Action not permitted
Modal body text goes here.
cve-2019-0199
Vulnerability from cvelistv5
Published
2019-04-10 14:21
Modified
2024-08-04 17:44
Severity
Summary
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
References
Impacted products
| Vendor | Product |
|---|---|
| n/a | Apache Tomcat |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:44:15.322Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20190419-0001/"
},
{
"name": "[tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E"
},
{
"name": "[tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E"
},
{
"name": "FEDORA-2019-1a3f878d27",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.f5.com/csp/article/K17321505"
},
{
"name": "openSUSE-SU-2019:1673",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html"
},
{
"name": "FEDORA-2019-d66febb5df",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"name": "107674",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/107674"
},
{
"name": "openSUSE-SU-2019:1723",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html"
},
{
"name": "openSUSE-SU-2019:1808",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html"
},
{
"name": "RHSA-2019:3929",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
},
{
"name": "RHSA-2019:3931",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:3931"
},
{
"name": "DSA-4596",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2019/dsa-4596"
},
{
"name": "20191229 [SECURITY] [DSA 4596-1] tomcat8 security update",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "https://seclists.org/bugtraq/2019/Dec/43"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache Tomcat",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37"
}
]
}
],
"datePublic": "2019-03-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "DoS",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-15T21:06:48",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20190419-0001/"
},
{
"name": "[tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E"
},
{
"name": "[tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E"
},
{
"name": "FEDORA-2019-1a3f878d27",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.f5.com/csp/article/K17321505"
},
{
"name": "openSUSE-SU-2019:1673",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html"
},
{
"name": "FEDORA-2019-d66febb5df",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"name": "107674",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/107674"
},
{
"name": "openSUSE-SU-2019:1723",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html"
},
{
"name": "openSUSE-SU-2019:1808",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html"
},
{
"name": "RHSA-2019:3929",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
},
{
"name": "RHSA-2019:3931",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:3931"
},
{
"name": "DSA-4596",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2019/dsa-4596"
},
{
"name": "20191229 [SECURITY] [DSA 4596-1] tomcat8 security update",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "https://seclists.org/bugtraq/2019/Dec/43"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2019-0199",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache Tomcat",
"version": {
"version_data": [
{
"version_value": "Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "DoS"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E",
"refsource": "MISC",
"url": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "https://security.netapp.com/advisory/ntap-20190419-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20190419-0001/"
},
{
"name": "[tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e@%3Ccommits.tomee.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067@%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef@%3Cannounce.apache.org%3E"
},
{
"name": "[tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c@%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600@%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6@%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9@%3Cannounce.apache.org%3E"
},
{
"name": "FEDORA-2019-1a3f878d27",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/"
},
{
"name": "https://support.f5.com/csp/article/K17321505",
"refsource": "CONFIRM",
"url": "https://support.f5.com/csp/article/K17321505"
},
{
"name": "openSUSE-SU-2019:1673",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html"
},
{
"name": "FEDORA-2019-d66febb5df",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"refsource": "MISC",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"name": "107674",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/107674"
},
{
"name": "openSUSE-SU-2019:1723",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html"
},
{
"name": "openSUSE-SU-2019:1808",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html"
},
{
"name": "RHSA-2019:3929",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
},
{
"name": "RHSA-2019:3931",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:3931"
},
{
"name": "DSA-4596",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2019/dsa-4596"
},
{
"name": "20191229 [SECURITY] [DSA 4596-1] tomcat8 security update",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Dec/43"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2019-0199",
"datePublished": "2019-04-10T14:21:50",
"dateReserved": "2018-11-14T00:00:00",
"dateUpdated": "2024-08-04T17:44:15.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2019-0199\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2019-04-10T15:29:00.390\",\"lastModified\":\"2023-12-08T16:41:18.860\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.\"},{\"lang\":\"es\",\"value\":\"La implementaci\u00f3n HTTP/2 en Apache Tomcat desde 9.0.0.M1 hasta 9.0.14 y desde 8.5.0 hasta 8.5.37 aceptaba flujos con n\u00fameros excesivos de tramas SETTINS y permit\u00eda a los clientes mantener flujos abiertos sin datos de lectura/escritura o solicitud/respuesta. Manteniendo flujos abiertos para peticiones que utilizaban bloqueo I/O en el Servlet API\u00b4s, los clientes eran capaces de hacer que los hilos (threads) del lado del servidor se bloquearan, provocando el agotamiento de los hilos y la denegaci\u00f3n del servicio (DoS).\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":5.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.5.0\",\"versionEndIncluding\":\"8.5.37\",\"matchCriteriaId\":\"E3E3F100-D467-4B40-B818-E0E915602B77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.1\",\"versionEndIncluding\":\"9.0.14\",\"matchCriteriaId\":\"589790FC-75B6-41A6-92D3-D3A0EF93678C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D0689FE-4BC0-4F53-8C79-34B21F9B86C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*\",\"matchCriteriaId\":\"89B129B2-FB6F-4EF9-BF12-E589A87996CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B6787B6-54A8-475E-BA1C-AB99334B2535\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*\",\"matchCriteriaId\":\"EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*\",\"matchCriteriaId\":\"E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A6DA0BE-908C-4DA8-A191-A0113235E99A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*\",\"matchCriteriaId\":\"39029C72-28B4-46A4-BFF5-EC822CFB2A4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A2E05A3-014F-4C4D-81E5-88E725FBD6AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*\",\"matchCriteriaId\":\"166C533C-0833-41D5-99B6-17A4FAB3CAF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3768C60-21FA-4B92-B98C-C3A2602D1BC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*\",\"matchCriteriaId\":\"DDD510FA-A2E4-4BAF-A0DE-F4E5777E9325\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F542E12-6BA8-4504-A494-DA83E7E19BD5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2409CC7-6A85-4A66-A457-0D62B9895DC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*\",\"matchCriteriaId\":\"B392A7E5-4455-4B1C-8FAC-AE6DDC70689E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0C5F004-F7D8-45DB-B173-351C50B0EC16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1902D2E-1896-4D3D-9E1C-3A675255072C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*\",\"matchCriteriaId\":\"49AAF4DF-F61D-47A8-8788-A21E317A145D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*\",\"matchCriteriaId\":\"454211D0-60A2-4661-AECA-4C0121413FEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*\",\"matchCriteriaId\":\"0686F977-889F-4960-8E0B-7784B73A7F2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*\",\"matchCriteriaId\":\"558703AE-DB5E-4DFF-B497-C36694DD7B24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED6273F2-1165-47A4-8DD7-9E9B2472941B\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html\",\"source\":\"security@apache.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html\",\"source\":\"security@apache.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html\",\"source\":\"security@apache.org\"},{\"url\":\"http://www.securityfocus.com/bid/107674\",\"source\":\"security@apache.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3929\",\"source\":\"security@apache.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3931\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/\",\"source\":\"security@apache.org\"},{\"url\":\"https://seclists.org/bugtraq/2019/Dec/43\",\"source\":\"security@apache.org\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20190419-0001/\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.f5.com/csp/article/K17321505\",\"source\":\"security@apache.org\"},{\"url\":\"https://www.debian.org/security/2019/dsa-4596\",\"source\":\"security@apache.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2020.html\",\"source\":\"security@apache.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2020.html\",\"source\":\"security@apache.org\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html\",\"source\":\"security@apache.org\"}]}}"
}
}
var-201904-1069
Vulnerability from variot
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. Apache Tomcat Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Apache Tomcat is a lightweight web application server from the Apache Software Foundation. This program implements support for Servlet and JavaServerPage (JSP). There is a security vulnerability in Apache Tomcat. An attacker could exploit the vulnerability to cause a denial of service. Attackers may leverage this issue to cause denial-of-service conditions. A vulnerability in Apache Tomcat could allow an unauthenticated, remote malicious user to cause a denial of service (DoS) condition on a targeted system. The vulnerability is due to a resource exhaustion condition in the HTTP/2 implementation of the affected software. A successful exploit could result in a DoS condition on the targeted system. Apache has confirmed the vulnerability and released software updates. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Debian Security Advisory DSA-4596-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff December 27, 2019 https://www.debian.org/security/faq
Package : tomcat8 CVE ID : CVE-2018-8014 CVE-2018-11784 CVE-2019-0199 CVE-2019-0221 CVE-2019-12418 CVE-2019-17563
Several issues were discovered in the Tomcat servlet and JSP engine, which could result in session fixation attacks, information disclosure, cross- site scripting, denial of service via resource exhaustion and insecure redirects.
For the oldstable distribution (stretch), these problems have been fixed in version 8.5.50-0+deb9u1. This update also requires an updated version of tomcat-native which has been updated to 1.2.21-1~deb9u1.
We recommend that you upgrade your tomcat8 packages.
For the detailed security status of tomcat8 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/tomcat8
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl4GgDcACgkQEMKTtsN8 TjaVxA//dmUGPdFZSI6VW/avTJ8YKIgVaKTLJz47hl9GKWJoGI4lG5TE4INs193y xKf2gtuPb/YCdqZj2VphPTiPiIbycXrRXTq9uGnioteeAZfgKnqSokcQ+EvUItsp Q7nBeuFNdSHaK1TAQ74Ty4qcwM/WXQ5c0UfZvAbMzYp3PRrkHkMXhUHMj7MJNz7W 6I/ehY+h+VkvTj7P6U3icEoLsTqOwKiHFiAVKD9DiUZqRI62nmbMW2il1zgF3pOZ QNrDGhNsaVfhJbIES3/vuF/qSQIm6GryQ1dwxbFBszemdHTGEQmANsxLLXWnPDH1 2KigZh5bkSlQZvJRHgbJp+LdM+DSY7VI1KtwTIkpwFZ2/kbz+kMGGT+TQplSORyL IY9SK1aQduWBx2yi3X7/wPXVdV7KA1cMCPhSt8fVieYxZWtONALBuCdnSSEweIEq myd2GD75QIHjZy7JZoVc421kCjH4IrXxuwEQDkHjKTladjdklOREEocAc8R+NjSS kUKdS2cOel6M2yjH/ieOv3DVaUPplgl+0KJGXqAhdkCQUwTMsw1tmR/ObWkCHQov k79Isubwc5kuQD/iBCuIQM8TgfNcyWXNAyHbpKR7kGkrn/ihN7dsCdvRjrMPrvRJ x/PLd3rjlgS5D1cEf7PTZZjym4mwDPrKgamSt9V3f3RwFwV75vY= =je4v -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Important: Red Hat support for Spring Boot 2.1.12 security and bug fix update Advisory ID: RHSA-2020:2366-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2020:2366 Issue date: 2020-06-04 CVE Names: CVE-2019-0199 CVE-2019-3868 CVE-2019-3875 CVE-2019-10199 CVE-2019-10201 CVE-2019-14832 =====================================================================
- Summary:
An update is now available for Red Hat OpenShift Application Runtimes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
[NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-02-18. The advisory is informational only; no files in the release have changed.]
- Description:
Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform.
This release of Red Hat support for Spring Boot 2.1.12 serves as a replacement for Red Hat support for Spring Boot 2.1.6, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
-
tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
-
keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)
-
keycloak: session hijack using the user access token (CVE-2019-3868)
-
keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875)
-
keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)
-
keycloak: cross-realm user access auth bypass (CVE-2019-14832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Solution:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
The References section of this erratum contains a download link (you must log in to download the update).
- Bugs fixed (https://bugzilla.redhat.com/):
1679144 - CVE-2019-3868 keycloak: session hijack using the user access token 1690628 - CVE-2019-3875 keycloak: missing signatures validation on CRL used to verify client certificates 1693325 - CVE-2019-0199 tomcat: Apache Tomcat HTTP/2 DoS 1728609 - CVE-2019-10201 keycloak: SAML broker does not check existence of signature on document allowing any user impersonation 1729261 - CVE-2019-10199 keycloak: CSRF check missing in My Resources functionality in the Account Console 1749487 - CVE-2019-14832 keycloak: cross-realm user access auth bypass
- References:
https://access.redhat.com/security/cve/CVE-2019-0199 https://access.redhat.com/security/cve/CVE-2019-3868 https://access.redhat.com/security/cve/CVE-2019-3875 https://access.redhat.com/security/cve/CVE-2019-10199 https://access.redhat.com/security/cve/CVE-2019-10201 https://access.redhat.com/security/cve/CVE-2019-14832 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.12 https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBXtjx9tzjgjWX9erEAQhFOA//Tkk46vAF4/aJiKVApEHvF5R96081W2Hq G96k3lUPuatTrcD/2yek9whs1Bf9MQgWcaFWCgx63nsNs6Mm81frsR/dt4YV8mWc 97y4u6kz6nvQQ6Wz6Xuic9km17/yXuNl5JqgmcLtltgNhtWgZhpQUKfbP3ot0T2X FStJvnZlPrgDnpnVZ8y6x++otaDfbXGiy2FyGepXei8WWxXtQ/XYPoQC/mYbuXgM eUNsFLEyY9hWLCE4vfavLCM4fHs+djrL2E6N431JhpLyCrbTx0nYkaMkoOoJlLe2 agJjBzd5iYnBbD6p9K5okIWR1U2gNsdV6Q7UROTLiEFoxBOr1hO1mzqYkJ80t1Pm d48N7OuQ4MhYgiKftVDmsVgXuQzySUrjZWnZZnDbVZo02gwD8T1NXgq9zCX64/sl ucKvbDnnmLDYQYsKRCjf1aH1ZDrrPOPIOkTbMlb4+Wqc/O8jrRfzvya0ym9wnN8v CG3VmxPBPeNgp6/pmTBrJU9c+dER9qmavAB77Vl09dH88V9Ne4GLiVfqSVOEhY1w vwZo31fNXNYFYT/NV2v9CiZwrRcsqn60VH0E4Qc+zTOb5esR7bIidcBMGtPm+BI0 80uR7D6DwjVmZsfzwakCIiGMaChysonql+P72iOd2Xerj7osdvMSEQHSVSjuILh7 wiv1ksQVw/s= =pUHq -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201904-1069",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tomcat",
"scope": "eq",
"trust": 1.1,
"vendor": "apache",
"version": "9.0.0"
},
{
"model": "tomcat",
"scope": "gte",
"trust": 1.0,
"vendor": "apache",
"version": "9.0.1"
},
{
"model": "tomcat",
"scope": "lte",
"trust": 1.0,
"vendor": "apache",
"version": "9.0.14"
},
{
"model": "tomcat",
"scope": "lte",
"trust": 1.0,
"vendor": "apache",
"version": "8.5.37"
},
{
"model": "tomcat",
"scope": "gte",
"trust": 1.0,
"vendor": "apache",
"version": "8.5.0"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.8,
"vendor": "apache",
"version": "8.5.0 to 8.5.37"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.8,
"vendor": "apache",
"version": "9.0.0.m1 to 9.0.14"
},
{
"model": "tomcat",
"scope": null,
"trust": 0.6,
"vendor": "apache",
"version": null
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.0"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.1"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.2"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.3"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.4"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.5"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.6"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.7"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.8"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.9"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.11"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.12"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.13"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.14"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.15"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.16"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.23"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.24"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.27"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.28"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.30"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.31"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.32"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.34"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "8.5.37"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "9.0.1"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "9.0.4"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "9.0.5"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "9.0.7"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "9.0.8"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "9.0.9"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "9.0.10"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "9.0.12"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.4,
"vendor": "apache",
"version": "9.0.14"
},
{
"model": "instantis enterprisetrack",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "17.3"
},
{
"model": "instantis enterprisetrack",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "17.2"
},
{
"model": "instantis enterprisetrack",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "17.1"
},
{
"model": "tomcat 9.0.0m8",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0m6",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m9",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m7",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m5",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m4",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m3",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m22",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m21",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m20",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m2",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m19",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m18",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m17",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m15",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m13",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m12",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m11",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m10",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat 9.0.0.m1",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "tomcat",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": "9.0.16"
},
{
"model": "tomcat",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": "8.5.38"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.10"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.17"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.18"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.19"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.20"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.21"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.22"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.25"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.26"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.29"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.33"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.35"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "8.5.36"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "9.0.2"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "9.0.3"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "9.0.6"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "9.0.11"
},
{
"model": "tomcat",
"scope": "eq",
"trust": 0.1,
"vendor": "apache",
"version": "9.0.13"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-15086"
},
{
"db": "VULMON",
"id": "CVE-2019-0199"
},
{
"db": "BID",
"id": "107674"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003375"
},
{
"db": "NVD",
"id": "CVE-2019-0199"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.0.14",
"versionStartIncluding": "9.0.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.5.37",
"versionStartIncluding": "8.5.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-0199"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Inc,Debian,Michal Karm Babacek from Red Hat",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201903-919"
}
],
"trust": 0.6
},
"cve": "CVE-2019-0199",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2019-0199",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-15086",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2019-0199",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-0199",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2019-15086",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201903-919",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2019-0199",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-15086"
},
{
"db": "VULMON",
"id": "CVE-2019-0199"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003375"
},
{
"db": "NVD",
"id": "CVE-2019-0199"
},
{
"db": "CNNVD",
"id": "CNNVD-201903-919"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. Apache Tomcat Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Apache Tomcat is a lightweight web application server from the Apache Software Foundation. This program implements support for Servlet and JavaServerPage (JSP). There is a security vulnerability in Apache Tomcat. An attacker could exploit the vulnerability to cause a denial of service. \nAttackers may leverage this issue to cause denial-of-service conditions. A vulnerability in Apache Tomcat could allow an unauthenticated, remote malicious user to cause a denial of service (DoS) condition on a targeted system. \nThe vulnerability is due to a resource exhaustion condition in the HTTP/2 implementation of the affected software. A successful exploit could result in a DoS condition on the targeted system. \nApache has confirmed the vulnerability and released software updates. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4596-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nDecember 27, 2019 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : tomcat8\nCVE ID : CVE-2018-8014 CVE-2018-11784 CVE-2019-0199 CVE-2019-0221 \n CVE-2019-12418 CVE-2019-17563\n\nSeveral issues were discovered in the Tomcat servlet and JSP engine, which\ncould result in session fixation attacks, information disclosure, cross-\nsite scripting, denial of service via resource exhaustion and insecure\nredirects. \n\nFor the oldstable distribution (stretch), these problems have been fixed\nin version 8.5.50-0+deb9u1. This update also requires an updated version\nof tomcat-native which has been updated to 1.2.21-1~deb9u1. \n\nWe recommend that you upgrade your tomcat8 packages. \n\nFor the detailed security status of tomcat8 please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/tomcat8\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl4GgDcACgkQEMKTtsN8\nTjaVxA//dmUGPdFZSI6VW/avTJ8YKIgVaKTLJz47hl9GKWJoGI4lG5TE4INs193y\nxKf2gtuPb/YCdqZj2VphPTiPiIbycXrRXTq9uGnioteeAZfgKnqSokcQ+EvUItsp\nQ7nBeuFNdSHaK1TAQ74Ty4qcwM/WXQ5c0UfZvAbMzYp3PRrkHkMXhUHMj7MJNz7W\n6I/ehY+h+VkvTj7P6U3icEoLsTqOwKiHFiAVKD9DiUZqRI62nmbMW2il1zgF3pOZ\nQNrDGhNsaVfhJbIES3/vuF/qSQIm6GryQ1dwxbFBszemdHTGEQmANsxLLXWnPDH1\n2KigZh5bkSlQZvJRHgbJp+LdM+DSY7VI1KtwTIkpwFZ2/kbz+kMGGT+TQplSORyL\nIY9SK1aQduWBx2yi3X7/wPXVdV7KA1cMCPhSt8fVieYxZWtONALBuCdnSSEweIEq\nmyd2GD75QIHjZy7JZoVc421kCjH4IrXxuwEQDkHjKTladjdklOREEocAc8R+NjSS\nkUKdS2cOel6M2yjH/ieOv3DVaUPplgl+0KJGXqAhdkCQUwTMsw1tmR/ObWkCHQov\nk79Isubwc5kuQD/iBCuIQM8TgfNcyWXNAyHbpKR7kGkrn/ihN7dsCdvRjrMPrvRJ\nx/PLd3rjlgS5D1cEf7PTZZjym4mwDPrKgamSt9V3f3RwFwV75vY=\n=je4v\n-----END PGP SIGNATURE-----\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Important: Red Hat support for Spring Boot 2.1.12 security and bug fix update\nAdvisory ID: RHSA-2020:2366-01\nProduct: Red Hat OpenShift Application Runtimes\nAdvisory URL: https://access.redhat.com/errata/RHSA-2020:2366\nIssue date: 2020-06-04\nCVE Names: CVE-2019-0199 CVE-2019-3868 CVE-2019-3875 \n CVE-2019-10199 CVE-2019-10201 CVE-2019-14832 \n=====================================================================\n\n1. Summary:\n\nAn update is now available for Red Hat OpenShift Application Runtimes. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n[NOTE: This security advisory was unintentionally omitted at the time of\nthe initial software release on 2020-02-18. The advisory is informational\nonly; no files in the release have changed.]\n\n2. Description:\n\nRed Hat support for Spring Boot provides an application platform that\nreduces the complexity of developing and operating applications (monoliths\nand microservices) for OpenShift as a containerized platform. \n\nThis release of Red Hat support for Spring Boot 2.1.12 serves as a\nreplacement for Red Hat support for Spring Boot 2.1.6, and includes\nsecurity and bug fixes and enhancements. For further information, refer to\nthe release notes linked to in the References section. \n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\n* keycloak: SAML broker does not check existence of signature on document\nallowing any user impersonation (CVE-2019-10201)\n\n* keycloak: session hijack using the user access token (CVE-2019-3868)\n\n* keycloak: missing signatures validation on CRL used to verify client\ncertificates (CVE-2019-3875)\n\n* keycloak: CSRF check missing in My Resources functionality in the Account\nConsole (CVE-2019-10199)\n\n* keycloak: cross-realm user access auth bypass (CVE-2019-14832)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n3. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). \n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1679144 - CVE-2019-3868 keycloak: session hijack using the user access token\n1690628 - CVE-2019-3875 keycloak: missing signatures validation on CRL used to verify client certificates\n1693325 - CVE-2019-0199 tomcat: Apache Tomcat HTTP/2 DoS\n1728609 - CVE-2019-10201 keycloak: SAML broker does not check existence of signature on document allowing any user impersonation\n1729261 - CVE-2019-10199 keycloak: CSRF check missing in My Resources functionality in the Account Console\n1749487 - CVE-2019-14832 keycloak: cross-realm user access auth bypass\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2019-0199\nhttps://access.redhat.com/security/cve/CVE-2019-3868\nhttps://access.redhat.com/security/cve/CVE-2019-3875\nhttps://access.redhat.com/security/cve/CVE-2019-10199\nhttps://access.redhat.com/security/cve/CVE-2019-10201\nhttps://access.redhat.com/security/cve/CVE-2019-14832\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot\u0026downloadType=distributions\u0026version=2.1.12\nhttps://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXtjx9tzjgjWX9erEAQhFOA//Tkk46vAF4/aJiKVApEHvF5R96081W2Hq\nG96k3lUPuatTrcD/2yek9whs1Bf9MQgWcaFWCgx63nsNs6Mm81frsR/dt4YV8mWc\n97y4u6kz6nvQQ6Wz6Xuic9km17/yXuNl5JqgmcLtltgNhtWgZhpQUKfbP3ot0T2X\nFStJvnZlPrgDnpnVZ8y6x++otaDfbXGiy2FyGepXei8WWxXtQ/XYPoQC/mYbuXgM\neUNsFLEyY9hWLCE4vfavLCM4fHs+djrL2E6N431JhpLyCrbTx0nYkaMkoOoJlLe2\nagJjBzd5iYnBbD6p9K5okIWR1U2gNsdV6Q7UROTLiEFoxBOr1hO1mzqYkJ80t1Pm\nd48N7OuQ4MhYgiKftVDmsVgXuQzySUrjZWnZZnDbVZo02gwD8T1NXgq9zCX64/sl\nucKvbDnnmLDYQYsKRCjf1aH1ZDrrPOPIOkTbMlb4+Wqc/O8jrRfzvya0ym9wnN8v\nCG3VmxPBPeNgp6/pmTBrJU9c+dER9qmavAB77Vl09dH88V9Ne4GLiVfqSVOEhY1w\nvwZo31fNXNYFYT/NV2v9CiZwrRcsqn60VH0E4Qc+zTOb5esR7bIidcBMGtPm+BI0\n80uR7D6DwjVmZsfzwakCIiGMaChysonql+P72iOd2Xerj7osdvMSEQHSVSjuILh7\nwiv1ksQVw/s=\n=pUHq\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-0199"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003375"
},
{
"db": "CNVD",
"id": "CNVD-2019-15086"
},
{
"db": "BID",
"id": "107674"
},
{
"db": "VULMON",
"id": "CVE-2019-0199"
},
{
"db": "PACKETSTORM",
"id": "155792"
},
{
"db": "PACKETSTORM",
"id": "157964"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-0199",
"trust": 3.6
},
{
"db": "BID",
"id": "107674",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003375",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "155792",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "157964",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-15086",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.2230",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.1958",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.0980",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.4405",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.0014",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.2295",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.1966",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.1983",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201903-919",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2019-0199",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-15086"
},
{
"db": "VULMON",
"id": "CVE-2019-0199"
},
{
"db": "BID",
"id": "107674"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003375"
},
{
"db": "PACKETSTORM",
"id": "155792"
},
{
"db": "PACKETSTORM",
"id": "157964"
},
{
"db": "NVD",
"id": "CVE-2019-0199"
},
{
"db": "CNNVD",
"id": "CNNVD-201903-919"
}
]
},
"id": "VAR-201904-1069",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-15086"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-15086"
}
]
},
"last_update_date": "2023-12-18T11:09:51.022000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"trust": 0.8,
"url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3cdev.tomcat.apache.org%3e"
},
{
"title": "svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"trust": 0.8,
"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3cdev.tomcat.apache.org%3e"
},
{
"title": "svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"trust": 0.8,
"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3cdev.tomcat.apache.org%3e"
},
{
"title": "[SECURITY] CVE-2019-0199 Apache Tomcat HTTP/2 DoS",
"trust": 0.8,
"url": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3cannounce.tomcat.apache.org%3e"
},
{
"title": "svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"trust": 0.8,
"url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3cdev.tomcat.apache.org%3e"
},
{
"title": "Patch for ApacheTomcat Resource Management Error Vulnerability (CNVD-2019-15086)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/161993"
},
{
"title": "Apache Tomcat Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=90371"
},
{
"title": "Debian CVElist Bug Report Logs: tomcat9: CVE-2019-10072",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=7966741ad75ea9ed4ce251ef47c32196"
},
{
"title": "Ubuntu Security Notice: tomcat9 vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-4128-2"
},
{
"title": "Ubuntu Security Notice: tomcat8 vulnerabilities",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-4128-1"
},
{
"title": "Red Hat: Moderate: Red Hat JBoss Web Server 5.2 security release",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20193929 - security advisory"
},
{
"title": "Amazon Linux AMI: ALAS-2019-1234",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=alas-2019-1234"
},
{
"title": "IBM: Security Bulletin: CVE-2019-10072",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=4cfa73e64dc3855ace71ce18bac6fba2"
},
{
"title": "IBM: IBM Security Bulletin: Apache Tomcat as used in IBM QRadar SIEM is vulnerable to denial of service (CVE-2019-0199)",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=2579e74a8148d49567b550a034c8f808"
},
{
"title": "Amazon Linux AMI: ALAS-2019-1208",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=alas-2019-1208"
},
{
"title": "IBM: IBM Security Bulletin: IBM WebSphere Cast Iron Solution \u0026 App Connect Professional is affected by Apache Tomcat vulnerabilities.",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=6a3950e54c50353235e3e8004916f871"
},
{
"title": "Red Hat: Moderate: Red Hat JBoss Web Server 5.2 security release",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20193931 - security advisory"
},
{
"title": "Debian Security Advisories: DSA-4596-1 tomcat8 -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=4cb7c55b01cbf593c9c3969d59695c8a"
},
{
"title": "tool",
"trust": 0.1,
"url": "https://github.com/mal-lol-git/tool "
},
{
"title": "AwareIM-resources",
"trust": 0.1,
"url": "https://github.com/rennurapps/awareim-resources "
},
{
"title": "cybsec",
"trust": 0.1,
"url": "https://github.com/ilmari666/cybsec "
},
{
"title": "cybersecuritybase-project",
"trust": 0.1,
"url": "https://github.com/mikademo/cybersecuritybase-project "
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-15086"
},
{
"db": "VULMON",
"id": "CVE-2019-0199"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003375"
},
{
"db": "CNNVD",
"id": "CNNVD-201903-919"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-400",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003375"
},
{
"db": "NVD",
"id": "CVE-2019-0199"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-0199"
},
{
"trust": 1.9,
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"trust": 1.7,
"url": "https://security.netapp.com/advisory/ntap-20190419-0001/"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/107674"
},
{
"trust": 1.6,
"url": "https://access.redhat.com/errata/rhsa-2019:3929"
},
{
"trust": 1.6,
"url": "https://access.redhat.com/errata/rhsa-2019:3931"
},
{
"trust": 1.6,
"url": "https://www.debian.org/security/2019/dsa-4596"
},
{
"trust": 1.0,
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html"
},
{
"trust": 1.0,
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html"
},
{
"trust": 1.0,
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3cusers.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3cusers.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3cannounce.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3cannounce.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3cannounce.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3cannounce.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3cannounce.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3ccommits.tomee.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3cusers.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3cdev.tomcat.apache.org%3e"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/nphqel5aq6lzszd2y6tyz4rc3wi7nxj3/"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/zqtz5bj5f4kv6n53sgnksw3uy5dbiq46/"
},
{
"trust": 1.0,
"url": "https://seclists.org/bugtraq/2019/dec/43"
},
{
"trust": 1.0,
"url": "https://support.f5.com/csp/article/k17321505"
},
{
"trust": 1.0,
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"trust": 1.0,
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"trust": 0.9,
"url": "http://tomcat.apache.org/security-8.html"
},
{
"trust": 0.9,
"url": "http://tomcat.apache.org/security-9.html"
},
{
"trust": 0.9,
"url": "http://tomcat.apache.org/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0199"
},
{
"trust": 0.7,
"url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3cdev.tomcat.apache.org%3e"
},
{
"trust": 0.7,
"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3cdev.tomcat.apache.org%3e"
},
{
"trust": 0.7,
"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3cdev.tomcat.apache.org%3e"
},
{
"trust": 0.7,
"url": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3cannounce.tomcat.apache.org%3e"
},
{
"trust": 0.7,
"url": "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e@%3ccommits.tomee.apache.org%3e"
},
{
"trust": 0.7,
"url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3cdev.tomcat.apache.org%3e"
},
{
"trust": 0.6,
"url": "https://www.mail-archive.com/dev"
},
{
"trust": 0.6,
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10886317"
},
{
"trust": 0.6,
"url": "https://www.mail-archive.com/users@tomcat.apache.org/msg132248.html"
},
{
"trust": 0.6,
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10885114"
},
{
"trust": 0.6,
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191693-1.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.4405/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/155792/debian-security-advisory-4596-1.html"
},
{
"trust": 0.6,
"url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10886317"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.2230/"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/apache-tomcat-denial-of-service-via-http-2-frames-28842"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.0014/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.2295/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/157964/red-hat-security-advisory-2020-2366-01.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.1958/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/77766"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.1966/"
},
{
"trust": 0.6,
"url": "http-2-implementation-in-embded-apache-tomcat-denial-of-service-vulnerability/"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-cve-2019-0199-the-"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.1983/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/400.html"
},
{
"trust": 0.1,
"url": "https://www.rapid7.com/db/vulnerabilities/apache-tomcat-cve-2019-0199"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://usn.ubuntu.com/4128-2/"
},
{
"trust": 0.1,
"url": "https://tools.cisco.com/security/center/viewalert.x?alertid=59989"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-17563"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-8014"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-0221"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/tomcat8"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-12418"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-11784"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-3875"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-14832"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-10201"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2020:2366"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=catrhoar.spring.boot\u0026downloadtype=distributions\u0026version=2.1.12"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-3868"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-0199"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-10201"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-3875"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.1,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-3868"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-14832"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-10199"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2019-10199"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-15086"
},
{
"db": "VULMON",
"id": "CVE-2019-0199"
},
{
"db": "BID",
"id": "107674"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003375"
},
{
"db": "PACKETSTORM",
"id": "155792"
},
{
"db": "PACKETSTORM",
"id": "157964"
},
{
"db": "NVD",
"id": "CVE-2019-0199"
},
{
"db": "CNNVD",
"id": "CNNVD-201903-919"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-15086"
},
{
"db": "VULMON",
"id": "CVE-2019-0199"
},
{
"db": "BID",
"id": "107674"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-003375"
},
{
"db": "PACKETSTORM",
"id": "155792"
},
{
"db": "PACKETSTORM",
"id": "157964"
},
{
"db": "NVD",
"id": "CVE-2019-0199"
},
{
"db": "CNNVD",
"id": "CNNVD-201903-919"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-05-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-15086"
},
{
"date": "2019-04-10T00:00:00",
"db": "VULMON",
"id": "CVE-2019-0199"
},
{
"date": "2019-02-08T00:00:00",
"db": "BID",
"id": "107674"
},
{
"date": "2019-05-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-003375"
},
{
"date": "2019-12-30T18:38:42",
"db": "PACKETSTORM",
"id": "155792"
},
{
"date": "2020-06-05T18:32:22",
"db": "PACKETSTORM",
"id": "157964"
},
{
"date": "2019-04-10T15:29:00.390000",
"db": "NVD",
"id": "CVE-2019-0199"
},
{
"date": "2019-03-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201903-919"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-05-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-15086"
},
{
"date": "2019-05-28T00:00:00",
"db": "VULMON",
"id": "CVE-2019-0199"
},
{
"date": "2019-07-17T09:00:00",
"db": "BID",
"id": "107674"
},
{
"date": "2019-05-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-003375"
},
{
"date": "2023-12-08T16:41:18.860000",
"db": "NVD",
"id": "CVE-2019-0199"
},
{
"date": "2020-06-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201903-919"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201903-919"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apache Tomcat Vulnerable to resource exhaustion",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-003375"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201903-919"
}
],
"trust": 0.6
}
}
wid-sec-w-2024-0528
Vulnerability from csaf_certbund
Published
2024-02-29 23:00
Modified
2024-02-29 23:00
Summary
Dell Data Protection Advisor: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Data Protection Advisor ist eine Monitoring Lösung. Der Collector ist der lokale Agent.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.
Betroffene Betriebssysteme
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Data Protection Advisor ist eine Monitoring L\u00f6sung. Der Collector ist der lokale Agent.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-0528 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0528.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-0528 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0528"
},
{
"category": "external",
"summary": "Dell Security Advisory DSA-2024-107 vom 2024-02-29",
"url": "https://www.dell.com/support/kbdoc/000222618/dsa-2024-="
}
],
"source_lang": "en-US",
"title": "Dell Data Protection Advisor: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2024-02-29T23:00:00.000+00:00",
"generator": {
"date": "2024-03-01T12:07:07.687+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.0"
}
},
"id": "WID-SEC-W-2024-0528",
"initial_release_date": "2024-02-29T23:00:00.000+00:00",
"revision_history": [
{
"date": "2024-02-29T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 19.10",
"product": {
"name": "Dell Data Protection Advisor \u003c 19.10",
"product_id": "T033198",
"product_identification_helper": {
"cpe": "cpe:/a:dell:data_protection_advisor:19.10"
}
}
}
],
"category": "product_name",
"name": "Data Protection Advisor"
}
],
"category": "vendor",
"name": "Dell"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-45648",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-45648"
},
{
"cve": "CVE-2023-42795",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-42795"
},
{
"cve": "CVE-2023-41080",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-41080"
},
{
"cve": "CVE-2023-34055",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-34055"
},
{
"cve": "CVE-2023-28708",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-28708"
},
{
"cve": "CVE-2023-28154",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-28154"
},
{
"cve": "CVE-2023-22081",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-22081"
},
{
"cve": "CVE-2023-22067",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-22067"
},
{
"cve": "CVE-2023-22025",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-22025"
},
{
"cve": "CVE-2023-20883",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-20883"
},
{
"cve": "CVE-2023-20873",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-20873"
},
{
"cve": "CVE-2023-20863",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-20863"
},
{
"cve": "CVE-2023-20861",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2023-20861"
},
{
"cve": "CVE-2022-46175",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-46175"
},
{
"cve": "CVE-2022-41854",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-41854"
},
{
"cve": "CVE-2022-38752",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-38752"
},
{
"cve": "CVE-2022-38751",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-38751"
},
{
"cve": "CVE-2022-38750",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-38750"
},
{
"cve": "CVE-2022-38749",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-38749"
},
{
"cve": "CVE-2022-37603",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-37603"
},
{
"cve": "CVE-2022-37601",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-37601"
},
{
"cve": "CVE-2022-37599",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-37599"
},
{
"cve": "CVE-2022-31129",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-31129"
},
{
"cve": "CVE-2022-27772",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-27772"
},
{
"cve": "CVE-2022-25881",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-25881"
},
{
"cve": "CVE-2022-25858",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-25858"
},
{
"cve": "CVE-2022-22971",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-22971"
},
{
"cve": "CVE-2022-22970",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-22970"
},
{
"cve": "CVE-2022-22968",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-22968"
},
{
"cve": "CVE-2022-22965",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-22965"
},
{
"cve": "CVE-2022-22950",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2022-22950"
},
{
"cve": "CVE-2021-43980",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2021-43980"
},
{
"cve": "CVE-2021-33037",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2021-33037"
},
{
"cve": "CVE-2021-30640",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2021-30640"
},
{
"cve": "CVE-2020-5421",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2020-5421"
},
{
"cve": "CVE-2020-1938",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2020-1938"
},
{
"cve": "CVE-2020-1935",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2020-1935"
},
{
"cve": "CVE-2020-13943",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2020-13943"
},
{
"cve": "CVE-2020-13935",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2020-13935"
},
{
"cve": "CVE-2020-13934",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2020-13934"
},
{
"cve": "CVE-2020-11996",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2020-11996"
},
{
"cve": "CVE-2019-2684",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2019-2684"
},
{
"cve": "CVE-2019-17563",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2019-17563"
},
{
"cve": "CVE-2019-12418",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2019-12418"
},
{
"cve": "CVE-2019-10072",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2019-10072"
},
{
"cve": "CVE-2019-0232",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2019-0232"
},
{
"cve": "CVE-2019-0221",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2019-0221"
},
{
"cve": "CVE-2019-0199",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2019-0199"
},
{
"cve": "CVE-2018-8037",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-8037"
},
{
"cve": "CVE-2018-8034",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-8034"
},
{
"cve": "CVE-2018-8014",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-8014"
},
{
"cve": "CVE-2018-15756",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-15756"
},
{
"cve": "CVE-2018-1336",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-1336"
},
{
"cve": "CVE-2018-1305",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-1305"
},
{
"cve": "CVE-2018-1304",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-1304"
},
{
"cve": "CVE-2018-1275",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-1275"
},
{
"cve": "CVE-2018-1272",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-1272"
},
{
"cve": "CVE-2018-1271",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-1271"
},
{
"cve": "CVE-2018-1270",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-1270"
},
{
"cve": "CVE-2018-1257",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-1257"
},
{
"cve": "CVE-2018-1199",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-1199"
},
{
"cve": "CVE-2018-1196",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-1196"
},
{
"cve": "CVE-2018-11784",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-11784"
},
{
"cve": "CVE-2018-11040",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-11040"
},
{
"cve": "CVE-2018-11039",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2018-11039"
},
{
"cve": "CVE-2017-8046",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2017-8046"
},
{
"cve": "CVE-2017-7675",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2017-7675"
},
{
"cve": "CVE-2017-7674",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2017-7674"
},
{
"cve": "CVE-2017-5664",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2017-5664"
},
{
"cve": "CVE-2017-5651",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2017-5651"
},
{
"cve": "CVE-2017-5650",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2017-5650"
},
{
"cve": "CVE-2017-5648",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2017-5648"
},
{
"cve": "CVE-2017-5647",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2017-5647"
},
{
"cve": "CVE-2017-18640",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2017-18640"
},
{
"cve": "CVE-2017-12617",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2017-12617"
},
{
"cve": "CVE-2016-9878",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2016-9878"
},
{
"cve": "CVE-2016-8745",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2016-8745"
},
{
"cve": "CVE-2016-8735",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2016-8735"
},
{
"cve": "CVE-2016-6817",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2016-6817"
},
{
"cve": "CVE-2016-6816",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
}
],
"release_date": "2024-02-29T23:00:00Z",
"title": "CVE-2016-6816"
}
]
}
rhsa-2019_3929
Vulnerability from csaf_redhat
Published
2019-11-20 16:08
Modified
2024-09-16 02:40
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release
Notes
Topic
Updated Red Hat JBoss Web Server 5.2.0 packages are now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 5.2 serves as a replacement for Red Hat JBoss Web Server 5.1, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.
Security Fix(es):
* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)
* openssl: 0-byte record padding oracle (CVE-2019-1559)
* tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199 (CVE-2019-10072)
* tomcat: XSS in SSI printenv (CVE-2019-0221)
* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated Red Hat JBoss Web Server 5.2.0 packages are now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 5.2 serves as a replacement for Red Hat JBoss Web Server 5.1, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.\n\nSecurity Fix(es):\n\n* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)\n\n* openssl: 0-byte record padding oracle (CVE-2019-1559)\n\n* tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199 (CVE-2019-10072)\n\n* tomcat: XSS in SSI printenv (CVE-2019-0221)\n\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2019:3929",
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.2/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.2/"
},
{
"category": "external",
"summary": "1645695",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695"
},
{
"category": "external",
"summary": "1683804",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804"
},
{
"category": "external",
"summary": "1693325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693325"
},
{
"category": "external",
"summary": "1713275",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713275"
},
{
"category": "external",
"summary": "1723708",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1723708"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2019/rhsa-2019_3929.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release",
"tracking": {
"current_release_date": "2024-09-16T02:40:13+00:00",
"generator": {
"date": "2024-09-16T02:40:13+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2019:3929",
"initial_release_date": "2019-11-20T16:08:26+00:00",
"revision_history": [
{
"date": "2019-11-20T16:08:26+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-12-02T16:26:41+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-16T02:40:13+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product": {
"name": "Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product": {
"name": "Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 5.2 for RHEL 8",
"product": {
"name": "Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
},
{
"branches": [
{
"category": "product_version",
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"product": {
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"product_id": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el7jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"product": {
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"product_id": "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el7jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"product": {
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"product_id": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el7jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"product": {
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"product_id": "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el7jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"product": {
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"product_id": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el7jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"product": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"product_id": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el7jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"product": {
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"product_id": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el7jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"product": {
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"product_id": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el6jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"product": {
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"product_id": "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el6jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"product": {
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"product_id": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el6jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"product": {
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"product_id": "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el6jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"product": {
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"product_id": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el6jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"product": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"product_id": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el6jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"product": {
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"product_id": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el6jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"product": {
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"product_id": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el8jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"product": {
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"product_id": "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el8jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"product": {
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"product_id": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el8jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"product": {
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"product_id": "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el8jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"product": {
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"product_id": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el8jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"product": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"product_id": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el8jws?arch=src"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"product": {
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"product_id": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el8jws?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"product": {
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"product_id": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"product": {
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"product_id": "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"product": {
"name": "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"product_id": "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-python-javapackages@3.4.1-5.15.11.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"product": {
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"product_id": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"product": {
"name": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"product_id": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-mod_cluster-tomcat@1.4.1-1.Final_redhat_00001.2.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"product": {
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"product_id": "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"product_id": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"product_id": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-vault-javadoc@1.1.8-1.Final_redhat_1.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_id": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_id": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.21-10.redhat_4.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_id": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.21-10.redhat_4.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_id": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.21-10.redhat_4.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_id": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.21-10.redhat_4.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.21-10.redhat_4.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_id": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.21-10.redhat_4.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_id": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.21-10.redhat_4.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.21-10.redhat_4.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product": {
"name": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_id": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.21-10.redhat_4.1.el7jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"product": {
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"product_id": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"product": {
"name": "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"product_id": "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-python-javapackages@3.4.1-5.15.11.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"product": {
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"product_id": "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"product": {
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"product_id": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"product": {
"name": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"product_id": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-mod_cluster-tomcat@1.4.1-1.Final_redhat_00001.2.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"product": {
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"product_id": "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"product": {
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"product_id": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"product": {
"name": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"product_id": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-vault-javadoc@1.1.8-1.Final_redhat_1.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product": {
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_id": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product": {
"name": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_id": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.21-10.redhat_4.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product": {
"name": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_id": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.21-10.redhat_4.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_id": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.21-10.redhat_4.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product": {
"name": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_id": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.21-10.redhat_4.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.21-10.redhat_4.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product": {
"name": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_id": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.21-10.redhat_4.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product": {
"name": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_id": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.21-10.redhat_4.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.21-10.redhat_4.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product": {
"name": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_id": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.21-10.redhat_4.1.el6jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"product": {
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"product_id": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"product": {
"name": "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"product_id": "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-python-javapackages@3.4.1-5.15.11.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"product": {
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"product_id": "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"product": {
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"product_id": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"product": {
"name": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"product_id": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-mod_cluster-tomcat@1.4.1-1.Final_redhat_00001.2.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"product": {
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"product_id": "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"product_id": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"product_id": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-vault-javadoc@1.1.8-1.Final_redhat_1.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_id": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_id": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.21-10.redhat_4.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_id": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.21-10.redhat_4.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_id": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.21-10.redhat_4.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_id": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.21-10.redhat_4.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_id": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.21-10.redhat_4.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_id": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-lib@9.0.21-10.redhat_4.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_id": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.21-10.redhat_4.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_id": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.21-10.redhat_4.1.el8jws?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product": {
"name": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_id": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.21-10.redhat_4.1.el8jws?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"product": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"product_id": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el7jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"product": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"product_id": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el7jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"product": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"product_id": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el6jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"product": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"product_id": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el6jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"product": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"product_id": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el8jws?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"product": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"product_id": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el8jws?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"product": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"product_id": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el6jws?arch=i686"
}
}
},
{
"category": "product_version",
"name": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"product": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"product_id": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el6jws?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch"
},
"product_reference": "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src"
},
"product_reference": "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch"
},
"product_reference": "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src"
},
"product_reference": "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch"
},
"product_reference": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src"
},
"product_reference": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch"
},
"product_reference": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src"
},
"product_reference": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch"
},
"product_reference": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch"
},
"product_reference": "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch"
},
"product_reference": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src"
},
"product_reference": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch"
},
"product_reference": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch"
},
"product_reference": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch"
},
"product_reference": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch"
},
"product_reference": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch"
},
"product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch"
},
"product_reference": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686"
},
"product_reference": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src"
},
"product_reference": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64"
},
"product_reference": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686"
},
"product_reference": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64"
},
"product_reference": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch"
},
"product_reference": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch"
},
"product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch"
},
"product_reference": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src"
},
"product_reference": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch"
},
"product_reference": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server",
"product_id": "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch"
},
"product_reference": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"relates_to_product_reference": "6Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch"
},
"product_reference": "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src"
},
"product_reference": "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch"
},
"product_reference": "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src"
},
"product_reference": "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch"
},
"product_reference": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src"
},
"product_reference": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch"
},
"product_reference": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src"
},
"product_reference": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch"
},
"product_reference": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch"
},
"product_reference": "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src"
},
"product_reference": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src"
},
"product_reference": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64"
},
"product_reference": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64"
},
"product_reference": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src"
},
"product_reference": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server",
"product_id": "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch"
},
"product_reference": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"relates_to_product_reference": "7Server-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch"
},
"product_reference": "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src"
},
"product_reference": "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch"
},
"product_reference": "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src"
},
"product_reference": "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch"
},
"product_reference": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src"
},
"product_reference": "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch"
},
"product_reference": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src"
},
"product_reference": "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch"
},
"product_reference": "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch"
},
"product_reference": "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src"
},
"product_reference": "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src"
},
"product_reference": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64"
},
"product_reference": "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64"
},
"product_reference": "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src"
},
"product_reference": "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8",
"product_id": "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
},
"product_reference": "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"relates_to_product_reference": "8Base-JWS-5.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Alejandro Cabrera Aldaya"
],
"organization": "Universidad Tecnologica de la Habana CUJAE; Cuba"
},
{
"names": [
"Billy Bob Brumley",
"Cesar Pereida Garcia",
"Sohaib ul Hassan"
]
},
{
"names": [
"Nicola Tuveri"
],
"organization": "Tampere University of Technology; Finland"
}
],
"cve": "CVE-2018-5407",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2018-11-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1645695"
}
],
"notes": [
{
"category": "description",
"text": "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-5407"
},
{
"category": "external",
"summary": "RHBZ#1645695",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-5407",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5407"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407"
},
{
"category": "external",
"summary": "https://github.com/bbbrumley/portsmash",
"url": "https://github.com/bbbrumley/portsmash"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20181112.txt",
"url": "https://www.openssl.org/news/secadv/20181112.txt"
}
],
"release_date": "2018-10-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
},
{
"category": "workaround",
"details": "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.",
"product_ids": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)"
},
{
"cve": "CVE-2019-0199",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2019-03-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1693325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat HTTP/2 DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "pki-servlet-container does not use HTTP/2 in its default configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-0199"
},
{
"category": "external",
"summary": "RHBZ#1693325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-0199",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-0199"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199"
}
],
"release_date": "2019-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Apache Tomcat HTTP/2 DoS"
},
{
"cve": "CVE-2019-0221",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2019-05-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1713275"
}
],
"notes": [
{
"category": "description",
"text": "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: XSS in SSI printenv",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-0221"
},
{
"category": "external",
"summary": "RHBZ#1713275",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713275"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-0221",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-0221"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221"
}
],
"release_date": "2019-04-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
},
{
"category": "workaround",
"details": "SSI is disabled in the default Tomcat configuration. The vulnerable printenv command is intended for debugging, and is recommended to not be enabled for a production website.",
"product_ids": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: XSS in SSI printenv"
},
{
"cve": "CVE-2019-0232",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2019-04-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1701056"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was discovered in Apache Tomcat, where a Java Runtime Environment can pass a command-line argument in the Windows operating system. The execution of arbitrary commands via Tomcat\u2019s Common Gateway Interface (CGI) Servlet, allows an attacker to perform remote code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Remote Code Execution on Windows",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is specific to the Windows platform\u0027s treatment of file names and how they must be quoted. Tomcat running on Linux hosts is not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-0232"
},
{
"category": "external",
"summary": "RHBZ#1701056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-0232",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-0232"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0232",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0232"
}
],
"release_date": "2019-04-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Remote Code Execution on Windows"
},
{
"cve": "CVE-2019-1559",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2019-02-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1683804"
}
],
"notes": [
{
"category": "description",
"text": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: 0-byte record padding oracle",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-1559"
},
{
"category": "external",
"summary": "RHBZ#1683804",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-1559",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1559"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559"
},
{
"category": "external",
"summary": "https://github.com/RUB-NDS/TLS-Padding-Oracles",
"url": "https://github.com/RUB-NDS/TLS-Padding-Oracles"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20190226.txt",
"url": "https://www.openssl.org/news/secadv/20190226.txt"
}
],
"release_date": "2019-02-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
},
{
"category": "workaround",
"details": "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.",
"product_ids": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: 0-byte record padding oracle"
},
{
"cve": "CVE-2019-10072",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2019-06-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1723708"
}
],
"notes": [
{
"category": "description",
"text": "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-10072"
},
{
"category": "external",
"summary": "RHBZ#1723708",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1723708"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-10072",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10072"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20",
"url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20"
}
],
"release_date": "2019-06-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
},
{
"category": "workaround",
"details": "pki-servlet-container does not use HTTP/2 in its default configuration.",
"product_ids": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src",
"6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch",
"6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686",
"6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64",
"6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src",
"6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch",
"6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src",
"7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch",
"7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64",
"7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src",
"7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch",
"7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src",
"8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch",
"8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64",
"8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src",
"8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch",
"8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199"
}
]
}
rhsa-2020_2366
Vulnerability from csaf_redhat
Published
2020-06-04 13:06
Modified
2024-09-13 19:58
Summary
Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update
Notes
Topic
An update is now available for Red Hat OpenShift Application Runtimes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
[NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-02-18. The advisory is informational only; no files in the release have changed.]
Details
Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform.
This release of Red Hat support for Spring Boot 2.1.12 serves as a replacement for Red Hat support for Spring Boot 2.1.6, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
* keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)
* keycloak: session hijack using the user access token (CVE-2019-3868)
* keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875)
* keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)
* keycloak: cross-realm user access auth bypass (CVE-2019-14832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat OpenShift Application Runtimes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\n[NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-02-18. The advisory is informational only; no files in the release have changed.]",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform.\n\nThis release of Red Hat support for Spring Boot 2.1.12 serves as a replacement for Red Hat support for Spring Boot 2.1.6, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\n* keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)\n\n* keycloak: session hijack using the user access token (CVE-2019-3868)\n\n* keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875)\n\n* keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)\n\n* keycloak: cross-realm user access auth bypass (CVE-2019-14832)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:2366",
"url": "https://access.redhat.com/errata/RHSA-2020:2366"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot\u0026downloadType=distributions\u0026version=2.1.12",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot\u0026downloadType=distributions\u0026version=2.1.12"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/",
"url": "https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/"
},
{
"category": "external",
"summary": "1679144",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1679144"
},
{
"category": "external",
"summary": "1690628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1690628"
},
{
"category": "external",
"summary": "1693325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693325"
},
{
"category": "external",
"summary": "1728609",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728609"
},
{
"category": "external",
"summary": "1729261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1729261"
},
{
"category": "external",
"summary": "1749487",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1749487"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2020/rhsa-2020_2366.json"
}
],
"title": "Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update",
"tracking": {
"current_release_date": "2024-09-13T19:58:28+00:00",
"generator": {
"date": "2024-09-13T19:58:28+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2020:2366",
"initial_release_date": "2020-06-04T13:06:31+00:00",
"revision_history": [
{
"date": "2020-06-04T13:06:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-06-04T13:06:31+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-13T19:58:28+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Runtimes Spring Boot 2.1.12",
"product": {
"name": "Red Hat Runtimes Spring Boot 2.1.12",
"product_id": "Red Hat Runtimes Spring Boot 2.1.12",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_application_runtimes:1.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Application Runtimes"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-0199",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2019-03-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1693325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat HTTP/2 DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "pki-servlet-container does not use HTTP/2 in its default configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-0199"
},
{
"category": "external",
"summary": "RHBZ#1693325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-0199",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-0199"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199"
}
],
"release_date": "2019-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Runtimes Spring Boot 2.1.12"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2366"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Apache Tomcat HTTP/2 DoS"
},
{
"acknowledgments": [
{
"names": [
"Caranzo Gideon",
"Muzamil Muein",
"Siddiqui Najam"
],
"organization": "Gemalto E\u0026C"
}
],
"cve": "CVE-2019-3868",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2019-02-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1679144"
}
],
"notes": [
{
"category": "description",
"text": "Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user\u2019s browser session.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak: session hijack using the user access token",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-3868"
},
{
"category": "external",
"summary": "RHBZ#1679144",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1679144"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-3868",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-3868"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3868",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3868"
}
],
"release_date": "2019-04-23T16:59:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Runtimes Spring Boot 2.1.12"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2366"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak: session hijack using the user access token"
},
{
"acknowledgments": [
{
"names": [
"Marek Posolda"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2019-3875",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2019-03-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1690628"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols (\u0027http\u0027 or \u0027ldap\u0027) and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn\u0027t validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak: missing signatures validation on CRL used to verify client certificates",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-3875"
},
{
"category": "external",
"summary": "RHBZ#1690628",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1690628"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-3875",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-3875"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3875",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3875"
}
],
"release_date": "2019-06-11T14:22:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Runtimes Spring Boot 2.1.12"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2366"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak: missing signatures validation on CRL used to verify client certificates"
},
{
"cve": "CVE-2019-10199",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2019-07-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1729261"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Keycloak\u0027s account console did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak: CSRF check missing in My Resources functionality in the Account Console",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-10199"
},
{
"category": "external",
"summary": "RHBZ#1729261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1729261"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-10199",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10199"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10199",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10199"
}
],
"release_date": "2019-08-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Runtimes Spring Boot 2.1.12"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2366"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak: CSRF check missing in My Resources functionality in the Account Console"
},
{
"cve": "CVE-2019-10201",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"discovery_date": "2019-07-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1728609"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Keycloak\u0027s SAML broker did not verify missing message signatures. If an attacker modifies the SAML Response and removes the \u003cSignature\u003e sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak: SAML broker does not check existence of signature on document allowing any user impersonation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-10201"
},
{
"category": "external",
"summary": "RHBZ#1728609",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728609"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-10201",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10201"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10201",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10201"
}
],
"release_date": "2019-08-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Runtimes Spring Boot 2.1.12"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2366"
},
{
"category": "workaround",
"details": "Administrator can prevent this issue for POST binding by requiring signed assertions.",
"product_ids": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
},
"products": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "keycloak: SAML broker does not check existence of signature on document allowing any user impersonation"
},
{
"cve": "CVE-2019-14832",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"discovery_date": "2019-07-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1749487"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "keycloak: cross-realm user access auth bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-14832"
},
{
"category": "external",
"summary": "RHBZ#1749487",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1749487"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-14832",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14832"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-14832",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14832"
}
],
"release_date": "2019-10-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
"product_ids": [
"Red Hat Runtimes Spring Boot 2.1.12"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:2366"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"Red Hat Runtimes Spring Boot 2.1.12"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "keycloak: cross-realm user access auth bypass"
}
]
}
rhsa-2019_3931
Vulnerability from csaf_redhat
Published
2019-11-20 16:04
Modified
2024-09-16 02:40
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release
Notes
Topic
Red Hat JBoss Web Server 5.2.0 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is available.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.
Security Fix(es):
* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)
* tomcat: XSS in SSI printenv (CVE-2019-0221)
* openssl: 0-byte record padding oracle (CVE-2019-1559)
* tomcat: HTTP/2 implementation leads to denial of service (CVE-2019-10072)
* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Web Server 5.2.0 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is available.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n \nRefer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.\n\nSecurity Fix(es):\n\n* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) \n* tomcat: XSS in SSI printenv (CVE-2019-0221) \n* openssl: 0-byte record padding oracle (CVE-2019-1559) \n* tomcat: HTTP/2 implementation leads to denial of service (CVE-2019-10072)\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2019:3931",
"url": "https://access.redhat.com/errata/RHSA-2019:3931"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1645695",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695"
},
{
"category": "external",
"summary": "1683804",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804"
},
{
"category": "external",
"summary": "1693325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693325"
},
{
"category": "external",
"summary": "1713275",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713275"
},
{
"category": "external",
"summary": "1723708",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1723708"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2019/rhsa-2019_3931.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release",
"tracking": {
"current_release_date": "2024-09-16T02:40:19+00:00",
"generator": {
"date": "2024-09-16T02:40:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2019:3931",
"initial_release_date": "2019-11-20T16:04:24+00:00",
"revision_history": [
{
"date": "2019-11-20T16:04:24+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-12-02T16:22:21+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-16T02:40:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Web Server 5",
"product": {
"name": "Red Hat JBoss Web Server 5",
"product_id": "Red Hat JBoss Web Server 5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Web Server"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Alejandro Cabrera Aldaya"
],
"organization": "Universidad Tecnologica de la Habana CUJAE; Cuba"
},
{
"names": [
"Billy Bob Brumley",
"Cesar Pereida Garcia",
"Sohaib ul Hassan"
]
},
{
"names": [
"Nicola Tuveri"
],
"organization": "Tampere University of Technology; Finland"
}
],
"cve": "CVE-2018-5407",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2018-11-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1645695"
}
],
"notes": [
{
"category": "description",
"text": "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-5407"
},
{
"category": "external",
"summary": "RHBZ#1645695",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-5407",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-5407"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407"
},
{
"category": "external",
"summary": "https://github.com/bbbrumley/portsmash",
"url": "https://github.com/bbbrumley/portsmash"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20181112.txt",
"url": "https://www.openssl.org/news/secadv/20181112.txt"
}
],
"release_date": "2018-10-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Web Server 5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:3931"
},
{
"category": "workaround",
"details": "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.",
"product_ids": [
"Red Hat JBoss Web Server 5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)"
},
{
"cve": "CVE-2019-0199",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2019-03-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1693325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat HTTP/2 DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "pki-servlet-container does not use HTTP/2 in its default configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-0199"
},
{
"category": "external",
"summary": "RHBZ#1693325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-0199",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-0199"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199"
}
],
"release_date": "2019-03-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Web Server 5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:3931"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: Apache Tomcat HTTP/2 DoS"
},
{
"cve": "CVE-2019-0221",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2019-05-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1713275"
}
],
"notes": [
{
"category": "description",
"text": "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: XSS in SSI printenv",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-0221"
},
{
"category": "external",
"summary": "RHBZ#1713275",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713275"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-0221",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-0221"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0221"
}
],
"release_date": "2019-04-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Web Server 5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:3931"
},
{
"category": "workaround",
"details": "SSI is disabled in the default Tomcat configuration. The vulnerable printenv command is intended for debugging, and is recommended to not be enabled for a production website.",
"product_ids": [
"Red Hat JBoss Web Server 5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: XSS in SSI printenv"
},
{
"cve": "CVE-2019-1559",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2019-02-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1683804"
}
],
"notes": [
{
"category": "description",
"text": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: 0-byte record padding oracle",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-1559"
},
{
"category": "external",
"summary": "RHBZ#1683804",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-1559",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1559"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559"
},
{
"category": "external",
"summary": "https://github.com/RUB-NDS/TLS-Padding-Oracles",
"url": "https://github.com/RUB-NDS/TLS-Padding-Oracles"
},
{
"category": "external",
"summary": "https://www.openssl.org/news/secadv/20190226.txt",
"url": "https://www.openssl.org/news/secadv/20190226.txt"
}
],
"release_date": "2019-02-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Web Server 5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:3931"
},
{
"category": "workaround",
"details": "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.",
"product_ids": [
"Red Hat JBoss Web Server 5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat JBoss Web Server 5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: 0-byte record padding oracle"
},
{
"cve": "CVE-2019-10072",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2019-06-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1723708"
}
],
"notes": [
{
"category": "description",
"text": "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Web Server 5"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-10072"
},
{
"category": "external",
"summary": "RHBZ#1723708",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1723708"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-10072",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10072"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41",
"url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41"
},
{
"category": "external",
"summary": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20",
"url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20"
}
],
"release_date": "2019-06-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat JBoss Web Server 5"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:3931"
},
{
"category": "workaround",
"details": "pki-servlet-container does not use HTTP/2 in its default configuration.",
"product_ids": [
"Red Hat JBoss Web Server 5"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"Red Hat JBoss Web Server 5"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199"
}
]
}
ghsa-qcxh-w3j9-58qr
Vulnerability from github
Published
2020-06-15 18:51
Modified
2023-12-08 22:47
Severity
Summary
Apache Tomcat Denial of Service vulnerability
Details
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.5.38"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-0199"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-15T16:43:54Z",
"nvd_published_at": "2019-04-10T15:29:00Z",
"severity": "HIGH"
},
"details": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.",
"id": "GHSA-qcxh-w3j9-58qr",
"modified": "2023-12-08T22:47:08Z",
"published": "2020-06-15T18:51:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0199"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e@%3Ccommits.tomee.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c@%3Cusers.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Dec/43"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190419-0001"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K17321505"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227030041/http://www.securityfocus.com/bid/107674"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4596"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3931"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6@%3Cusers.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067@%3Cusers.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50@%3Cdev.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9@%3Cannounce.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef@%3Cannounce.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600@%3Cannounce.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache Tomcat Denial of Service vulnerability"
}
gsd-2019-0199
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2019-0199",
"description": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.",
"id": "GSD-2019-0199",
"references": [
"https://www.suse.com/security/cve/CVE-2019-0199.html",
"https://www.debian.org/security/2019/dsa-4596",
"https://access.redhat.com/errata/RHSA-2020:2366",
"https://access.redhat.com/errata/RHSA-2019:3931",
"https://access.redhat.com/errata/RHSA-2019:3929",
"https://advisories.mageia.org/CVE-2019-0199.html",
"https://alas.aws.amazon.com/cve/html/CVE-2019-0199.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2019-0199"
],
"details": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.",
"id": "GSD-2019-0199",
"modified": "2023-12-13T01:23:39.102975Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2019-0199",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache Tomcat",
"version": {
"version_data": [
{
"version_value": "Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "DoS"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E",
"refsource": "MISC",
"url": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "https://security.netapp.com/advisory/ntap-20190419-0001/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20190419-0001/"
},
{
"name": "[tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e@%3Ccommits.tomee.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067@%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef@%3Cannounce.apache.org%3E"
},
{
"name": "[tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c@%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600@%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6@%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9@%3Cannounce.apache.org%3E"
},
{
"name": "FEDORA-2019-1a3f878d27",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/"
},
{
"name": "https://support.f5.com/csp/article/K17321505",
"refsource": "CONFIRM",
"url": "https://support.f5.com/csp/article/K17321505"
},
{
"name": "openSUSE-SU-2019:1673",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html"
},
{
"name": "FEDORA-2019-d66febb5df",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"refsource": "MISC",
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"name": "107674",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/107674"
},
{
"name": "openSUSE-SU-2019:1723",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html"
},
{
"name": "openSUSE-SU-2019:1808",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html"
},
{
"name": "RHSA-2019:3929",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
},
{
"name": "RHSA-2019:3931",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:3931"
},
{
"name": "DSA-4596",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2019/dsa-4596"
},
{
"name": "20191229 [SECURITY] [DSA 4596-1] tomcat8 security update",
"refsource": "BUGTRAQ",
"url": "https://seclists.org/bugtraq/2019/Dec/43"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E"
},
{
"name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"refsource": "MISC",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "[9.0.0,9.0.16),[8.0.0,8.5.38)",
"affected_versions": "All versions starting from 9.0.0 before 9.0.16, all versions starting from 8.0.0 before 8.5.38",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-400",
"CWE-937"
],
"date": "2021-08-30",
"description": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.",
"fixed_versions": [
"9.0.16",
"9.0.16"
],
"identifier": "CVE-2019-0199",
"identifiers": [
"GHSA-qcxh-w3j9-58qr",
"CVE-2019-0199"
],
"not_impacted": "All versions before 9.0.0, all versions starting from 9.0.16, all versions before 8.0.0, all versions starting from 8.5.38",
"package_slug": "maven/org.apache.tomcat.embed/tomcat-embed-core",
"pubdate": "2020-06-15",
"solution": "Upgrade to versions 9.0.16, 9.0.16 or above.",
"title": "Uncontrolled Resource Consumption",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2019-0199",
"https://access.redhat.com/errata/RHSA-2019:3929",
"https://access.redhat.com/errata/RHSA-2019:3931",
"https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6@%3Cusers.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067@%3Cusers.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9@%3Cannounce.apache.org%3E",
"https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef@%3Cannounce.apache.org%3E",
"https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600@%3Cannounce.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e@%3Ccommits.tomee.apache.org%3E",
"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c@%3Cusers.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/",
"https://seclists.org/bugtraq/2019/Dec/43",
"https://security.netapp.com/advisory/ntap-20190419-0001/",
"https://support.f5.com/csp/article/K17321505",
"https://www.debian.org/security/2019/dsa-4596",
"https://www.oracle.com/security-alerts/cpuapr2020.html",
"https://www.oracle.com/security-alerts/cpujan2020.html",
"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html",
"http://www.securityfocus.com/bid/107674",
"https://github.com/advisories/GHSA-qcxh-w3j9-58qr"
],
"uuid": "19804a66-65a8-4c72-848b-90d17b602a42"
},
{
"affected_range": "[8.5.0,8.5.37],[9.0.0.M1,9.0.14]",
"affected_versions": "All versions starting from 8.5.0 up to 8.5.37, all versions starting from 9.0.0.M1 up to 9.0.14",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-400",
"CWE-937"
],
"date": "2019-05-28",
"description": "The HTTP/2 implementation in Apache Tomcat accepted streams with excessive numbers of `SETTINGS` frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.",
"fixed_versions": [
"8.5.38",
"9.0.16"
],
"identifier": "CVE-2019-0199",
"identifiers": [
"CVE-2019-0199"
],
"not_impacted": "All versions before 8.5.0, all versions after 8.5.37 before 9.0.0.M1, all versions after 9.0.14",
"package_slug": "maven/org.apache.tomcat/tomcat-util",
"pubdate": "2019-04-10",
"solution": "Upgrade to versions 8.5.38, 9.0.16 or above.",
"title": "Uncontrolled Resource Consumption",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2019-0199"
],
"uuid": "f8f33450-a363-4e6a-8623-97f78eb8e090"
},
{
"affected_range": "[8.5.0,8.5.37],[9.0.0.M1,9.0.14]",
"affected_versions": "All versions starting from 8.5.0 up to 8.5.37, all versions starting from 9.0.0.M1 up to 9.0.14",
"cvss_v2": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-400",
"CWE-937"
],
"date": "2019-05-28",
"description": "The HTTP/2 implementation in Apache Tomcat accepted streams with excessive numbers of `SETTINGS` frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.",
"fixed_versions": [
"8.5.38",
"9.0.16"
],
"identifier": "CVE-2019-0199",
"identifiers": [
"CVE-2019-0199"
],
"not_impacted": "All versions before 8.5.0, all versions after 8.5.37 before 9.0.0.M1, all versions after 9.0.14",
"package_slug": "maven/org.apache.tomcat/tomcat",
"pubdate": "2019-04-10",
"solution": "Upgrade to versions 8.5.38, 9.0.16 or above.",
"title": "Uncontrolled Resource Consumption",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2019-0199"
],
"uuid": "8583efcf-fbee-4841-aed9-a9bdec997d8a"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "9.0.14",
"versionStartIncluding": "9.0.1",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "8.5.37",
"versionStartIncluding": "8.5.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2019-0199"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API\u0027s blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://security.netapp.com/advisory/ntap-20190419-0001/",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20190419-0001/"
},
{
"name": "https://support.f5.com/csp/article/K17321505",
"refsource": "CONFIRM",
"tags": [],
"url": "https://support.f5.com/csp/article/K17321505"
},
{
"name": "openSUSE-SU-2019:1673",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html"
},
{
"name": "107674",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/107674"
},
{
"name": "RHSA-2019:3929",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2019:3929"
},
{
"name": "RHSA-2019:3931",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2019:3931"
},
{
"name": "DSA-4596",
"refsource": "DEBIAN",
"tags": [],
"url": "https://www.debian.org/security/2019/dsa-4596"
},
{
"name": "20191229 [SECURITY] [DSA 4596-1] tomcat8 security update",
"refsource": "BUGTRAQ",
"tags": [],
"url": "https://seclists.org/bugtraq/2019/Dec/43"
},
{
"name": "https://www.oracle.com/security-alerts/cpujan2020.html",
"refsource": "MISC",
"tags": [],
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"name": "N/A",
"refsource": "N/A",
"tags": [],
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"name": "openSUSE-SU-2019:1808",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html"
},
{
"name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"refsource": "MISC",
"tags": [],
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"name": "openSUSE-SU-2019:1723",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html"
},
{
"name": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E"
},
{
"name": "[tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E"
},
{
"name": "[tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E"
},
{
"name": "[announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E"
},
{
"name": "FEDORA-2019-1a3f878d27",
"refsource": "",
"tags": [],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/"
},
{
"name": "FEDORA-2019-d66febb5df",
"refsource": "",
"tags": [],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E"
},
{
"name": "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/",
"refsource": "",
"tags": [],
"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
},
"lastModifiedDate": "2023-12-08T16:41Z",
"publishedDate": "2019-04-10T15:29Z"
}
}
}
Loading...