"url": "http://marc.info/?l=bugtraq\u0026m=145974991225029\u0026w=2"
},
{
"name": "RHSA-2016:2045",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2045.html"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"
},
{
"name": "83324",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/83324"
},
{
"name": "RHSA-2016:1087",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2016:1087"
},
{
"name": "RHSA-2016:1089",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1089.html"
},
{
"name": "RHSA-2016:1088",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2016:1088"
},
{
"name": "SUSE-SU-2016:0769",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html"
},
{
"name": "openSUSE-SU-2016:0865",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html"
},
{
"name": "https://bto.bluecoat.com/security-advisory/sa118",
"refsource": "CONFIRM",
"tags": [],
"url": "https://bto.bluecoat.com/security-advisory/sa118"
},
{
"name": "SUSE-SU-2016:0822",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html"
},
{
"name": "SUSE-SU-2016:0839",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html"
},
{
"name": "1035069",
"refsource": "SECTRACK",
"tags": [],
"url": "http://www.securitytracker.com/id/1035069"
},
{
"name": "GLSA-201705-09",
"refsource": "GENTOO",
"tags": [],
"url": "https://security.gentoo.org/glsa/201705-09"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
},
{
"name": "RHSA-2016:2808",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2808.html"
},
{
"name": "RHSA-2016:2807",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2807.html"
},
{
"name": "RHSA-2016:2599",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-2599.html"
},
{
"name": "https://security.netapp.com/advisory/ntap-20180531-0001/",
"refsource": "CONFIRM",
"tags": [],
"url": "https://security.netapp.com/advisory/ntap-20180531-0001/"
},
{
"name": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
},
{
"name": "[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
},
"lastModifiedDate": "2023-12-08T16:41Z",
"publishedDate": "2016-02-25T01:59Z"
}
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.