Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2019-0199
Vulnerability from cvelistv5
Published
2019-04-10 14:21
Modified
2024-08-04 17:44
Severity ?
EPSS score ?
Summary
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Apache Tomcat |
Version: Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37 |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T17:44:15.322Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20190419-0001/", }, { name: "[tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E", }, { name: "[tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E", }, { name: "[announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E", }, { name: "[tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E", }, { name: "[announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E", }, { name: "FEDORA-2019-1a3f878d27", tags: [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://support.f5.com/csp/article/K17321505", }, { name: "openSUSE-SU-2019:1673", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html", }, { name: "FEDORA-2019-d66febb5df", tags: [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", }, { name: "107674", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/107674", }, { name: "openSUSE-SU-2019:1723", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html", }, { name: "openSUSE-SU-2019:1808", tags: [ "vendor-advisory", "x_refsource_SUSE", "x_transferred", ], url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html", }, { name: "RHSA-2019:3929", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { name: "RHSA-2019:3931", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { name: "DSA-4596", tags: [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred", ], url: "https://www.debian.org/security/2019/dsa-4596", }, { name: "20191229 [SECURITY] [DSA 4596-1] tomcat8 security update", tags: [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred", ], url: "https://seclists.org/bugtraq/2019/Dec/43", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpujan2020.html", }, { name: "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "Apache Tomcat", vendor: "n/a", versions: [ { status: "affected", version: "Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37", }, ], }, ], datePublic: "2019-03-25T00:00:00", descriptions: [ { lang: "en", value: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", }, ], problemTypes: [ { descriptions: [ { description: "DoS", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2020-04-15T21:06:48", orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09", shortName: "apache", }, references: [ { tags: [ "x_refsource_MISC", ], url: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://security.netapp.com/advisory/ntap-20190419-0001/", }, { name: "[tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E", }, { name: "[tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E", }, { name: "[announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E", }, { name: "[tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E", }, { name: "[announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E", }, { name: "FEDORA-2019-1a3f878d27", tags: [ "vendor-advisory", "x_refsource_FEDORA", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://support.f5.com/csp/article/K17321505", }, { name: "openSUSE-SU-2019:1673", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html", }, { name: "FEDORA-2019-d66febb5df", tags: [ "vendor-advisory", "x_refsource_FEDORA", ], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", }, { name: "107674", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/107674", }, { name: "openSUSE-SU-2019:1723", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html", }, { name: "openSUSE-SU-2019:1808", tags: [ "vendor-advisory", "x_refsource_SUSE", ], url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html", }, { name: "RHSA-2019:3929", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { name: "RHSA-2019:3931", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { name: "DSA-4596", tags: [ "vendor-advisory", "x_refsource_DEBIAN", ], url: "https://www.debian.org/security/2019/dsa-4596", }, { name: "20191229 [SECURITY] [DSA 4596-1] tomcat8 security update", tags: [ "mailing-list", "x_refsource_BUGTRAQ", ], url: "https://seclists.org/bugtraq/2019/Dec/43", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpujan2020.html", }, { name: "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E", }, { tags: [ "x_refsource_MISC", ], url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "security@apache.org", ID: "CVE-2019-0199", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Apache Tomcat", version: { version_data: [ { version_value: "Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "DoS", }, ], }, ], }, references: { reference_data: [ { name: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E", refsource: "MISC", url: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E", }, { name: "https://security.netapp.com/advisory/ntap-20190419-0001/", refsource: "CONFIRM", url: "https://security.netapp.com/advisory/ntap-20190419-0001/", }, { name: "[tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199", refsource: "MLIST", url: "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e@%3Ccommits.tomee.apache.org%3E", }, { name: "[tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067@%3Cusers.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094@%3Cdev.tomcat.apache.org%3E", }, { name: "[announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef@%3Cannounce.apache.org%3E", }, { name: "[tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml", refsource: "MLIST", url: "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c@%3Cusers.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600@%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6@%3Cusers.tomcat.apache.org%3E", }, { name: "[announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9@%3Cannounce.apache.org%3E", }, { name: "FEDORA-2019-1a3f878d27", refsource: "FEDORA", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/", }, { name: "https://support.f5.com/csp/article/K17321505", refsource: "CONFIRM", url: "https://support.f5.com/csp/article/K17321505", }, { name: "openSUSE-SU-2019:1673", refsource: "SUSE", url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html", }, { name: "FEDORA-2019-d66febb5df", refsource: "FEDORA", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/", }, { name: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", refsource: "MISC", url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", }, { name: "107674", refsource: "BID", url: "http://www.securityfocus.com/bid/107674", }, { name: "openSUSE-SU-2019:1723", refsource: "SUSE", url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html", }, { name: "openSUSE-SU-2019:1808", refsource: "SUSE", url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html", }, { name: "RHSA-2019:3929", refsource: "REDHAT", url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { name: "RHSA-2019:3931", refsource: "REDHAT", url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { name: "DSA-4596", refsource: "DEBIAN", url: "https://www.debian.org/security/2019/dsa-4596", }, { name: "20191229 [SECURITY] [DSA 4596-1] tomcat8 security update", refsource: "BUGTRAQ", url: "https://seclists.org/bugtraq/2019/Dec/43", }, { name: "https://www.oracle.com/security-alerts/cpujan2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpujan2020.html", }, { name: "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E", }, { name: "https://www.oracle.com/security-alerts/cpuapr2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09", assignerShortName: "apache", cveId: "CVE-2019-0199", datePublished: "2019-04-10T14:21:50", dateReserved: "2018-11-14T00:00:00", dateUpdated: "2024-08-04T17:44:15.322Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { fkie_nvd: { configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.5.0\", \"versionEndIncluding\": \"8.5.37\", \"matchCriteriaId\": \"E3E3F100-D467-4B40-B818-E0E915602B77\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"9.0.1\", \"versionEndIncluding\": \"9.0.14\", \"matchCriteriaId\": \"589790FC-75B6-41A6-92D3-D3A0EF93678C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*\", \"matchCriteriaId\": \"9D0689FE-4BC0-4F53-8C79-34B21F9B86C2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*\", \"matchCriteriaId\": \"89B129B2-FB6F-4EF9-BF12-E589A87996CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B6787B6-54A8-475E-BA1C-AB99334B2535\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*\", \"matchCriteriaId\": \"EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*\", \"matchCriteriaId\": \"E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*\", \"matchCriteriaId\": \"8A6DA0BE-908C-4DA8-A191-A0113235E99A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*\", \"matchCriteriaId\": \"39029C72-28B4-46A4-BFF5-EC822CFB2A4C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*\", \"matchCriteriaId\": \"1A2E05A3-014F-4C4D-81E5-88E725FBD6AD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*\", \"matchCriteriaId\": \"166C533C-0833-41D5-99B6-17A4FAB3CAF0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*\", \"matchCriteriaId\": \"D3768C60-21FA-4B92-B98C-C3A2602D1BC4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*\", \"matchCriteriaId\": \"DDD510FA-A2E4-4BAF-A0DE-F4E5777E9325\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*\", \"matchCriteriaId\": \"9F542E12-6BA8-4504-A494-DA83E7E19BD5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*\", \"matchCriteriaId\": \"C2409CC7-6A85-4A66-A457-0D62B9895DC1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*\", \"matchCriteriaId\": \"B392A7E5-4455-4B1C-8FAC-AE6DDC70689E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*\", \"matchCriteriaId\": \"C0C5F004-F7D8-45DB-B173-351C50B0EC16\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*\", \"matchCriteriaId\": \"D1902D2E-1896-4D3D-9E1C-3A675255072C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*\", \"matchCriteriaId\": \"49AAF4DF-F61D-47A8-8788-A21E317A145D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*\", \"matchCriteriaId\": \"454211D0-60A2-4661-AECA-4C0121413FEB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*\", \"matchCriteriaId\": \"0686F977-889F-4960-8E0B-7784B73A7F2D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*\", \"matchCriteriaId\": \"558703AE-DB5E-4DFF-B497-C36694DD7B24\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*\", \"matchCriteriaId\": \"ED6273F2-1165-47A4-8DD7-9E9B2472941B\"}]}]}]", descriptions: "[{\"lang\": \"en\", \"value\": \"The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.\"}, {\"lang\": \"es\", \"value\": \"La implementaci\\u00f3n HTTP/2 en Apache Tomcat desde 9.0.0.M1 hasta 9.0.14 y desde 8.5.0 hasta 8.5.37 aceptaba flujos con n\\u00fameros excesivos de tramas SETTINS y permit\\u00eda a los clientes mantener flujos abiertos sin datos de lectura/escritura o solicitud/respuesta. Manteniendo flujos abiertos para peticiones que utilizaban bloqueo I/O en el Servlet API\\u00b4s, los clientes eran capaces de hacer que los hilos (threads) del lado del servidor se bloquearan, provocando el agotamiento de los hilos y la denegaci\\u00f3n del servicio (DoS).\"}]", id: "CVE-2019-0199", lastModified: "2024-11-21T04:16:28.177", metrics: "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:N/I:N/A:P\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}", published: "2019-04-10T15:29:00.390", references: "[{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html\", \"source\": \"security@apache.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html\", \"source\": \"security@apache.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html\", \"source\": \"security@apache.org\"}, {\"url\": \"http://www.securityfocus.com/bid/107674\", \"source\": \"security@apache.org\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:3929\", \"source\": \"security@apache.org\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:3931\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/\", \"source\": \"security@apache.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/\", \"source\": \"security@apache.org\"}, {\"url\": \"https://seclists.org/bugtraq/2019/Dec/43\", \"source\": \"security@apache.org\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20190419-0001/\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://support.f5.com/csp/article/K17321505\", \"source\": \"security@apache.org\"}, {\"url\": \"https://www.debian.org/security/2019/dsa-4596\", \"source\": \"security@apache.org\"}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2020.html\", \"source\": \"security@apache.org\"}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2020.html\", \"source\": \"security@apache.org\"}, {\"url\": \"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html\", \"source\": \"security@apache.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/107674\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:3929\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:3931\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://seclists.org/bugtraq/2019/Dec/43\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20190419-0001/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://support.f5.com/csp/article/K17321505\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.debian.org/security/2019/dsa-4596\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]", sourceIdentifier: "security@apache.org", vulnStatus: "Modified", weaknesses: "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-400\"}]}]", }, nvd: "{\"cve\":{\"id\":\"CVE-2019-0199\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2019-04-10T15:29:00.390\",\"lastModified\":\"2024-11-21T04:16:28.177\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.\"},{\"lang\":\"es\",\"value\":\"La implementación HTTP/2 en Apache Tomcat desde 9.0.0.M1 hasta 9.0.14 y desde 8.5.0 hasta 8.5.37 aceptaba flujos con números excesivos de tramas SETTINS y permitía a los clientes mantener flujos abiertos sin datos de lectura/escritura o solicitud/respuesta. Manteniendo flujos abiertos para peticiones que utilizaban bloqueo I/O en el Servlet API´s, los clientes eran capaces de hacer que los hilos (threads) del lado del servidor se bloquearan, provocando el agotamiento de los hilos y la denegación del servicio (DoS).\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.5.0\",\"versionEndIncluding\":\"8.5.37\",\"matchCriteriaId\":\"E3E3F100-D467-4B40-B818-E0E915602B77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.1\",\"versionEndIncluding\":\"9.0.14\",\"matchCriteriaId\":\"589790FC-75B6-41A6-92D3-D3A0EF93678C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9D0689FE-4BC0-4F53-8C79-34B21F9B86C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*\",\"matchCriteriaId\":\"89B129B2-FB6F-4EF9-BF12-E589A87996CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B6787B6-54A8-475E-BA1C-AB99334B2535\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*\",\"matchCriteriaId\":\"EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*\",\"matchCriteriaId\":\"E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A6DA0BE-908C-4DA8-A191-A0113235E99A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*\",\"matchCriteriaId\":\"39029C72-28B4-46A4-BFF5-EC822CFB2A4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A2E05A3-014F-4C4D-81E5-88E725FBD6AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*\",\"matchCriteriaId\":\"166C533C-0833-41D5-99B6-17A4FAB3CAF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3768C60-21FA-4B92-B98C-C3A2602D1BC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*\",\"matchCriteriaId\":\"DDD510FA-A2E4-4BAF-A0DE-F4E5777E9325\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F542E12-6BA8-4504-A494-DA83E7E19BD5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2409CC7-6A85-4A66-A457-0D62B9895DC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*\",\"matchCriteriaId\":\"B392A7E5-4455-4B1C-8FAC-AE6DDC70689E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0C5F004-F7D8-45DB-B173-351C50B0EC16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1902D2E-1896-4D3D-9E1C-3A675255072C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*\",\"matchCriteriaId\":\"49AAF4DF-F61D-47A8-8788-A21E317A145D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*\",\"matchCriteriaId\":\"454211D0-60A2-4661-AECA-4C0121413FEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*\",\"matchCriteriaId\":\"0686F977-889F-4960-8E0B-7784B73A7F2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*\",\"matchCriteriaId\":\"558703AE-DB5E-4DFF-B497-C36694DD7B24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED6273F2-1165-47A4-8DD7-9E9B2472941B\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html\",\"source\":\"security@apache.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html\",\"source\":\"security@apache.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html\",\"source\":\"security@apache.org\"},{\"url\":\"http://www.securityfocus.com/bid/107674\",\"source\":\"security@apache.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3929\",\"source\":\"security@apache.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3931\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/\",\"source\":\"security@apache.org\"},{\"url\":\"https://seclists.org/bugtraq/2019/Dec/43\",\"source\":\"security@apache.org\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20190419-0001/\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.f5.com/csp/article/K17321505\",\"source\":\"security@apache.org\"},{\"url\":\"https://www.debian.org/security/2019/dsa-4596\",\"source\":\"security@apache.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2020.html\",\"source\":\"security@apache.org\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2020.html\",\"source\":\"security@apache.org\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html\",\"source\":\"security@apache.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/107674\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3929\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3931\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://seclists.org/bugtraq/2019/Dec/43\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20190419-0001/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.f5.com/csp/article/K17321505\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2019/dsa-4596\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}", }, }
fkie_cve-2019-0199
Vulnerability from fkie_nvd
Published
2019-04-10 15:29
Modified
2024-11-21 04:16
Severity ?
Summary
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| apache | tomcat | * | |
| apache | tomcat | * | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 | |
| apache | tomcat | 9.0.0 |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", matchCriteriaId: "E3E3F100-D467-4B40-B818-E0E915602B77", versionEndIncluding: "8.5.37", versionStartIncluding: "8.5.0", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", matchCriteriaId: "589790FC-75B6-41A6-92D3-D3A0EF93678C", versionEndIncluding: "9.0.14", versionStartIncluding: "9.0.1", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*", matchCriteriaId: "9D0689FE-4BC0-4F53-8C79-34B21F9B86C2", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*", matchCriteriaId: "89B129B2-FB6F-4EF9-BF12-E589A87996CF", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*", matchCriteriaId: "8B6787B6-54A8-475E-BA1C-AB99334B2535", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*", matchCriteriaId: "EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*", matchCriteriaId: "E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*", matchCriteriaId: "8A6DA0BE-908C-4DA8-A191-A0113235E99A", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*", matchCriteriaId: "39029C72-28B4-46A4-BFF5-EC822CFB2A4C", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*", matchCriteriaId: "1A2E05A3-014F-4C4D-81E5-88E725FBD6AD", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*", matchCriteriaId: "166C533C-0833-41D5-99B6-17A4FAB3CAF0", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*", matchCriteriaId: "D3768C60-21FA-4B92-B98C-C3A2602D1BC4", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*", matchCriteriaId: "DDD510FA-A2E4-4BAF-A0DE-F4E5777E9325", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*", matchCriteriaId: "9F542E12-6BA8-4504-A494-DA83E7E19BD5", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*", matchCriteriaId: "C2409CC7-6A85-4A66-A457-0D62B9895DC1", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*", matchCriteriaId: "B392A7E5-4455-4B1C-8FAC-AE6DDC70689E", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*", matchCriteriaId: "C0C5F004-F7D8-45DB-B173-351C50B0EC16", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*", matchCriteriaId: "D1902D2E-1896-4D3D-9E1C-3A675255072C", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*", matchCriteriaId: "49AAF4DF-F61D-47A8-8788-A21E317A145D", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*", matchCriteriaId: "454211D0-60A2-4661-AECA-4C0121413FEB", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*", matchCriteriaId: "0686F977-889F-4960-8E0B-7784B73A7F2D", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*", matchCriteriaId: "558703AE-DB5E-4DFF-B497-C36694DD7B24", vulnerable: true, }, { criteria: "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*", matchCriteriaId: "ED6273F2-1165-47A4-8DD7-9E9B2472941B", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", }, { lang: "es", value: "La implementación HTTP/2 en Apache Tomcat desde 9.0.0.M1 hasta 9.0.14 y desde 8.5.0 hasta 8.5.37 aceptaba flujos con números excesivos de tramas SETTINS y permitía a los clientes mantener flujos abiertos sin datos de lectura/escritura o solicitud/respuesta. Manteniendo flujos abiertos para peticiones que utilizaban bloqueo I/O en el Servlet API´s, los clientes eran capaces de hacer que los hilos (threads) del lado del servidor se bloquearan, provocando el agotamiento de los hilos y la denegación del servicio (DoS).", }, ], id: "CVE-2019-0199", lastModified: "2024-11-21T04:16:28.177", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, exploitabilityScore: 3.9, impactScore: 3.6, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2019-04-10T15:29:00.390", references: [ { source: "security@apache.org", url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html", }, { source: "security@apache.org", url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html", }, { source: "security@apache.org", url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html", }, { source: "security@apache.org", url: "http://www.securityfocus.com/bid/107674", }, { source: "security@apache.org", url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { source: "security@apache.org", url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E", }, { source: "security@apache.org", url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/", }, { source: "security@apache.org", url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/", }, { source: "security@apache.org", url: "https://seclists.org/bugtraq/2019/Dec/43", }, { source: "security@apache.org", tags: [ "Third Party Advisory", ], url: "https://security.netapp.com/advisory/ntap-20190419-0001/", }, { source: "security@apache.org", url: "https://support.f5.com/csp/article/K17321505", }, { source: "security@apache.org", url: "https://www.debian.org/security/2019/dsa-4596", }, { source: "security@apache.org", url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, { source: "security@apache.org", url: "https://www.oracle.com/security-alerts/cpujan2020.html", }, { source: "security@apache.org", url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/107674", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://seclists.org/bugtraq/2019/Dec/43", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://security.netapp.com/advisory/ntap-20190419-0001/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://support.f5.com/csp/article/K17321505", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://www.debian.org/security/2019/dsa-4596", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://www.oracle.com/security-alerts/cpujan2020.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", }, ], sourceIdentifier: "security@apache.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-400", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
opensuse-su-2024:11468-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
tomcat-9.0.36-8.4 on GA media
Notes
Title of the patch
tomcat-9.0.36-8.4 on GA media
Description of the patch
These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-11468
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "tomcat-9.0.36-8.4 on GA media", title: "Title of the patch", }, { category: "description", text: "These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.", title: "Description of the patch", }, { category: "details", text: "openSUSE-Tumbleweed-2024-11468", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11468-1.json", }, { category: "self", summary: "SUSE CVE CVE-2016-8745 page", url: "https://www.suse.com/security/cve/CVE-2016-8745/", }, { category: "self", summary: "SUSE CVE CVE-2017-12617 page", url: "https://www.suse.com/security/cve/CVE-2017-12617/", }, { category: "self", summary: "SUSE CVE CVE-2017-5647 page", url: "https://www.suse.com/security/cve/CVE-2017-5647/", }, { category: "self", summary: "SUSE CVE CVE-2017-5648 page", url: "https://www.suse.com/security/cve/CVE-2017-5648/", }, { category: "self", summary: "SUSE CVE CVE-2017-5664 page", url: "https://www.suse.com/security/cve/CVE-2017-5664/", }, { category: "self", summary: "SUSE CVE CVE-2018-11784 page", url: "https://www.suse.com/security/cve/CVE-2018-11784/", }, { category: "self", summary: "SUSE CVE CVE-2018-1336 page", url: "https://www.suse.com/security/cve/CVE-2018-1336/", }, { category: "self", summary: "SUSE CVE CVE-2018-8014 page", url: "https://www.suse.com/security/cve/CVE-2018-8014/", }, { category: "self", summary: "SUSE CVE CVE-2018-8034 page", url: "https://www.suse.com/security/cve/CVE-2018-8034/", }, { category: "self", summary: "SUSE CVE CVE-2018-8037 page", url: "https://www.suse.com/security/cve/CVE-2018-8037/", }, { category: "self", summary: "SUSE CVE CVE-2019-0199 page", url: "https://www.suse.com/security/cve/CVE-2019-0199/", }, { category: "self", summary: "SUSE CVE CVE-2019-0221 page", url: "https://www.suse.com/security/cve/CVE-2019-0221/", }, { category: "self", summary: "SUSE CVE CVE-2019-10072 page", url: "https://www.suse.com/security/cve/CVE-2019-10072/", }, { category: "self", summary: "SUSE CVE CVE-2019-12418 page", url: "https://www.suse.com/security/cve/CVE-2019-12418/", }, { category: "self", summary: "SUSE CVE CVE-2019-17563 page", url: "https://www.suse.com/security/cve/CVE-2019-17563/", }, { category: "self", summary: "SUSE CVE CVE-2019-17569 page", url: "https://www.suse.com/security/cve/CVE-2019-17569/", }, { category: "self", summary: "SUSE CVE CVE-2020-11996 page", url: "https://www.suse.com/security/cve/CVE-2020-11996/", }, { category: "self", summary: "SUSE CVE CVE-2020-13943 page", url: "https://www.suse.com/security/cve/CVE-2020-13943/", }, { category: "self", summary: "SUSE CVE CVE-2020-17527 page", url: "https://www.suse.com/security/cve/CVE-2020-17527/", }, { category: "self", summary: "SUSE CVE CVE-2020-1935 page", url: "https://www.suse.com/security/cve/CVE-2020-1935/", }, { category: "self", summary: "SUSE CVE CVE-2020-1938 page", url: "https://www.suse.com/security/cve/CVE-2020-1938/", }, { category: "self", summary: "SUSE CVE CVE-2020-9484 page", url: "https://www.suse.com/security/cve/CVE-2020-9484/", }, { category: "self", summary: "SUSE CVE CVE-2021-24122 page", url: "https://www.suse.com/security/cve/CVE-2021-24122/", }, { category: "self", summary: "SUSE CVE CVE-2021-25122 page", url: "https://www.suse.com/security/cve/CVE-2021-25122/", }, { category: "self", summary: "SUSE CVE CVE-2021-25329 page", url: "https://www.suse.com/security/cve/CVE-2021-25329/", }, ], title: "tomcat-9.0.36-8.4 on GA media", tracking: { current_release_date: "2024-06-15T00:00:00Z", generator: { date: "2024-06-15T00:00:00Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "openSUSE-SU-2024:11468-1", initial_release_date: "2024-06-15T00:00:00Z", revision_history: [ { date: "2024-06-15T00:00:00Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "tomcat-9.0.36-8.4.aarch64", product: { name: "tomcat-9.0.36-8.4.aarch64", product_id: "tomcat-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.36-8.4.aarch64", product: { name: "tomcat-admin-webapps-9.0.36-8.4.aarch64", product_id: "tomcat-admin-webapps-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.36-8.4.aarch64", product: { name: "tomcat-docs-webapp-9.0.36-8.4.aarch64", product_id: "tomcat-docs-webapp-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.36-8.4.aarch64", product: { name: "tomcat-el-3_0-api-9.0.36-8.4.aarch64", product_id: "tomcat-el-3_0-api-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-embed-9.0.36-8.4.aarch64", product: { name: "tomcat-embed-9.0.36-8.4.aarch64", product_id: "tomcat-embed-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.36-8.4.aarch64", product: { name: "tomcat-javadoc-9.0.36-8.4.aarch64", product_id: "tomcat-javadoc-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", product: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", product_id: "tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.36-8.4.aarch64", product: { name: "tomcat-jsvc-9.0.36-8.4.aarch64", product_id: "tomcat-jsvc-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-lib-9.0.36-8.4.aarch64", product: { name: "tomcat-lib-9.0.36-8.4.aarch64", product_id: "tomcat-lib-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", product: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", product_id: "tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-webapps-9.0.36-8.4.aarch64", product: { name: "tomcat-webapps-9.0.36-8.4.aarch64", product_id: "tomcat-webapps-9.0.36-8.4.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "tomcat-9.0.36-8.4.ppc64le", product: { name: "tomcat-9.0.36-8.4.ppc64le", product_id: "tomcat-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.36-8.4.ppc64le", product: { name: "tomcat-admin-webapps-9.0.36-8.4.ppc64le", product_id: "tomcat-admin-webapps-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.36-8.4.ppc64le", product: { name: "tomcat-docs-webapp-9.0.36-8.4.ppc64le", product_id: "tomcat-docs-webapp-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.36-8.4.ppc64le", product: { name: "tomcat-el-3_0-api-9.0.36-8.4.ppc64le", product_id: "tomcat-el-3_0-api-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-embed-9.0.36-8.4.ppc64le", product: { name: "tomcat-embed-9.0.36-8.4.ppc64le", product_id: "tomcat-embed-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.36-8.4.ppc64le", product: { name: "tomcat-javadoc-9.0.36-8.4.ppc64le", product_id: "tomcat-javadoc-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", product: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", product_id: "tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.36-8.4.ppc64le", product: { name: "tomcat-jsvc-9.0.36-8.4.ppc64le", product_id: "tomcat-jsvc-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-lib-9.0.36-8.4.ppc64le", product: { name: "tomcat-lib-9.0.36-8.4.ppc64le", product_id: "tomcat-lib-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", product: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", product_id: "tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-webapps-9.0.36-8.4.ppc64le", product: { name: "tomcat-webapps-9.0.36-8.4.ppc64le", product_id: "tomcat-webapps-9.0.36-8.4.ppc64le", }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "tomcat-9.0.36-8.4.s390x", product: { name: "tomcat-9.0.36-8.4.s390x", product_id: "tomcat-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.36-8.4.s390x", product: { name: "tomcat-admin-webapps-9.0.36-8.4.s390x", product_id: "tomcat-admin-webapps-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.36-8.4.s390x", product: { name: "tomcat-docs-webapp-9.0.36-8.4.s390x", product_id: "tomcat-docs-webapp-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.36-8.4.s390x", product: { name: "tomcat-el-3_0-api-9.0.36-8.4.s390x", product_id: "tomcat-el-3_0-api-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-embed-9.0.36-8.4.s390x", product: { name: "tomcat-embed-9.0.36-8.4.s390x", product_id: "tomcat-embed-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.36-8.4.s390x", product: { name: "tomcat-javadoc-9.0.36-8.4.s390x", product_id: "tomcat-javadoc-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.36-8.4.s390x", product: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.s390x", product_id: "tomcat-jsp-2_3-api-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.36-8.4.s390x", product: { name: "tomcat-jsvc-9.0.36-8.4.s390x", product_id: "tomcat-jsvc-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-lib-9.0.36-8.4.s390x", product: { name: "tomcat-lib-9.0.36-8.4.s390x", product_id: "tomcat-lib-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.36-8.4.s390x", product: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.s390x", product_id: "tomcat-servlet-4_0-api-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-webapps-9.0.36-8.4.s390x", product: { name: "tomcat-webapps-9.0.36-8.4.s390x", product_id: "tomcat-webapps-9.0.36-8.4.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "tomcat-9.0.36-8.4.x86_64", product: { name: "tomcat-9.0.36-8.4.x86_64", product_id: "tomcat-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.36-8.4.x86_64", product: { name: "tomcat-admin-webapps-9.0.36-8.4.x86_64", product_id: "tomcat-admin-webapps-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.36-8.4.x86_64", product: { name: "tomcat-docs-webapp-9.0.36-8.4.x86_64", product_id: "tomcat-docs-webapp-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.36-8.4.x86_64", product: { name: "tomcat-el-3_0-api-9.0.36-8.4.x86_64", product_id: "tomcat-el-3_0-api-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-embed-9.0.36-8.4.x86_64", product: { name: "tomcat-embed-9.0.36-8.4.x86_64", product_id: "tomcat-embed-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.36-8.4.x86_64", product: { name: "tomcat-javadoc-9.0.36-8.4.x86_64", product_id: "tomcat-javadoc-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", product: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", product_id: "tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.36-8.4.x86_64", product: { name: "tomcat-jsvc-9.0.36-8.4.x86_64", product_id: "tomcat-jsvc-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-lib-9.0.36-8.4.x86_64", product: { name: "tomcat-lib-9.0.36-8.4.x86_64", product_id: "tomcat-lib-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", product: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", product_id: "tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-webapps-9.0.36-8.4.x86_64", product: { name: "tomcat-webapps-9.0.36-8.4.x86_64", product_id: "tomcat-webapps-9.0.36-8.4.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "openSUSE Tumbleweed", product: { name: "openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed", product_identification_helper: { cpe: "cpe:/o:opensuse:tumbleweed", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "tomcat-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", }, product_reference: "tomcat-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", }, product_reference: "tomcat-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", }, product_reference: "tomcat-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", }, product_reference: "tomcat-admin-webapps-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-admin-webapps-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", }, product_reference: "tomcat-admin-webapps-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", }, product_reference: "tomcat-admin-webapps-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", }, product_reference: "tomcat-docs-webapp-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-docs-webapp-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", }, product_reference: "tomcat-docs-webapp-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", }, product_reference: "tomcat-docs-webapp-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", }, product_reference: "tomcat-el-3_0-api-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-el-3_0-api-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", }, product_reference: "tomcat-el-3_0-api-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", }, product_reference: "tomcat-el-3_0-api-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-embed-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", }, product_reference: "tomcat-embed-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-embed-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-embed-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-embed-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", }, product_reference: "tomcat-embed-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-embed-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", }, product_reference: "tomcat-embed-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", }, product_reference: "tomcat-javadoc-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-javadoc-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", }, product_reference: "tomcat-javadoc-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", }, product_reference: "tomcat-javadoc-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", }, product_reference: "tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", }, product_reference: "tomcat-jsp-2_3-api-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", }, product_reference: "tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsvc-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", }, product_reference: "tomcat-jsvc-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsvc-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-jsvc-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsvc-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", }, product_reference: "tomcat-jsvc-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsvc-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", }, product_reference: "tomcat-jsvc-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", }, product_reference: "tomcat-lib-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-lib-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", }, product_reference: "tomcat-lib-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", }, product_reference: "tomcat-lib-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", }, product_reference: "tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", }, product_reference: "tomcat-servlet-4_0-api-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", }, product_reference: "tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", }, product_reference: "tomcat-webapps-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-webapps-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", }, product_reference: "tomcat-webapps-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", }, product_reference: "tomcat-webapps-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, ], }, vulnerabilities: [ { cve: "CVE-2016-8745", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-8745", }, ], notes: [ { category: "general", text: "A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-8745", url: "https://www.suse.com/security/cve/CVE-2016-8745", }, { category: "external", summary: "SUSE Bug 1015119 for CVE-2016-8745", url: "https://bugzilla.suse.com/1015119", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2016-8745", }, { cve: "CVE-2017-12617", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-12617", }, ], notes: [ { category: "general", text: "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-12617", url: "https://www.suse.com/security/cve/CVE-2017-12617", }, { category: "external", summary: "SUSE Bug 1059554 for CVE-2017-12617", url: "https://bugzilla.suse.com/1059554", }, { category: "external", summary: "SUSE Bug 1062607 for CVE-2017-12617", url: "https://bugzilla.suse.com/1062607", }, { category: "external", summary: "SUSE Bug 1180947 for CVE-2017-12617", url: "https://bugzilla.suse.com/1180947", }, { category: "external", summary: "SUSE Bug 1189861 for CVE-2017-12617", url: "https://bugzilla.suse.com/1189861", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 9.8, baseSeverity: "CRITICAL", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2017-12617", }, { cve: "CVE-2017-5647", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-5647", }, ], notes: [ { category: "general", text: "A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-5647", url: "https://www.suse.com/security/cve/CVE-2017-5647", }, { category: "external", summary: "SUSE Bug 1033448 for CVE-2017-5647", url: "https://bugzilla.suse.com/1033448", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2017-5647", }, { cve: "CVE-2017-5648", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-5648", }, ], notes: [ { category: "general", text: "While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-5648", url: "https://www.suse.com/security/cve/CVE-2017-5648", }, { category: "external", summary: "SUSE Bug 1033447 for CVE-2017-5648", url: "https://bugzilla.suse.com/1033447", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 9.1, baseSeverity: "CRITICAL", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2017-5648", }, { cve: "CVE-2017-5664", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-5664", }, ], notes: [ { category: "general", text: "The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-5664", url: "https://www.suse.com/security/cve/CVE-2017-5664", }, { category: "external", summary: "SUSE Bug 1042910 for CVE-2017-5664", url: "https://bugzilla.suse.com/1042910", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2017-5664", }, { cve: "CVE-2018-11784", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-11784", }, ], notes: [ { category: "general", text: "When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-11784", url: "https://www.suse.com/security/cve/CVE-2018-11784", }, { category: "external", summary: "SUSE Bug 1110850 for CVE-2018-11784", url: "https://bugzilla.suse.com/1110850", }, { category: "external", summary: "SUSE Bug 1122212 for CVE-2018-11784", url: "https://bugzilla.suse.com/1122212", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.1, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-11784", }, { cve: "CVE-2018-1336", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-1336", }, ], notes: [ { category: "general", text: "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-1336", url: "https://www.suse.com/security/cve/CVE-2018-1336", }, { category: "external", summary: "SUSE Bug 1102400 for CVE-2018-1336", url: "https://bugzilla.suse.com/1102400", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2018-1336", }, { cve: "CVE-2018-8014", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-8014", }, ], notes: [ { category: "general", text: "The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-8014", url: "https://www.suse.com/security/cve/CVE-2018-8014", }, { category: "external", summary: "SUSE Bug 1093697 for CVE-2018-8014", url: "https://bugzilla.suse.com/1093697", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2018-8014", }, { cve: "CVE-2018-8034", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-8034", }, ], notes: [ { category: "general", text: "The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-8034", url: "https://www.suse.com/security/cve/CVE-2018-8034", }, { category: "external", summary: "SUSE Bug 1102379 for CVE-2018-8034", url: "https://bugzilla.suse.com/1102379", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-8034", }, { cve: "CVE-2018-8037", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-8037", }, ], notes: [ { category: "general", text: "If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-8037", url: "https://www.suse.com/security/cve/CVE-2018-8037", }, { category: "external", summary: "SUSE Bug 1003579 for CVE-2018-8037", url: "https://bugzilla.suse.com/1003579", }, { category: "external", summary: "SUSE Bug 1102410 for CVE-2018-8037", url: "https://bugzilla.suse.com/1102410", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 9.1, baseSeverity: "CRITICAL", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "critical", }, ], title: "CVE-2018-8037", }, { cve: "CVE-2019-0199", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0199", }, ], notes: [ { category: "general", text: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-0199", url: "https://www.suse.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "SUSE Bug 1131055 for CVE-2019-0199", url: "https://bugzilla.suse.com/1131055", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-0199", url: "https://bugzilla.suse.com/1139924", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2019-0199", }, { cve: "CVE-2019-0221", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0221", }, ], notes: [ { category: "general", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-0221", url: "https://www.suse.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "SUSE Bug 1136085 for CVE-2019-0221", url: "https://bugzilla.suse.com/1136085", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2019-0221", }, { cve: "CVE-2019-10072", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-10072", }, ], notes: [ { category: "general", text: "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-10072", url: "https://www.suse.com/security/cve/CVE-2019-10072", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-10072", url: "https://bugzilla.suse.com/1139924", }, { category: "external", summary: "SUSE Bug 1154162 for CVE-2019-10072", url: "https://bugzilla.suse.com/1154162", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-10072", }, { cve: "CVE-2019-12418", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-12418", }, ], notes: [ { category: "general", text: "When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-12418", url: "https://www.suse.com/security/cve/CVE-2019-12418", }, { category: "external", summary: "SUSE Bug 1159723 for CVE-2019-12418", url: "https://bugzilla.suse.com/1159723", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.1, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2019-12418", }, { cve: "CVE-2019-17563", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-17563", }, ], notes: [ { category: "general", text: "When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-17563", url: "https://www.suse.com/security/cve/CVE-2019-17563", }, { category: "external", summary: "SUSE Bug 1159729 for CVE-2019-17563", url: "https://bugzilla.suse.com/1159729", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 3.4, baseSeverity: "LOW", vectorString: "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2019-17563", }, { cve: "CVE-2019-17569", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-17569", }, ], notes: [ { category: "general", text: "The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-17569", url: "https://www.suse.com/security/cve/CVE-2019-17569", }, { category: "external", summary: "SUSE Bug 1164825 for CVE-2019-17569", url: "https://bugzilla.suse.com/1164825", }, { category: "external", summary: "SUSE Bug 1165858 for CVE-2019-17569", url: "https://bugzilla.suse.com/1165858", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.8, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-17569", }, { cve: "CVE-2020-11996", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-11996", }, ], notes: [ { category: "general", text: "A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-11996", url: "https://www.suse.com/security/cve/CVE-2020-11996", }, { category: "external", summary: "SUSE Bug 1173389 for CVE-2020-11996", url: "https://bugzilla.suse.com/1173389", }, { category: "external", summary: "SUSE Bug 1201081 for CVE-2020-11996", url: "https://bugzilla.suse.com/1201081", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-11996", }, { cve: "CVE-2020-13943", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-13943", }, ], notes: [ { category: "general", text: "If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-13943", url: "https://www.suse.com/security/cve/CVE-2020-13943", }, { category: "external", summary: "SUSE Bug 1177582 for CVE-2020-13943", url: "https://bugzilla.suse.com/1177582", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-13943", }, { cve: "CVE-2020-17527", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-17527", }, ], notes: [ { category: "general", text: "While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-17527", url: "https://www.suse.com/security/cve/CVE-2020-17527", }, { category: "external", summary: "SUSE Bug 1179602 for CVE-2020-17527", url: "https://bugzilla.suse.com/1179602", }, { category: "external", summary: "SUSE Bug 1180830 for CVE-2020-17527", url: "https://bugzilla.suse.com/1180830", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2020-17527", }, { cve: "CVE-2020-1935", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-1935", }, ], notes: [ { category: "general", text: "In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-1935", url: "https://www.suse.com/security/cve/CVE-2020-1935", }, { category: "external", summary: "SUSE Bug 1164860 for CVE-2020-1935", url: "https://bugzilla.suse.com/1164860", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.8, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-1935", }, { cve: "CVE-2020-1938", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-1938", }, ], notes: [ { category: "general", text: "When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-1938", url: "https://www.suse.com/security/cve/CVE-2020-1938", }, { category: "external", summary: "SUSE Bug 1164692 for CVE-2020-1938", url: "https://bugzilla.suse.com/1164692", }, { category: "external", summary: "SUSE Bug 1166559 for CVE-2020-1938", url: "https://bugzilla.suse.com/1166559", }, { category: "external", summary: "SUSE Bug 1169066 for CVE-2020-1938", url: "https://bugzilla.suse.com/1169066", }, { category: "external", summary: "SUSE Bug 1175170 for CVE-2020-1938", url: "https://bugzilla.suse.com/1175170", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.6, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2020-1938", }, { cve: "CVE-2020-9484", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-9484", }, ], notes: [ { category: "general", text: "When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-9484", url: "https://www.suse.com/security/cve/CVE-2020-9484", }, { category: "external", summary: "SUSE Bug 1171928 for CVE-2020-9484", url: "https://bugzilla.suse.com/1171928", }, { category: "external", summary: "SUSE Bug 1182909 for CVE-2020-9484", url: "https://bugzilla.suse.com/1182909", }, { category: "external", summary: "SUSE Bug 1195255 for CVE-2020-9484", url: "https://bugzilla.suse.com/1195255", }, { category: "external", summary: "SUSE Bug 1196395 for CVE-2020-9484", url: "https://bugzilla.suse.com/1196395", }, { category: "external", summary: "SUSE Bug 1201081 for CVE-2020-9484", url: "https://bugzilla.suse.com/1201081", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2020-9484", }, { cve: "CVE-2021-24122", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-24122", }, ], notes: [ { category: "general", text: "When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-24122", url: "https://www.suse.com/security/cve/CVE-2021-24122", }, { category: "external", summary: "SUSE Bug 1180947 for CVE-2021-24122", url: "https://bugzilla.suse.com/1180947", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2021-24122", }, { cve: "CVE-2021-25122", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-25122", }, ], notes: [ { category: "general", text: "When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-25122", url: "https://www.suse.com/security/cve/CVE-2021-25122", }, { category: "external", summary: "SUSE Bug 1182912 for CVE-2021-25122", url: "https://bugzilla.suse.com/1182912", }, { category: "external", summary: "SUSE Bug 1188549 for CVE-2021-25122", url: "https://bugzilla.suse.com/1188549", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2021-25122", }, { cve: "CVE-2021-25329", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-25329", }, ], notes: [ { category: "general", text: "The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-25329", url: "https://www.suse.com/security/cve/CVE-2021-25329", }, { category: "external", summary: "SUSE Bug 1182909 for CVE-2021-25329", url: "https://bugzilla.suse.com/1182909", }, { category: "external", summary: "SUSE Bug 1200696 for CVE-2021-25329", url: "https://bugzilla.suse.com/1200696", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2021-25329", }, ], }
opensuse-su-2019:1723-1
Vulnerability from csaf_opensuse
Published
2019-07-19 06:04
Modified
2019-07-19 06:04
Summary
Security update for tomcat
Notes
Title of the patch
Security update for tomcat
Description of the patch
This update for tomcat to version 9.0.21 fixes the following issues:
Security issue fixed:
- CVE-2019-0199: Added additional fixes to address HTTP/2 connection window exhaustion (bsc#1139924).
This update was imported from the SUSE:SLE-15:Update update project.
Patchnames
openSUSE-2019-1723
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for tomcat", title: "Title of the patch", }, { category: "description", text: "This update for tomcat to version 9.0.21 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-0199: Added additional fixes to address HTTP/2 connection window exhaustion (bsc#1139924).\n\nThis update was imported from the SUSE:SLE-15:Update update project.", title: "Description of the patch", }, { category: "details", text: "openSUSE-2019-1723", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_1723-1.json", }, { category: "self", summary: "URL for openSUSE-SU-2019:1723-1", url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MZRW44HVNWG5UVGEY2JEROSEKT4I55HV/#MZRW44HVNWG5UVGEY2JEROSEKT4I55HV", }, { category: "self", summary: "E-Mail link for openSUSE-SU-2019:1723-1", url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MZRW44HVNWG5UVGEY2JEROSEKT4I55HV/#MZRW44HVNWG5UVGEY2JEROSEKT4I55HV", }, { category: "self", summary: "SUSE Bug 1139924", url: "https://bugzilla.suse.com/1139924", }, { category: "self", summary: "SUSE CVE CVE-2019-0199 page", url: "https://www.suse.com/security/cve/CVE-2019-0199/", }, ], title: "Security update for tomcat", tracking: { current_release_date: "2019-07-19T06:04:55Z", generator: { date: "2019-07-19T06:04:55Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "openSUSE-SU-2019:1723-1", initial_release_date: "2019-07-19T06:04:55Z", revision_history: [ { date: "2019-07-19T06:04:55Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "tomcat-9.0.21-lp150.2.22.1.noarch", product: { name: "tomcat-9.0.21-lp150.2.22.1.noarch", product_id: "tomcat-9.0.21-lp150.2.22.1.noarch", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.21-lp150.2.22.1.noarch", product: { name: "tomcat-admin-webapps-9.0.21-lp150.2.22.1.noarch", product_id: "tomcat-admin-webapps-9.0.21-lp150.2.22.1.noarch", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.21-lp150.2.22.1.noarch", product: { name: "tomcat-docs-webapp-9.0.21-lp150.2.22.1.noarch", product_id: "tomcat-docs-webapp-9.0.21-lp150.2.22.1.noarch", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.21-lp150.2.22.1.noarch", product: { name: "tomcat-el-3_0-api-9.0.21-lp150.2.22.1.noarch", product_id: "tomcat-el-3_0-api-9.0.21-lp150.2.22.1.noarch", }, }, { category: "product_version", name: "tomcat-embed-9.0.21-lp150.2.22.1.noarch", product: { name: "tomcat-embed-9.0.21-lp150.2.22.1.noarch", product_id: "tomcat-embed-9.0.21-lp150.2.22.1.noarch", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.21-lp150.2.22.1.noarch", product: { name: "tomcat-javadoc-9.0.21-lp150.2.22.1.noarch", product_id: "tomcat-javadoc-9.0.21-lp150.2.22.1.noarch", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.21-lp150.2.22.1.noarch", product: { name: "tomcat-jsp-2_3-api-9.0.21-lp150.2.22.1.noarch", product_id: "tomcat-jsp-2_3-api-9.0.21-lp150.2.22.1.noarch", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.21-lp150.2.22.1.noarch", product: { name: "tomcat-jsvc-9.0.21-lp150.2.22.1.noarch", product_id: "tomcat-jsvc-9.0.21-lp150.2.22.1.noarch", }, }, { category: "product_version", name: "tomcat-lib-9.0.21-lp150.2.22.1.noarch", product: { name: "tomcat-lib-9.0.21-lp150.2.22.1.noarch", product_id: "tomcat-lib-9.0.21-lp150.2.22.1.noarch", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.21-lp150.2.22.1.noarch", product: { name: "tomcat-servlet-4_0-api-9.0.21-lp150.2.22.1.noarch", product_id: "tomcat-servlet-4_0-api-9.0.21-lp150.2.22.1.noarch", }, }, { category: "product_version", name: "tomcat-webapps-9.0.21-lp150.2.22.1.noarch", product: { name: "tomcat-webapps-9.0.21-lp150.2.22.1.noarch", product_id: "tomcat-webapps-9.0.21-lp150.2.22.1.noarch", }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_name", name: "openSUSE Leap 15.0", product: { name: "openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0", product_identification_helper: { cpe: "cpe:/o:opensuse:leap:15.0", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "tomcat-9.0.21-lp150.2.22.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-9.0.21-lp150.2.22.1.noarch", }, product_reference: "tomcat-9.0.21-lp150.2.22.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.21-lp150.2.22.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-admin-webapps-9.0.21-lp150.2.22.1.noarch", }, product_reference: "tomcat-admin-webapps-9.0.21-lp150.2.22.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.21-lp150.2.22.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-docs-webapp-9.0.21-lp150.2.22.1.noarch", }, product_reference: "tomcat-docs-webapp-9.0.21-lp150.2.22.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.21-lp150.2.22.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-el-3_0-api-9.0.21-lp150.2.22.1.noarch", }, product_reference: "tomcat-el-3_0-api-9.0.21-lp150.2.22.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-embed-9.0.21-lp150.2.22.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-embed-9.0.21-lp150.2.22.1.noarch", }, product_reference: "tomcat-embed-9.0.21-lp150.2.22.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.21-lp150.2.22.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-javadoc-9.0.21-lp150.2.22.1.noarch", }, product_reference: "tomcat-javadoc-9.0.21-lp150.2.22.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.21-lp150.2.22.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-jsp-2_3-api-9.0.21-lp150.2.22.1.noarch", }, product_reference: "tomcat-jsp-2_3-api-9.0.21-lp150.2.22.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsvc-9.0.21-lp150.2.22.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-jsvc-9.0.21-lp150.2.22.1.noarch", }, product_reference: "tomcat-jsvc-9.0.21-lp150.2.22.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.21-lp150.2.22.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-lib-9.0.21-lp150.2.22.1.noarch", }, product_reference: "tomcat-lib-9.0.21-lp150.2.22.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.21-lp150.2.22.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-servlet-4_0-api-9.0.21-lp150.2.22.1.noarch", }, product_reference: "tomcat-servlet-4_0-api-9.0.21-lp150.2.22.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.21-lp150.2.22.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-webapps-9.0.21-lp150.2.22.1.noarch", }, product_reference: "tomcat-webapps-9.0.21-lp150.2.22.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, ], }, vulnerabilities: [ { cve: "CVE-2019-0199", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0199", }, ], notes: [ { category: "general", text: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Leap 15.0:tomcat-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-admin-webapps-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-docs-webapp-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-el-3_0-api-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-embed-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-javadoc-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-jsp-2_3-api-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-jsvc-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-lib-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-servlet-4_0-api-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-webapps-9.0.21-lp150.2.22.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-0199", url: "https://www.suse.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "SUSE Bug 1131055 for CVE-2019-0199", url: "https://bugzilla.suse.com/1131055", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-0199", url: "https://bugzilla.suse.com/1139924", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Leap 15.0:tomcat-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-admin-webapps-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-docs-webapp-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-el-3_0-api-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-embed-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-javadoc-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-jsp-2_3-api-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-jsvc-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-lib-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-servlet-4_0-api-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-webapps-9.0.21-lp150.2.22.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Leap 15.0:tomcat-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-admin-webapps-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-docs-webapp-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-el-3_0-api-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-embed-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-javadoc-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-jsp-2_3-api-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-jsvc-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-lib-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-servlet-4_0-api-9.0.21-lp150.2.22.1.noarch", "openSUSE Leap 15.0:tomcat-webapps-9.0.21-lp150.2.22.1.noarch", ], }, ], threats: [ { category: "impact", date: "2019-07-19T06:04:55Z", details: "important", }, ], title: "CVE-2019-0199", }, ], }
opensuse-su-2024:13441-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
tomcat10-10.1.14-1.1 on GA media
Notes
Title of the patch
tomcat10-10.1.14-1.1 on GA media
Description of the patch
These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-13441
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "tomcat10-10.1.14-1.1 on GA media", title: "Title of the patch", }, { category: "description", text: "These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.", title: "Description of the patch", }, { category: "details", text: "openSUSE-Tumbleweed-2024-13441", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13441-1.json", }, { category: "self", summary: "SUSE CVE CVE-2013-1976 page", url: "https://www.suse.com/security/cve/CVE-2013-1976/", }, { category: "self", summary: "SUSE CVE CVE-2014-0050 page", url: "https://www.suse.com/security/cve/CVE-2014-0050/", }, { category: "self", summary: "SUSE CVE CVE-2015-5174 page", url: "https://www.suse.com/security/cve/CVE-2015-5174/", }, { category: "self", summary: "SUSE CVE CVE-2015-5345 page", url: "https://www.suse.com/security/cve/CVE-2015-5345/", }, { category: "self", summary: "SUSE CVE CVE-2015-5346 page", url: "https://www.suse.com/security/cve/CVE-2015-5346/", }, { category: "self", summary: "SUSE CVE CVE-2015-5351 page", url: "https://www.suse.com/security/cve/CVE-2015-5351/", }, { category: "self", summary: "SUSE CVE CVE-2016-0706 page", url: "https://www.suse.com/security/cve/CVE-2016-0706/", }, { category: "self", summary: "SUSE CVE CVE-2016-0714 page", url: "https://www.suse.com/security/cve/CVE-2016-0714/", }, { category: "self", summary: "SUSE CVE CVE-2016-0763 page", url: "https://www.suse.com/security/cve/CVE-2016-0763/", }, { category: "self", summary: "SUSE CVE CVE-2016-3092 page", url: "https://www.suse.com/security/cve/CVE-2016-3092/", }, { category: "self", summary: "SUSE CVE CVE-2016-8745 page", url: "https://www.suse.com/security/cve/CVE-2016-8745/", }, { category: "self", summary: "SUSE CVE CVE-2017-12617 page", url: "https://www.suse.com/security/cve/CVE-2017-12617/", }, { category: "self", summary: "SUSE CVE CVE-2017-5647 page", url: "https://www.suse.com/security/cve/CVE-2017-5647/", }, { category: "self", summary: "SUSE CVE CVE-2017-5648 page", url: "https://www.suse.com/security/cve/CVE-2017-5648/", }, { category: "self", summary: "SUSE CVE CVE-2017-5664 page", url: "https://www.suse.com/security/cve/CVE-2017-5664/", }, { category: "self", summary: "SUSE CVE CVE-2018-11784 page", url: "https://www.suse.com/security/cve/CVE-2018-11784/", }, { category: "self", summary: "SUSE CVE CVE-2018-1336 page", url: "https://www.suse.com/security/cve/CVE-2018-1336/", }, { category: "self", summary: "SUSE CVE CVE-2018-8014 page", url: "https://www.suse.com/security/cve/CVE-2018-8014/", }, { category: "self", summary: "SUSE CVE CVE-2018-8034 page", url: "https://www.suse.com/security/cve/CVE-2018-8034/", }, { category: "self", summary: "SUSE CVE CVE-2018-8037 page", url: "https://www.suse.com/security/cve/CVE-2018-8037/", }, { category: "self", summary: "SUSE CVE CVE-2019-0199 page", url: "https://www.suse.com/security/cve/CVE-2019-0199/", }, { category: "self", summary: "SUSE CVE CVE-2019-0221 page", url: "https://www.suse.com/security/cve/CVE-2019-0221/", }, { category: "self", summary: "SUSE CVE CVE-2019-10072 page", url: "https://www.suse.com/security/cve/CVE-2019-10072/", }, { category: "self", summary: "SUSE CVE CVE-2019-12418 page", url: "https://www.suse.com/security/cve/CVE-2019-12418/", }, { category: "self", summary: "SUSE CVE CVE-2019-17563 page", url: "https://www.suse.com/security/cve/CVE-2019-17563/", }, { category: "self", summary: "SUSE CVE CVE-2019-17569 page", url: "https://www.suse.com/security/cve/CVE-2019-17569/", }, { category: "self", summary: "SUSE CVE CVE-2020-11996 page", url: "https://www.suse.com/security/cve/CVE-2020-11996/", }, { category: "self", summary: "SUSE CVE CVE-2020-13934 page", url: "https://www.suse.com/security/cve/CVE-2020-13934/", }, { category: "self", summary: "SUSE CVE CVE-2020-13935 page", url: "https://www.suse.com/security/cve/CVE-2020-13935/", }, { category: "self", summary: "SUSE CVE CVE-2020-13943 page", url: "https://www.suse.com/security/cve/CVE-2020-13943/", }, { category: "self", summary: "SUSE CVE CVE-2020-17527 page", url: "https://www.suse.com/security/cve/CVE-2020-17527/", }, { category: "self", summary: "SUSE CVE CVE-2020-1935 page", url: "https://www.suse.com/security/cve/CVE-2020-1935/", }, { category: "self", summary: "SUSE CVE CVE-2020-1938 page", url: "https://www.suse.com/security/cve/CVE-2020-1938/", }, { category: "self", summary: "SUSE CVE CVE-2020-9484 page", url: "https://www.suse.com/security/cve/CVE-2020-9484/", }, { category: "self", summary: "SUSE CVE CVE-2021-24122 page", url: "https://www.suse.com/security/cve/CVE-2021-24122/", }, { category: "self", summary: "SUSE CVE CVE-2021-25122 page", url: "https://www.suse.com/security/cve/CVE-2021-25122/", }, { category: "self", summary: "SUSE CVE CVE-2021-25329 page", url: "https://www.suse.com/security/cve/CVE-2021-25329/", }, { category: "self", summary: "SUSE CVE CVE-2021-30640 page", url: "https://www.suse.com/security/cve/CVE-2021-30640/", }, { category: "self", summary: "SUSE CVE CVE-2021-33037 page", url: "https://www.suse.com/security/cve/CVE-2021-33037/", }, { category: "self", summary: "SUSE CVE CVE-2021-41079 page", url: "https://www.suse.com/security/cve/CVE-2021-41079/", }, { category: "self", summary: "SUSE CVE CVE-2021-43980 page", url: "https://www.suse.com/security/cve/CVE-2021-43980/", }, { category: "self", summary: "SUSE CVE CVE-2022-23181 page", url: "https://www.suse.com/security/cve/CVE-2022-23181/", }, { category: "self", summary: "SUSE CVE CVE-2022-42252 page", url: "https://www.suse.com/security/cve/CVE-2022-42252/", }, { category: "self", summary: "SUSE CVE CVE-2022-45143 page", url: "https://www.suse.com/security/cve/CVE-2022-45143/", }, { category: "self", summary: "SUSE CVE CVE-2023-24998 page", url: "https://www.suse.com/security/cve/CVE-2023-24998/", }, { category: "self", summary: "SUSE CVE CVE-2023-28708 page", url: "https://www.suse.com/security/cve/CVE-2023-28708/", }, { category: "self", summary: "SUSE CVE CVE-2023-28709 page", url: "https://www.suse.com/security/cve/CVE-2023-28709/", }, { category: "self", summary: "SUSE CVE CVE-2023-41080 page", url: "https://www.suse.com/security/cve/CVE-2023-41080/", }, { category: "self", summary: "SUSE CVE CVE-2023-44487 page", url: "https://www.suse.com/security/cve/CVE-2023-44487/", }, ], title: "tomcat10-10.1.14-1.1 on GA media", tracking: { current_release_date: "2024-06-15T00:00:00Z", generator: { date: "2024-06-15T00:00:00Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "openSUSE-SU-2024:13441-1", initial_release_date: "2024-06-15T00:00:00Z", revision_history: [ { date: "2024-06-15T00:00:00Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "tomcat10-10.1.14-1.1.aarch64", product: { name: "tomcat10-10.1.14-1.1.aarch64", product_id: "tomcat10-10.1.14-1.1.aarch64", }, }, { category: "product_version", name: "tomcat10-admin-webapps-10.1.14-1.1.aarch64", product: { name: "tomcat10-admin-webapps-10.1.14-1.1.aarch64", product_id: "tomcat10-admin-webapps-10.1.14-1.1.aarch64", }, }, { category: "product_version", name: "tomcat10-doc-10.1.14-1.1.aarch64", product: { name: "tomcat10-doc-10.1.14-1.1.aarch64", product_id: "tomcat10-doc-10.1.14-1.1.aarch64", }, }, { category: "product_version", name: "tomcat10-docs-webapp-10.1.14-1.1.aarch64", product: { name: "tomcat10-docs-webapp-10.1.14-1.1.aarch64", product_id: "tomcat10-docs-webapp-10.1.14-1.1.aarch64", }, }, { category: "product_version", name: "tomcat10-el-5_0-api-10.1.14-1.1.aarch64", product: { name: "tomcat10-el-5_0-api-10.1.14-1.1.aarch64", product_id: "tomcat10-el-5_0-api-10.1.14-1.1.aarch64", }, }, { category: "product_version", name: "tomcat10-embed-10.1.14-1.1.aarch64", product: { name: "tomcat10-embed-10.1.14-1.1.aarch64", product_id: "tomcat10-embed-10.1.14-1.1.aarch64", }, }, { category: "product_version", name: "tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", product: { name: "tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", product_id: "tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", }, }, { category: "product_version", name: "tomcat10-jsvc-10.1.14-1.1.aarch64", product: { name: "tomcat10-jsvc-10.1.14-1.1.aarch64", product_id: "tomcat10-jsvc-10.1.14-1.1.aarch64", }, }, { category: "product_version", name: "tomcat10-lib-10.1.14-1.1.aarch64", product: { name: "tomcat10-lib-10.1.14-1.1.aarch64", product_id: "tomcat10-lib-10.1.14-1.1.aarch64", }, }, { category: "product_version", name: "tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", product: { name: "tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", product_id: "tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", }, }, { category: "product_version", name: "tomcat10-webapps-10.1.14-1.1.aarch64", product: { name: "tomcat10-webapps-10.1.14-1.1.aarch64", product_id: "tomcat10-webapps-10.1.14-1.1.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "tomcat10-10.1.14-1.1.ppc64le", product: { name: "tomcat10-10.1.14-1.1.ppc64le", product_id: "tomcat10-10.1.14-1.1.ppc64le", }, }, { category: "product_version", name: "tomcat10-admin-webapps-10.1.14-1.1.ppc64le", product: { name: "tomcat10-admin-webapps-10.1.14-1.1.ppc64le", product_id: "tomcat10-admin-webapps-10.1.14-1.1.ppc64le", }, }, { category: "product_version", name: "tomcat10-doc-10.1.14-1.1.ppc64le", product: { name: "tomcat10-doc-10.1.14-1.1.ppc64le", product_id: "tomcat10-doc-10.1.14-1.1.ppc64le", }, }, { category: "product_version", name: "tomcat10-docs-webapp-10.1.14-1.1.ppc64le", product: { name: "tomcat10-docs-webapp-10.1.14-1.1.ppc64le", product_id: "tomcat10-docs-webapp-10.1.14-1.1.ppc64le", }, }, { category: "product_version", name: "tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", product: { name: "tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", product_id: "tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", }, }, { category: "product_version", name: "tomcat10-embed-10.1.14-1.1.ppc64le", product: { name: "tomcat10-embed-10.1.14-1.1.ppc64le", product_id: "tomcat10-embed-10.1.14-1.1.ppc64le", }, }, { category: "product_version", name: "tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", product: { name: "tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", product_id: "tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", }, }, { category: "product_version", name: "tomcat10-jsvc-10.1.14-1.1.ppc64le", product: { name: "tomcat10-jsvc-10.1.14-1.1.ppc64le", product_id: "tomcat10-jsvc-10.1.14-1.1.ppc64le", }, }, { category: "product_version", name: "tomcat10-lib-10.1.14-1.1.ppc64le", product: { name: "tomcat10-lib-10.1.14-1.1.ppc64le", product_id: "tomcat10-lib-10.1.14-1.1.ppc64le", }, }, { category: "product_version", name: "tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", product: { name: "tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", product_id: "tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", }, }, { category: "product_version", name: "tomcat10-webapps-10.1.14-1.1.ppc64le", product: { name: "tomcat10-webapps-10.1.14-1.1.ppc64le", product_id: "tomcat10-webapps-10.1.14-1.1.ppc64le", }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "tomcat10-10.1.14-1.1.s390x", product: { name: "tomcat10-10.1.14-1.1.s390x", product_id: "tomcat10-10.1.14-1.1.s390x", }, }, { category: "product_version", name: "tomcat10-admin-webapps-10.1.14-1.1.s390x", product: { name: "tomcat10-admin-webapps-10.1.14-1.1.s390x", product_id: "tomcat10-admin-webapps-10.1.14-1.1.s390x", }, }, { category: "product_version", name: "tomcat10-doc-10.1.14-1.1.s390x", product: { name: "tomcat10-doc-10.1.14-1.1.s390x", product_id: "tomcat10-doc-10.1.14-1.1.s390x", }, }, { category: "product_version", name: "tomcat10-docs-webapp-10.1.14-1.1.s390x", product: { name: "tomcat10-docs-webapp-10.1.14-1.1.s390x", product_id: "tomcat10-docs-webapp-10.1.14-1.1.s390x", }, }, { category: "product_version", name: "tomcat10-el-5_0-api-10.1.14-1.1.s390x", product: { name: "tomcat10-el-5_0-api-10.1.14-1.1.s390x", product_id: "tomcat10-el-5_0-api-10.1.14-1.1.s390x", }, }, { category: "product_version", name: "tomcat10-embed-10.1.14-1.1.s390x", product: { name: "tomcat10-embed-10.1.14-1.1.s390x", product_id: "tomcat10-embed-10.1.14-1.1.s390x", }, }, { category: "product_version", name: "tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", product: { name: "tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", product_id: "tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", }, }, { category: "product_version", name: "tomcat10-jsvc-10.1.14-1.1.s390x", product: { name: "tomcat10-jsvc-10.1.14-1.1.s390x", product_id: "tomcat10-jsvc-10.1.14-1.1.s390x", }, }, { category: "product_version", name: "tomcat10-lib-10.1.14-1.1.s390x", product: { name: "tomcat10-lib-10.1.14-1.1.s390x", product_id: "tomcat10-lib-10.1.14-1.1.s390x", }, }, { category: "product_version", name: "tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", product: { name: "tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", product_id: "tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", }, }, { category: "product_version", name: "tomcat10-webapps-10.1.14-1.1.s390x", product: { name: "tomcat10-webapps-10.1.14-1.1.s390x", product_id: "tomcat10-webapps-10.1.14-1.1.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "tomcat10-10.1.14-1.1.x86_64", product: { name: "tomcat10-10.1.14-1.1.x86_64", product_id: "tomcat10-10.1.14-1.1.x86_64", }, }, { category: "product_version", name: "tomcat10-admin-webapps-10.1.14-1.1.x86_64", product: { name: "tomcat10-admin-webapps-10.1.14-1.1.x86_64", product_id: "tomcat10-admin-webapps-10.1.14-1.1.x86_64", }, }, { category: "product_version", name: "tomcat10-doc-10.1.14-1.1.x86_64", product: { name: "tomcat10-doc-10.1.14-1.1.x86_64", product_id: "tomcat10-doc-10.1.14-1.1.x86_64", }, }, { category: "product_version", name: "tomcat10-docs-webapp-10.1.14-1.1.x86_64", product: { name: "tomcat10-docs-webapp-10.1.14-1.1.x86_64", product_id: "tomcat10-docs-webapp-10.1.14-1.1.x86_64", }, }, { category: "product_version", name: "tomcat10-el-5_0-api-10.1.14-1.1.x86_64", product: { name: "tomcat10-el-5_0-api-10.1.14-1.1.x86_64", product_id: "tomcat10-el-5_0-api-10.1.14-1.1.x86_64", }, }, { category: "product_version", name: "tomcat10-embed-10.1.14-1.1.x86_64", product: { name: "tomcat10-embed-10.1.14-1.1.x86_64", product_id: "tomcat10-embed-10.1.14-1.1.x86_64", }, }, { category: "product_version", name: "tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", product: { name: "tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", product_id: "tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", }, }, { category: "product_version", name: "tomcat10-jsvc-10.1.14-1.1.x86_64", product: { name: "tomcat10-jsvc-10.1.14-1.1.x86_64", product_id: "tomcat10-jsvc-10.1.14-1.1.x86_64", }, }, { category: "product_version", name: "tomcat10-lib-10.1.14-1.1.x86_64", product: { name: "tomcat10-lib-10.1.14-1.1.x86_64", product_id: "tomcat10-lib-10.1.14-1.1.x86_64", }, }, { category: "product_version", name: "tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", product: { name: "tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", product_id: "tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", }, }, { category: "product_version", name: "tomcat10-webapps-10.1.14-1.1.x86_64", product: { name: "tomcat10-webapps-10.1.14-1.1.x86_64", product_id: "tomcat10-webapps-10.1.14-1.1.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "openSUSE Tumbleweed", product: { name: "openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed", product_identification_helper: { cpe: "cpe:/o:opensuse:tumbleweed", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "tomcat10-10.1.14-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", }, product_reference: "tomcat10-10.1.14-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-10.1.14-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", }, product_reference: "tomcat10-10.1.14-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-10.1.14-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", }, product_reference: "tomcat10-10.1.14-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-10.1.14-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", }, product_reference: "tomcat10-10.1.14-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-admin-webapps-10.1.14-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", }, product_reference: "tomcat10-admin-webapps-10.1.14-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-admin-webapps-10.1.14-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", }, product_reference: "tomcat10-admin-webapps-10.1.14-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-admin-webapps-10.1.14-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", }, product_reference: "tomcat10-admin-webapps-10.1.14-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-admin-webapps-10.1.14-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", }, product_reference: "tomcat10-admin-webapps-10.1.14-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-doc-10.1.14-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", }, product_reference: "tomcat10-doc-10.1.14-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-doc-10.1.14-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", }, product_reference: "tomcat10-doc-10.1.14-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-doc-10.1.14-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", }, product_reference: "tomcat10-doc-10.1.14-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-doc-10.1.14-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", }, product_reference: "tomcat10-doc-10.1.14-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-docs-webapp-10.1.14-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", }, product_reference: "tomcat10-docs-webapp-10.1.14-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-docs-webapp-10.1.14-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", }, product_reference: "tomcat10-docs-webapp-10.1.14-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-docs-webapp-10.1.14-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", }, product_reference: "tomcat10-docs-webapp-10.1.14-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-docs-webapp-10.1.14-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", }, product_reference: "tomcat10-docs-webapp-10.1.14-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-el-5_0-api-10.1.14-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", }, product_reference: "tomcat10-el-5_0-api-10.1.14-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-el-5_0-api-10.1.14-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", }, product_reference: "tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-el-5_0-api-10.1.14-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", }, product_reference: "tomcat10-el-5_0-api-10.1.14-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-el-5_0-api-10.1.14-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", }, product_reference: "tomcat10-el-5_0-api-10.1.14-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-embed-10.1.14-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", }, product_reference: "tomcat10-embed-10.1.14-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-embed-10.1.14-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", }, product_reference: "tomcat10-embed-10.1.14-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-embed-10.1.14-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", }, product_reference: "tomcat10-embed-10.1.14-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-embed-10.1.14-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", }, product_reference: "tomcat10-embed-10.1.14-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", }, product_reference: "tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", }, product_reference: "tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-jsp-3_1-api-10.1.14-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", }, product_reference: "tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", }, product_reference: "tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-jsvc-10.1.14-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", }, product_reference: "tomcat10-jsvc-10.1.14-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-jsvc-10.1.14-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", }, product_reference: "tomcat10-jsvc-10.1.14-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-jsvc-10.1.14-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", }, product_reference: "tomcat10-jsvc-10.1.14-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-jsvc-10.1.14-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", }, product_reference: "tomcat10-jsvc-10.1.14-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-lib-10.1.14-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", }, product_reference: "tomcat10-lib-10.1.14-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-lib-10.1.14-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", }, product_reference: "tomcat10-lib-10.1.14-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-lib-10.1.14-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", }, product_reference: "tomcat10-lib-10.1.14-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-lib-10.1.14-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", }, product_reference: "tomcat10-lib-10.1.14-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", }, product_reference: "tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", }, product_reference: "tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-servlet-6_0-api-10.1.14-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", }, product_reference: "tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", }, product_reference: "tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-webapps-10.1.14-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", }, product_reference: "tomcat10-webapps-10.1.14-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-webapps-10.1.14-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", }, product_reference: "tomcat10-webapps-10.1.14-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-webapps-10.1.14-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", }, product_reference: "tomcat10-webapps-10.1.14-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat10-webapps-10.1.14-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", }, product_reference: "tomcat10-webapps-10.1.14-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, ], }, vulnerabilities: [ { cve: "CVE-2013-1976", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2013-1976", }, ], notes: [ { category: "general", text: "The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a symlink attack on (a) tomcat5-initd.log, (b) tomcat6-initd.log, (c) catalina.out, or (d) tomcat7-initd.log.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2013-1976", url: "https://www.suse.com/security/cve/CVE-2013-1976", }, { category: "external", summary: "SUSE Bug 822177 for CVE-2013-1976", url: "https://bugzilla.suse.com/822177", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2013-1976", }, { cve: "CVE-2014-0050", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2014-0050", }, ], notes: [ { category: "general", text: "MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2014-0050", url: "https://www.suse.com/security/cve/CVE-2014-0050", }, { category: "external", summary: "SUSE Bug 862781 for CVE-2014-0050", url: "https://bugzilla.suse.com/862781", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2014-0050", }, { cve: "CVE-2015-5174", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-5174", }, ], notes: [ { category: "general", text: "Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-5174", url: "https://www.suse.com/security/cve/CVE-2015-5174", }, { category: "external", summary: "SUSE Bug 967967 for CVE-2015-5174", url: "https://bugzilla.suse.com/967967", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2015-5174", }, { cve: "CVE-2015-5345", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-5345", }, ], notes: [ { category: "general", text: "The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-5345", url: "https://www.suse.com/security/cve/CVE-2015-5345", }, { category: "external", summary: "SUSE Bug 967965 for CVE-2015-5345", url: "https://bugzilla.suse.com/967965", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2015-5345", }, { cve: "CVE-2015-5346", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-5346", }, ], notes: [ { category: "general", text: "Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-5346", url: "https://www.suse.com/security/cve/CVE-2015-5346", }, { category: "external", summary: "SUSE Bug 967814 for CVE-2015-5346", url: "https://bugzilla.suse.com/967814", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.1, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2015-5346", }, { cve: "CVE-2015-5351", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2015-5351", }, ], notes: [ { category: "general", text: "The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2015-5351", url: "https://www.suse.com/security/cve/CVE-2015-5351", }, { category: "external", summary: "SUSE Bug 967812 for CVE-2015-5351", url: "https://bugzilla.suse.com/967812", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2015-5351", }, { cve: "CVE-2016-0706", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-0706", }, ], notes: [ { category: "general", text: "Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-0706", url: "https://www.suse.com/security/cve/CVE-2016-0706", }, { category: "external", summary: "SUSE Bug 967815 for CVE-2016-0706", url: "https://bugzilla.suse.com/967815", }, { category: "external", summary: "SUSE Bug 971085 for CVE-2016-0706", url: "https://bugzilla.suse.com/971085", }, { category: "external", summary: "SUSE Bug 988489 for CVE-2016-0706", url: "https://bugzilla.suse.com/988489", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2016-0706", }, { cve: "CVE-2016-0714", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-0714", }, ], notes: [ { category: "general", text: "The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-0714", url: "https://www.suse.com/security/cve/CVE-2016-0714", }, { category: "external", summary: "SUSE Bug 967964 for CVE-2016-0714", url: "https://bugzilla.suse.com/967964", }, { category: "external", summary: "SUSE Bug 971085 for CVE-2016-0714", url: "https://bugzilla.suse.com/971085", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2016-0714", }, { cve: "CVE-2016-0763", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-0763", }, ], notes: [ { category: "general", text: "The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-0763", url: "https://www.suse.com/security/cve/CVE-2016-0763", }, { category: "external", summary: "SUSE Bug 967966 for CVE-2016-0763", url: "https://bugzilla.suse.com/967966", }, { category: "external", summary: "SUSE Bug 971085 for CVE-2016-0763", url: "https://bugzilla.suse.com/971085", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2016-0763", }, { cve: "CVE-2016-3092", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-3092", }, ], notes: [ { category: "general", text: "The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-3092", url: "https://www.suse.com/security/cve/CVE-2016-3092", }, { category: "external", summary: "SUSE Bug 1068865 for CVE-2016-3092", url: "https://bugzilla.suse.com/1068865", }, { category: "external", summary: "SUSE Bug 986359 for CVE-2016-3092", url: "https://bugzilla.suse.com/986359", }, { category: "external", summary: "SUSE Bug 988489 for CVE-2016-3092", url: "https://bugzilla.suse.com/988489", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2016-3092", }, { cve: "CVE-2016-8745", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-8745", }, ], notes: [ { category: "general", text: "A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-8745", url: "https://www.suse.com/security/cve/CVE-2016-8745", }, { category: "external", summary: "SUSE Bug 1015119 for CVE-2016-8745", url: "https://bugzilla.suse.com/1015119", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2016-8745", }, { cve: "CVE-2017-12617", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-12617", }, ], notes: [ { category: "general", text: "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-12617", url: "https://www.suse.com/security/cve/CVE-2017-12617", }, { category: "external", summary: "SUSE Bug 1059554 for CVE-2017-12617", url: "https://bugzilla.suse.com/1059554", }, { category: "external", summary: "SUSE Bug 1062607 for CVE-2017-12617", url: "https://bugzilla.suse.com/1062607", }, { category: "external", summary: "SUSE Bug 1180947 for CVE-2017-12617", url: "https://bugzilla.suse.com/1180947", }, { category: "external", summary: "SUSE Bug 1189861 for CVE-2017-12617", url: "https://bugzilla.suse.com/1189861", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 9.8, baseSeverity: "CRITICAL", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2017-12617", }, { cve: "CVE-2017-5647", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-5647", }, ], notes: [ { category: "general", text: "A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-5647", url: "https://www.suse.com/security/cve/CVE-2017-5647", }, { category: "external", summary: "SUSE Bug 1033448 for CVE-2017-5647", url: "https://bugzilla.suse.com/1033448", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2017-5647", }, { cve: "CVE-2017-5648", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-5648", }, ], notes: [ { category: "general", text: "While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-5648", url: "https://www.suse.com/security/cve/CVE-2017-5648", }, { category: "external", summary: "SUSE Bug 1033447 for CVE-2017-5648", url: "https://bugzilla.suse.com/1033447", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 9.1, baseSeverity: "CRITICAL", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2017-5648", }, { cve: "CVE-2017-5664", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-5664", }, ], notes: [ { category: "general", text: "The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-5664", url: "https://www.suse.com/security/cve/CVE-2017-5664", }, { category: "external", summary: "SUSE Bug 1042910 for CVE-2017-5664", url: "https://bugzilla.suse.com/1042910", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2017-5664", }, { cve: "CVE-2018-11784", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-11784", }, ], notes: [ { category: "general", text: "When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-11784", url: "https://www.suse.com/security/cve/CVE-2018-11784", }, { category: "external", summary: "SUSE Bug 1110850 for CVE-2018-11784", url: "https://bugzilla.suse.com/1110850", }, { category: "external", summary: "SUSE Bug 1122212 for CVE-2018-11784", url: "https://bugzilla.suse.com/1122212", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.1, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-11784", }, { cve: "CVE-2018-1336", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-1336", }, ], notes: [ { category: "general", text: "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-1336", url: "https://www.suse.com/security/cve/CVE-2018-1336", }, { category: "external", summary: "SUSE Bug 1102400 for CVE-2018-1336", url: "https://bugzilla.suse.com/1102400", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2018-1336", }, { cve: "CVE-2018-8014", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-8014", }, ], notes: [ { category: "general", text: "The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-8014", url: "https://www.suse.com/security/cve/CVE-2018-8014", }, { category: "external", summary: "SUSE Bug 1093697 for CVE-2018-8014", url: "https://bugzilla.suse.com/1093697", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2018-8014", }, { cve: "CVE-2018-8034", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-8034", }, ], notes: [ { category: "general", text: "The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-8034", url: "https://www.suse.com/security/cve/CVE-2018-8034", }, { category: "external", summary: "SUSE Bug 1102379 for CVE-2018-8034", url: "https://bugzilla.suse.com/1102379", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-8034", }, { cve: "CVE-2018-8037", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-8037", }, ], notes: [ { category: "general", text: "If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-8037", url: "https://www.suse.com/security/cve/CVE-2018-8037", }, { category: "external", summary: "SUSE Bug 1003579 for CVE-2018-8037", url: "https://bugzilla.suse.com/1003579", }, { category: "external", summary: "SUSE Bug 1102410 for CVE-2018-8037", url: "https://bugzilla.suse.com/1102410", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 9.1, baseSeverity: "CRITICAL", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "critical", }, ], title: "CVE-2018-8037", }, { cve: "CVE-2019-0199", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0199", }, ], notes: [ { category: "general", text: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-0199", url: "https://www.suse.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "SUSE Bug 1131055 for CVE-2019-0199", url: "https://bugzilla.suse.com/1131055", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-0199", url: "https://bugzilla.suse.com/1139924", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2019-0199", }, { cve: "CVE-2019-0221", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0221", }, ], notes: [ { category: "general", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-0221", url: "https://www.suse.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "SUSE Bug 1136085 for CVE-2019-0221", url: "https://bugzilla.suse.com/1136085", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2019-0221", }, { cve: "CVE-2019-10072", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-10072", }, ], notes: [ { category: "general", text: "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-10072", url: "https://www.suse.com/security/cve/CVE-2019-10072", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-10072", url: "https://bugzilla.suse.com/1139924", }, { category: "external", summary: "SUSE Bug 1154162 for CVE-2019-10072", url: "https://bugzilla.suse.com/1154162", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-10072", }, { cve: "CVE-2019-12418", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-12418", }, ], notes: [ { category: "general", text: "When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-12418", url: "https://www.suse.com/security/cve/CVE-2019-12418", }, { category: "external", summary: "SUSE Bug 1159723 for CVE-2019-12418", url: "https://bugzilla.suse.com/1159723", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.1, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2019-12418", }, { cve: "CVE-2019-17563", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-17563", }, ], notes: [ { category: "general", text: "When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-17563", url: "https://www.suse.com/security/cve/CVE-2019-17563", }, { category: "external", summary: "SUSE Bug 1159729 for CVE-2019-17563", url: "https://bugzilla.suse.com/1159729", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 3.4, baseSeverity: "LOW", vectorString: "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2019-17563", }, { cve: "CVE-2019-17569", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-17569", }, ], notes: [ { category: "general", text: "The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-17569", url: "https://www.suse.com/security/cve/CVE-2019-17569", }, { category: "external", summary: "SUSE Bug 1164825 for CVE-2019-17569", url: "https://bugzilla.suse.com/1164825", }, { category: "external", summary: "SUSE Bug 1165858 for CVE-2019-17569", url: "https://bugzilla.suse.com/1165858", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.8, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-17569", }, { cve: "CVE-2020-11996", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-11996", }, ], notes: [ { category: "general", text: "A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-11996", url: "https://www.suse.com/security/cve/CVE-2020-11996", }, { category: "external", summary: "SUSE Bug 1173389 for CVE-2020-11996", url: "https://bugzilla.suse.com/1173389", }, { category: "external", summary: "SUSE Bug 1201081 for CVE-2020-11996", url: "https://bugzilla.suse.com/1201081", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-11996", }, { cve: "CVE-2020-13934", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-13934", }, ], notes: [ { category: "general", text: "An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-13934", url: "https://www.suse.com/security/cve/CVE-2020-13934", }, { category: "external", summary: "SUSE Bug 1174121 for CVE-2020-13934", url: "https://bugzilla.suse.com/1174121", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-13934", }, { cve: "CVE-2020-13935", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-13935", }, ], notes: [ { category: "general", text: "The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-13935", url: "https://www.suse.com/security/cve/CVE-2020-13935", }, { category: "external", summary: "SUSE Bug 1174117 for CVE-2020-13935", url: "https://bugzilla.suse.com/1174117", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2020-13935", }, { cve: "CVE-2020-13943", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-13943", }, ], notes: [ { category: "general", text: "If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-13943", url: "https://www.suse.com/security/cve/CVE-2020-13943", }, { category: "external", summary: "SUSE Bug 1177582 for CVE-2020-13943", url: "https://bugzilla.suse.com/1177582", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-13943", }, { cve: "CVE-2020-17527", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-17527", }, ], notes: [ { category: "general", text: "While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-17527", url: "https://www.suse.com/security/cve/CVE-2020-17527", }, { category: "external", summary: "SUSE Bug 1179602 for CVE-2020-17527", url: "https://bugzilla.suse.com/1179602", }, { category: "external", summary: "SUSE Bug 1180830 for CVE-2020-17527", url: "https://bugzilla.suse.com/1180830", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2020-17527", }, { cve: "CVE-2020-1935", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-1935", }, ], notes: [ { category: "general", text: "In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-1935", url: "https://www.suse.com/security/cve/CVE-2020-1935", }, { category: "external", summary: "SUSE Bug 1164860 for CVE-2020-1935", url: "https://bugzilla.suse.com/1164860", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.8, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-1935", }, { cve: "CVE-2020-1938", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-1938", }, ], notes: [ { category: "general", text: "When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-1938", url: "https://www.suse.com/security/cve/CVE-2020-1938", }, { category: "external", summary: "SUSE Bug 1164692 for CVE-2020-1938", url: "https://bugzilla.suse.com/1164692", }, { category: "external", summary: "SUSE Bug 1166559 for CVE-2020-1938", url: "https://bugzilla.suse.com/1166559", }, { category: "external", summary: "SUSE Bug 1169066 for CVE-2020-1938", url: "https://bugzilla.suse.com/1169066", }, { category: "external", summary: "SUSE Bug 1175170 for CVE-2020-1938", url: "https://bugzilla.suse.com/1175170", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.6, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2020-1938", }, { cve: "CVE-2020-9484", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-9484", }, ], notes: [ { category: "general", text: "When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-9484", url: "https://www.suse.com/security/cve/CVE-2020-9484", }, { category: "external", summary: "SUSE Bug 1171928 for CVE-2020-9484", url: "https://bugzilla.suse.com/1171928", }, { category: "external", summary: "SUSE Bug 1182909 for CVE-2020-9484", url: "https://bugzilla.suse.com/1182909", }, { category: "external", summary: "SUSE Bug 1195255 for CVE-2020-9484", url: "https://bugzilla.suse.com/1195255", }, { category: "external", summary: "SUSE Bug 1196395 for CVE-2020-9484", url: "https://bugzilla.suse.com/1196395", }, { category: "external", summary: "SUSE Bug 1201081 for CVE-2020-9484", url: "https://bugzilla.suse.com/1201081", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2020-9484", }, { cve: "CVE-2021-24122", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-24122", }, ], notes: [ { category: "general", text: "When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-24122", url: "https://www.suse.com/security/cve/CVE-2021-24122", }, { category: "external", summary: "SUSE Bug 1180947 for CVE-2021-24122", url: "https://bugzilla.suse.com/1180947", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2021-24122", }, { cve: "CVE-2021-25122", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-25122", }, ], notes: [ { category: "general", text: "When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-25122", url: "https://www.suse.com/security/cve/CVE-2021-25122", }, { category: "external", summary: "SUSE Bug 1182912 for CVE-2021-25122", url: "https://bugzilla.suse.com/1182912", }, { category: "external", summary: "SUSE Bug 1188549 for CVE-2021-25122", url: "https://bugzilla.suse.com/1188549", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2021-25122", }, { cve: "CVE-2021-25329", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-25329", }, ], notes: [ { category: "general", text: "The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-25329", url: "https://www.suse.com/security/cve/CVE-2021-25329", }, { category: "external", summary: "SUSE Bug 1182909 for CVE-2021-25329", url: "https://bugzilla.suse.com/1182909", }, { category: "external", summary: "SUSE Bug 1200696 for CVE-2021-25329", url: "https://bugzilla.suse.com/1200696", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2021-25329", }, { cve: "CVE-2021-30640", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-30640", }, ], notes: [ { category: "general", text: "A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-30640", url: "https://www.suse.com/security/cve/CVE-2021-30640", }, { category: "external", summary: "SUSE Bug 1188279 for CVE-2021-30640", url: "https://bugzilla.suse.com/1188279", }, { category: "external", summary: "SUSE Bug 1200696 for CVE-2021-30640", url: "https://bugzilla.suse.com/1200696", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2021-30640", }, { cve: "CVE-2021-33037", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-33037", }, ], notes: [ { category: "general", text: "Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-33037", url: "https://www.suse.com/security/cve/CVE-2021-33037", }, { category: "external", summary: "SUSE Bug 1188278 for CVE-2021-33037", url: "https://bugzilla.suse.com/1188278", }, { category: "external", summary: "SUSE Bug 1200696 for CVE-2021-33037", url: "https://bugzilla.suse.com/1200696", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2021-33037", }, { cve: "CVE-2021-41079", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-41079", }, ], notes: [ { category: "general", text: "Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-41079", url: "https://www.suse.com/security/cve/CVE-2021-41079", }, { category: "external", summary: "SUSE Bug 1190558 for CVE-2021-41079", url: "https://bugzilla.suse.com/1190558", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2021-41079", }, { cve: "CVE-2021-43980", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-43980", }, ], notes: [ { category: "general", text: "The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-43980", url: "https://www.suse.com/security/cve/CVE-2021-43980", }, { category: "external", summary: "SUSE Bug 1203868 for CVE-2021-43980", url: "https://bugzilla.suse.com/1203868", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2021-43980", }, { cve: "CVE-2022-23181", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2022-23181", }, ], notes: [ { category: "general", text: "The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2022-23181", url: "https://www.suse.com/security/cve/CVE-2022-23181", }, { category: "external", summary: "SUSE Bug 1195255 for CVE-2022-23181", url: "https://bugzilla.suse.com/1195255", }, { category: "external", summary: "SUSE Bug 1196395 for CVE-2022-23181", url: "https://bugzilla.suse.com/1196395", }, { category: "external", summary: "SUSE Bug 1200696 for CVE-2022-23181", url: "https://bugzilla.suse.com/1200696", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2022-23181", }, { cve: "CVE-2022-42252", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2022-42252", }, ], notes: [ { category: "general", text: "If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2022-42252", url: "https://www.suse.com/security/cve/CVE-2022-42252", }, { category: "external", summary: "SUSE Bug 1204918 for CVE-2022-42252", url: "https://bugzilla.suse.com/1204918", }, { category: "external", summary: "SUSE Bug 1220503 for CVE-2022-42252", url: "https://bugzilla.suse.com/1220503", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2022-42252", }, { cve: "CVE-2022-45143", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2022-45143", }, ], notes: [ { category: "general", text: "The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2022-45143", url: "https://www.suse.com/security/cve/CVE-2022-45143", }, { category: "external", summary: "SUSE Bug 1206840 for CVE-2022-45143", url: "https://bugzilla.suse.com/1206840", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2022-45143", }, { cve: "CVE-2023-24998", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-24998", }, ], notes: [ { category: "general", text: "Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\n\n\n\n\nNote that, like all of the file upload limits, the\n new configuration option (FileUploadBase#setFileCountMax) is not\n enabled by default and must be explicitly configured.\n\n\n", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-24998", url: "https://www.suse.com/security/cve/CVE-2023-24998", }, { category: "external", summary: "SUSE Bug 1208513 for CVE-2023-24998", url: "https://bugzilla.suse.com/1208513", }, { category: "external", summary: "SUSE Bug 1210310 for CVE-2023-24998", url: "https://bugzilla.suse.com/1210310", }, { category: "external", summary: "SUSE Bug 1211608 for CVE-2023-24998", url: "https://bugzilla.suse.com/1211608", }, { category: "external", summary: "SUSE Bug 1228313 for CVE-2023-24998", url: "https://bugzilla.suse.com/1228313", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2023-24998", }, { cve: "CVE-2023-28708", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-28708", }, ], notes: [ { category: "general", text: "When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-28708", url: "https://www.suse.com/security/cve/CVE-2023-28708", }, { category: "external", summary: "SUSE Bug 1209622 for CVE-2023-28708", url: "https://bugzilla.suse.com/1209622", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2023-28708", }, { cve: "CVE-2023-28709", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-28709", }, ], notes: [ { category: "general", text: "The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.\n\n\n\n\n", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-28709", url: "https://www.suse.com/security/cve/CVE-2023-28709", }, { category: "external", summary: "SUSE Bug 1211608 for CVE-2023-28709", url: "https://bugzilla.suse.com/1211608", }, { category: "external", summary: "SUSE Bug 1228313 for CVE-2023-28709", url: "https://bugzilla.suse.com/1228313", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2023-28709", }, { cve: "CVE-2023-41080", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-41080", }, ], notes: [ { category: "general", text: "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.\n\nThe vulnerability is limited to the ROOT (default) web application.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-41080", url: "https://www.suse.com/security/cve/CVE-2023-41080", }, { category: "external", summary: "SUSE Bug 1214666 for CVE-2023-41080", url: "https://bugzilla.suse.com/1214666", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2023-41080", }, { cve: "CVE-2023-44487", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-44487", }, ], notes: [ { category: "general", text: "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2023-44487", url: "https://www.suse.com/security/cve/CVE-2023-44487", }, { category: "external", summary: "SUSE Bug 1216109 for CVE-2023-44487", url: "https://bugzilla.suse.com/1216109", }, { category: "external", summary: "SUSE Bug 1216123 for CVE-2023-44487", url: "https://bugzilla.suse.com/1216123", }, { category: "external", summary: "SUSE Bug 1216169 for CVE-2023-44487", url: "https://bugzilla.suse.com/1216169", }, { category: "external", summary: "SUSE Bug 1216171 for CVE-2023-44487", url: "https://bugzilla.suse.com/1216171", }, { category: "external", summary: "SUSE Bug 1216174 for CVE-2023-44487", url: "https://bugzilla.suse.com/1216174", }, { category: "external", summary: "SUSE Bug 1216176 for CVE-2023-44487", url: "https://bugzilla.suse.com/1216176", }, { category: "external", summary: "SUSE Bug 1216181 for CVE-2023-44487", url: "https://bugzilla.suse.com/1216181", }, { category: "external", summary: "SUSE Bug 1216182 for CVE-2023-44487", url: "https://bugzilla.suse.com/1216182", }, { category: "external", summary: "SUSE Bug 1216190 for CVE-2023-44487", url: "https://bugzilla.suse.com/1216190", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1.x86_64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.aarch64", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.ppc64le", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.s390x", "openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2023-44487", }, ], }
opensuse-su-2019:1673-1
Vulnerability from csaf_opensuse
Published
2019-06-30 19:03
Modified
2019-06-30 19:03
Summary
Security update for tomcat
Notes
Title of the patch
Security update for tomcat
Description of the patch
This update for tomcat to version 9.0.20 fixes the following issues:
Security issues fixed:
- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to
streams with excessive numbers of SETTINGS frames (bsc#1131055).
- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).
Non-security issues fixed:
- Increase maximum number of threads and open files for tomcat (bsc#1111966).
This update was imported from the SUSE:SLE-15:Update update project.
Patchnames
openSUSE-2019-1673
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for tomcat", title: "Title of the patch", }, { category: "description", text: "This update for tomcat to version 9.0.20 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to \n streams with excessive numbers of SETTINGS frames (bsc#1131055).\n- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).\n\nNon-security issues fixed: \n\n- Increase maximum number of threads and open files for tomcat (bsc#1111966).\n\nThis update was imported from the SUSE:SLE-15:Update update project.", title: "Description of the patch", }, { category: "details", text: "openSUSE-2019-1673", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_1673-1.json", }, { category: "self", summary: "URL for openSUSE-SU-2019:1673-1", url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/36H2KGFI64Y7Z3YTFXWV2YQODHAXC6AV/#36H2KGFI64Y7Z3YTFXWV2YQODHAXC6AV", }, { category: "self", summary: "E-Mail link for openSUSE-SU-2019:1673-1", url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/36H2KGFI64Y7Z3YTFXWV2YQODHAXC6AV/#36H2KGFI64Y7Z3YTFXWV2YQODHAXC6AV", }, { category: "self", summary: "SUSE Bug 1111966", url: "https://bugzilla.suse.com/1111966", }, { category: "self", summary: "SUSE Bug 1131055", url: "https://bugzilla.suse.com/1131055", }, { category: "self", summary: "SUSE Bug 1136085", url: "https://bugzilla.suse.com/1136085", }, { category: "self", summary: "SUSE CVE CVE-2019-0199 page", url: "https://www.suse.com/security/cve/CVE-2019-0199/", }, { category: "self", summary: "SUSE CVE CVE-2019-0221 page", url: "https://www.suse.com/security/cve/CVE-2019-0221/", }, ], title: "Security update for tomcat", tracking: { current_release_date: "2019-06-30T19:03:50Z", generator: { date: "2019-06-30T19:03:50Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "openSUSE-SU-2019:1673-1", initial_release_date: "2019-06-30T19:03:50Z", revision_history: [ { date: "2019-06-30T19:03:50Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "tomcat-9.0.20-lp150.2.19.1.noarch", product: { name: "tomcat-9.0.20-lp150.2.19.1.noarch", product_id: "tomcat-9.0.20-lp150.2.19.1.noarch", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.20-lp150.2.19.1.noarch", product: { name: "tomcat-admin-webapps-9.0.20-lp150.2.19.1.noarch", product_id: "tomcat-admin-webapps-9.0.20-lp150.2.19.1.noarch", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.20-lp150.2.19.1.noarch", product: { name: "tomcat-docs-webapp-9.0.20-lp150.2.19.1.noarch", product_id: "tomcat-docs-webapp-9.0.20-lp150.2.19.1.noarch", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.20-lp150.2.19.1.noarch", product: { name: "tomcat-el-3_0-api-9.0.20-lp150.2.19.1.noarch", product_id: "tomcat-el-3_0-api-9.0.20-lp150.2.19.1.noarch", }, }, { category: "product_version", name: "tomcat-embed-9.0.20-lp150.2.19.1.noarch", product: { name: "tomcat-embed-9.0.20-lp150.2.19.1.noarch", product_id: "tomcat-embed-9.0.20-lp150.2.19.1.noarch", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.20-lp150.2.19.1.noarch", product: { name: "tomcat-javadoc-9.0.20-lp150.2.19.1.noarch", product_id: "tomcat-javadoc-9.0.20-lp150.2.19.1.noarch", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1.noarch", product: { name: "tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1.noarch", product_id: "tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1.noarch", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.20-lp150.2.19.1.noarch", product: { name: "tomcat-jsvc-9.0.20-lp150.2.19.1.noarch", product_id: "tomcat-jsvc-9.0.20-lp150.2.19.1.noarch", }, }, { category: "product_version", name: "tomcat-lib-9.0.20-lp150.2.19.1.noarch", product: { name: "tomcat-lib-9.0.20-lp150.2.19.1.noarch", product_id: "tomcat-lib-9.0.20-lp150.2.19.1.noarch", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1.noarch", product: { name: "tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1.noarch", product_id: "tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1.noarch", }, }, { category: "product_version", name: "tomcat-webapps-9.0.20-lp150.2.19.1.noarch", product: { name: "tomcat-webapps-9.0.20-lp150.2.19.1.noarch", product_id: "tomcat-webapps-9.0.20-lp150.2.19.1.noarch", }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_name", name: "openSUSE Leap 15.0", product: { name: "openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0", product_identification_helper: { cpe: "cpe:/o:opensuse:leap:15.0", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "tomcat-9.0.20-lp150.2.19.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-9.0.20-lp150.2.19.1.noarch", }, product_reference: "tomcat-9.0.20-lp150.2.19.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.20-lp150.2.19.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-admin-webapps-9.0.20-lp150.2.19.1.noarch", }, product_reference: "tomcat-admin-webapps-9.0.20-lp150.2.19.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.20-lp150.2.19.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-docs-webapp-9.0.20-lp150.2.19.1.noarch", }, product_reference: "tomcat-docs-webapp-9.0.20-lp150.2.19.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.20-lp150.2.19.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-el-3_0-api-9.0.20-lp150.2.19.1.noarch", }, product_reference: "tomcat-el-3_0-api-9.0.20-lp150.2.19.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-embed-9.0.20-lp150.2.19.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-embed-9.0.20-lp150.2.19.1.noarch", }, product_reference: "tomcat-embed-9.0.20-lp150.2.19.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.20-lp150.2.19.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-javadoc-9.0.20-lp150.2.19.1.noarch", }, product_reference: "tomcat-javadoc-9.0.20-lp150.2.19.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1.noarch", }, product_reference: "tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsvc-9.0.20-lp150.2.19.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-jsvc-9.0.20-lp150.2.19.1.noarch", }, product_reference: "tomcat-jsvc-9.0.20-lp150.2.19.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.20-lp150.2.19.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-lib-9.0.20-lp150.2.19.1.noarch", }, product_reference: "tomcat-lib-9.0.20-lp150.2.19.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1.noarch", }, product_reference: "tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.20-lp150.2.19.1.noarch as component of openSUSE Leap 15.0", product_id: "openSUSE Leap 15.0:tomcat-webapps-9.0.20-lp150.2.19.1.noarch", }, product_reference: "tomcat-webapps-9.0.20-lp150.2.19.1.noarch", relates_to_product_reference: "openSUSE Leap 15.0", }, ], }, vulnerabilities: [ { cve: "CVE-2019-0199", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0199", }, ], notes: [ { category: "general", text: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Leap 15.0:tomcat-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-admin-webapps-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-docs-webapp-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-el-3_0-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-embed-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-javadoc-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-jsvc-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-lib-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-webapps-9.0.20-lp150.2.19.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-0199", url: "https://www.suse.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "SUSE Bug 1131055 for CVE-2019-0199", url: "https://bugzilla.suse.com/1131055", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-0199", url: "https://bugzilla.suse.com/1139924", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Leap 15.0:tomcat-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-admin-webapps-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-docs-webapp-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-el-3_0-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-embed-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-javadoc-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-jsvc-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-lib-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-webapps-9.0.20-lp150.2.19.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Leap 15.0:tomcat-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-admin-webapps-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-docs-webapp-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-el-3_0-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-embed-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-javadoc-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-jsvc-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-lib-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-webapps-9.0.20-lp150.2.19.1.noarch", ], }, ], threats: [ { category: "impact", date: "2019-06-30T19:03:50Z", details: "important", }, ], title: "CVE-2019-0199", }, { cve: "CVE-2019-0221", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0221", }, ], notes: [ { category: "general", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Leap 15.0:tomcat-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-admin-webapps-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-docs-webapp-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-el-3_0-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-embed-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-javadoc-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-jsvc-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-lib-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-webapps-9.0.20-lp150.2.19.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-0221", url: "https://www.suse.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "SUSE Bug 1136085 for CVE-2019-0221", url: "https://bugzilla.suse.com/1136085", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Leap 15.0:tomcat-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-admin-webapps-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-docs-webapp-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-el-3_0-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-embed-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-javadoc-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-jsvc-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-lib-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-webapps-9.0.20-lp150.2.19.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "openSUSE Leap 15.0:tomcat-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-admin-webapps-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-docs-webapp-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-el-3_0-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-embed-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-javadoc-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-jsp-2_3-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-jsvc-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-lib-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-servlet-4_0-api-9.0.20-lp150.2.19.1.noarch", "openSUSE Leap 15.0:tomcat-webapps-9.0.20-lp150.2.19.1.noarch", ], }, ], threats: [ { category: "impact", date: "2019-06-30T19:03:50Z", details: "low", }, ], title: "CVE-2019-0221", }, ], }
opensuse-su-2019:1808-1
Vulnerability from csaf_opensuse
Published
2019-07-25 08:21
Modified
2019-07-25 08:21
Summary
Security update for tomcat
Notes
Title of the patch
Security update for tomcat
Description of the patch
This update for tomcat to version 9.0.21 fixes the following issues:
Security issues fixed:
- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to
streams with excessive numbers of SETTINGS frames (bsc#1131055).
- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).
Non-security issues fixed:
- Increase maximum number of threads and open files for tomcat (bsc#1111966).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
Patchnames
openSUSE-2019-1808
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for tomcat", title: "Title of the patch", }, { category: "description", text: "This update for tomcat to version 9.0.21 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to \n streams with excessive numbers of SETTINGS frames (bsc#1131055).\n- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).\n\nNon-security issues fixed: \n\n- Increase maximum number of threads and open files for tomcat (bsc#1111966).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.", title: "Description of the patch", }, { category: "details", text: "openSUSE-2019-1808", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_1808-1.json", }, { category: "self", summary: "URL for openSUSE-SU-2019:1808-1", url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QG2SPH2GUSXWEVOOJMUB4WVQPKM3QPV6/#QG2SPH2GUSXWEVOOJMUB4WVQPKM3QPV6", }, { category: "self", summary: "E-Mail link for openSUSE-SU-2019:1808-1", url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QG2SPH2GUSXWEVOOJMUB4WVQPKM3QPV6/#QG2SPH2GUSXWEVOOJMUB4WVQPKM3QPV6", }, { category: "self", summary: "SUSE Bug 1111966", url: "https://bugzilla.suse.com/1111966", }, { category: "self", summary: "SUSE Bug 1131055", url: "https://bugzilla.suse.com/1131055", }, { category: "self", summary: "SUSE Bug 1136085", url: "https://bugzilla.suse.com/1136085", }, { category: "self", summary: "SUSE CVE CVE-2019-0199 page", url: "https://www.suse.com/security/cve/CVE-2019-0199/", }, { category: "self", summary: "SUSE CVE CVE-2019-0221 page", url: "https://www.suse.com/security/cve/CVE-2019-0221/", }, ], title: "Security update for tomcat", tracking: { current_release_date: "2019-07-25T08:21:02Z", generator: { date: "2019-07-25T08:21:02Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "openSUSE-SU-2019:1808-1", initial_release_date: "2019-07-25T08:21:02Z", revision_history: [ { date: "2019-07-25T08:21:02Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "tomcat-9.0.21-lp151.3.3.1.noarch", product: { name: "tomcat-9.0.21-lp151.3.3.1.noarch", product_id: "tomcat-9.0.21-lp151.3.3.1.noarch", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.21-lp151.3.3.1.noarch", product: { name: "tomcat-admin-webapps-9.0.21-lp151.3.3.1.noarch", product_id: "tomcat-admin-webapps-9.0.21-lp151.3.3.1.noarch", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.21-lp151.3.3.1.noarch", product: { name: "tomcat-docs-webapp-9.0.21-lp151.3.3.1.noarch", product_id: "tomcat-docs-webapp-9.0.21-lp151.3.3.1.noarch", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.21-lp151.3.3.1.noarch", product: { name: "tomcat-el-3_0-api-9.0.21-lp151.3.3.1.noarch", product_id: "tomcat-el-3_0-api-9.0.21-lp151.3.3.1.noarch", }, }, { category: "product_version", name: "tomcat-embed-9.0.21-lp151.3.3.1.noarch", product: { name: "tomcat-embed-9.0.21-lp151.3.3.1.noarch", product_id: "tomcat-embed-9.0.21-lp151.3.3.1.noarch", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.21-lp151.3.3.1.noarch", product: { name: "tomcat-javadoc-9.0.21-lp151.3.3.1.noarch", product_id: "tomcat-javadoc-9.0.21-lp151.3.3.1.noarch", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1.noarch", product: { name: "tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1.noarch", product_id: "tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1.noarch", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.21-lp151.3.3.1.noarch", product: { name: "tomcat-jsvc-9.0.21-lp151.3.3.1.noarch", product_id: "tomcat-jsvc-9.0.21-lp151.3.3.1.noarch", }, }, { category: "product_version", name: "tomcat-lib-9.0.21-lp151.3.3.1.noarch", product: { name: "tomcat-lib-9.0.21-lp151.3.3.1.noarch", product_id: "tomcat-lib-9.0.21-lp151.3.3.1.noarch", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1.noarch", product: { name: "tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1.noarch", product_id: "tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1.noarch", }, }, { category: "product_version", name: "tomcat-webapps-9.0.21-lp151.3.3.1.noarch", product: { name: "tomcat-webapps-9.0.21-lp151.3.3.1.noarch", product_id: "tomcat-webapps-9.0.21-lp151.3.3.1.noarch", }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_name", name: "openSUSE Leap 15.1", product: { name: "openSUSE Leap 15.1", product_id: "openSUSE Leap 15.1", product_identification_helper: { cpe: "cpe:/o:opensuse:leap:15.1", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "tomcat-9.0.21-lp151.3.3.1.noarch as component of openSUSE Leap 15.1", product_id: "openSUSE Leap 15.1:tomcat-9.0.21-lp151.3.3.1.noarch", }, product_reference: "tomcat-9.0.21-lp151.3.3.1.noarch", relates_to_product_reference: "openSUSE Leap 15.1", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.21-lp151.3.3.1.noarch as component of openSUSE Leap 15.1", product_id: "openSUSE Leap 15.1:tomcat-admin-webapps-9.0.21-lp151.3.3.1.noarch", }, product_reference: "tomcat-admin-webapps-9.0.21-lp151.3.3.1.noarch", relates_to_product_reference: "openSUSE Leap 15.1", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.21-lp151.3.3.1.noarch as component of openSUSE Leap 15.1", product_id: "openSUSE Leap 15.1:tomcat-docs-webapp-9.0.21-lp151.3.3.1.noarch", }, product_reference: "tomcat-docs-webapp-9.0.21-lp151.3.3.1.noarch", relates_to_product_reference: "openSUSE Leap 15.1", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.21-lp151.3.3.1.noarch as component of openSUSE Leap 15.1", product_id: "openSUSE Leap 15.1:tomcat-el-3_0-api-9.0.21-lp151.3.3.1.noarch", }, product_reference: "tomcat-el-3_0-api-9.0.21-lp151.3.3.1.noarch", relates_to_product_reference: "openSUSE Leap 15.1", }, { category: "default_component_of", full_product_name: { name: "tomcat-embed-9.0.21-lp151.3.3.1.noarch as component of openSUSE Leap 15.1", product_id: "openSUSE Leap 15.1:tomcat-embed-9.0.21-lp151.3.3.1.noarch", }, product_reference: "tomcat-embed-9.0.21-lp151.3.3.1.noarch", relates_to_product_reference: "openSUSE Leap 15.1", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.21-lp151.3.3.1.noarch as component of openSUSE Leap 15.1", product_id: "openSUSE Leap 15.1:tomcat-javadoc-9.0.21-lp151.3.3.1.noarch", }, product_reference: "tomcat-javadoc-9.0.21-lp151.3.3.1.noarch", relates_to_product_reference: "openSUSE Leap 15.1", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1.noarch as component of openSUSE Leap 15.1", product_id: "openSUSE Leap 15.1:tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1.noarch", }, product_reference: "tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1.noarch", relates_to_product_reference: "openSUSE Leap 15.1", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsvc-9.0.21-lp151.3.3.1.noarch as component of openSUSE Leap 15.1", product_id: "openSUSE Leap 15.1:tomcat-jsvc-9.0.21-lp151.3.3.1.noarch", }, product_reference: "tomcat-jsvc-9.0.21-lp151.3.3.1.noarch", relates_to_product_reference: "openSUSE Leap 15.1", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.21-lp151.3.3.1.noarch as component of openSUSE Leap 15.1", product_id: "openSUSE Leap 15.1:tomcat-lib-9.0.21-lp151.3.3.1.noarch", }, product_reference: "tomcat-lib-9.0.21-lp151.3.3.1.noarch", relates_to_product_reference: "openSUSE Leap 15.1", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1.noarch as component of openSUSE Leap 15.1", product_id: "openSUSE Leap 15.1:tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1.noarch", }, product_reference: "tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1.noarch", relates_to_product_reference: "openSUSE Leap 15.1", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.21-lp151.3.3.1.noarch as component of openSUSE Leap 15.1", product_id: "openSUSE Leap 15.1:tomcat-webapps-9.0.21-lp151.3.3.1.noarch", }, product_reference: "tomcat-webapps-9.0.21-lp151.3.3.1.noarch", relates_to_product_reference: "openSUSE Leap 15.1", }, ], }, vulnerabilities: [ { cve: "CVE-2019-0199", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0199", }, ], notes: [ { category: "general", text: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Leap 15.1:tomcat-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-admin-webapps-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-docs-webapp-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-el-3_0-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-embed-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-javadoc-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-jsvc-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-lib-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-webapps-9.0.21-lp151.3.3.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-0199", url: "https://www.suse.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "SUSE Bug 1131055 for CVE-2019-0199", url: "https://bugzilla.suse.com/1131055", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-0199", url: "https://bugzilla.suse.com/1139924", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Leap 15.1:tomcat-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-admin-webapps-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-docs-webapp-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-el-3_0-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-embed-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-javadoc-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-jsvc-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-lib-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-webapps-9.0.21-lp151.3.3.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Leap 15.1:tomcat-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-admin-webapps-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-docs-webapp-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-el-3_0-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-embed-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-javadoc-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-jsvc-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-lib-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-webapps-9.0.21-lp151.3.3.1.noarch", ], }, ], threats: [ { category: "impact", date: "2019-07-25T08:21:02Z", details: "important", }, ], title: "CVE-2019-0199", }, { cve: "CVE-2019-0221", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0221", }, ], notes: [ { category: "general", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Leap 15.1:tomcat-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-admin-webapps-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-docs-webapp-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-el-3_0-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-embed-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-javadoc-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-jsvc-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-lib-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-webapps-9.0.21-lp151.3.3.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-0221", url: "https://www.suse.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "SUSE Bug 1136085 for CVE-2019-0221", url: "https://bugzilla.suse.com/1136085", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Leap 15.1:tomcat-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-admin-webapps-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-docs-webapp-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-el-3_0-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-embed-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-javadoc-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-jsvc-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-lib-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-webapps-9.0.21-lp151.3.3.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "openSUSE Leap 15.1:tomcat-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-admin-webapps-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-docs-webapp-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-el-3_0-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-embed-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-javadoc-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-jsp-2_3-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-jsvc-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-lib-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-servlet-4_0-api-9.0.21-lp151.3.3.1.noarch", "openSUSE Leap 15.1:tomcat-webapps-9.0.21-lp151.3.3.1.noarch", ], }, ], threats: [ { category: "impact", date: "2019-07-25T08:21:02Z", details: "low", }, ], title: "CVE-2019-0221", }, ], }
WID-SEC-W-2024-0528
Vulnerability from csaf_certbund
Published
2024-02-29 23:00
Modified
2024-02-29 23:00
Summary
Dell Data Protection Advisor: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Data Protection Advisor ist eine Monitoring Lösung. Der Collector ist der lokale Agent.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.
Betroffene Betriebssysteme
- Windows
{ document: { aggregate_severity: { text: "hoch", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Data Protection Advisor ist eine Monitoring Lösung. Der Collector ist der lokale Agent.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", title: "Angriff", }, { category: "general", text: "- Windows", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2024-0528 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0528.json", }, { category: "self", summary: "WID-SEC-2024-0528 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0528", }, { category: "external", summary: "Dell Security Advisory DSA-2024-107 vom 2024-02-29", url: "https://www.dell.com/support/kbdoc/000222618/dsa-2024-=", }, ], source_lang: "en-US", title: "Dell Data Protection Advisor: Mehrere Schwachstellen", tracking: { current_release_date: "2024-02-29T23:00:00.000+00:00", generator: { date: "2024-08-15T18:05:58.480+00:00", engine: { name: "BSI-WID", version: "1.3.5", }, }, id: "WID-SEC-W-2024-0528", initial_release_date: "2024-02-29T23:00:00.000+00:00", revision_history: [ { date: "2024-02-29T23:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version_range", name: "< 19.10", product: { name: "Dell Data Protection Advisor < 19.10", product_id: "T033198", }, }, ], category: "product_name", name: "Data Protection Advisor", }, ], category: "vendor", name: "Dell", }, ], }, vulnerabilities: [ { cve: "CVE-2023-45648", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-45648", }, { cve: "CVE-2023-42795", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-42795", }, { cve: "CVE-2023-41080", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-41080", }, { cve: "CVE-2023-34055", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-34055", }, { cve: "CVE-2023-28708", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-28708", }, { cve: "CVE-2023-28154", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-28154", }, { cve: "CVE-2023-22081", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-22081", }, { cve: "CVE-2023-22067", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-22067", }, { cve: "CVE-2023-22025", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-22025", }, { cve: "CVE-2023-20883", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-20883", }, { cve: "CVE-2023-20873", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-20873", }, { cve: "CVE-2023-20863", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-20863", }, { cve: "CVE-2023-20861", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-20861", }, { cve: "CVE-2022-46175", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-46175", }, { cve: "CVE-2022-41854", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-41854", }, { cve: "CVE-2022-38752", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-38752", }, { cve: "CVE-2022-38751", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-38751", }, { cve: "CVE-2022-38750", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-38750", }, { cve: "CVE-2022-38749", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-38749", }, { cve: "CVE-2022-37603", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-37603", }, { cve: "CVE-2022-37601", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-37601", }, { cve: "CVE-2022-37599", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-37599", }, { cve: "CVE-2022-31129", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-31129", }, { cve: "CVE-2022-27772", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-27772", }, { cve: "CVE-2022-25881", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-25881", }, { cve: "CVE-2022-25858", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-25858", }, { cve: "CVE-2022-22971", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-22971", }, { cve: "CVE-2022-22970", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-22970", }, { cve: "CVE-2022-22968", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-22968", }, { cve: "CVE-2022-22965", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-22965", }, { cve: "CVE-2022-22950", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-22950", }, { cve: "CVE-2021-43980", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2021-43980", }, { cve: "CVE-2021-33037", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2021-33037", }, { cve: "CVE-2021-30640", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2021-30640", }, { cve: "CVE-2020-5421", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-5421", }, { cve: "CVE-2020-1938", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-1938", }, { cve: "CVE-2020-1935", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-1935", }, { cve: "CVE-2020-13943", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-13943", }, { cve: "CVE-2020-13935", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-13935", }, { cve: "CVE-2020-13934", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-13934", }, { cve: "CVE-2020-11996", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-11996", }, { cve: "CVE-2019-2684", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-2684", }, { cve: "CVE-2019-17563", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-17563", }, { cve: "CVE-2019-12418", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-12418", }, { cve: "CVE-2019-10072", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-10072", }, { cve: "CVE-2019-0232", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-0232", }, { cve: "CVE-2019-0221", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-0221", }, { cve: "CVE-2019-0199", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-0199", }, { cve: "CVE-2018-8037", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-8037", }, { cve: "CVE-2018-8034", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-8034", }, { cve: "CVE-2018-8014", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-8014", }, { cve: "CVE-2018-15756", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-15756", }, { cve: "CVE-2018-1336", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1336", }, { cve: "CVE-2018-1305", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1305", }, { cve: "CVE-2018-1304", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1304", }, { cve: "CVE-2018-1275", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1275", }, { cve: "CVE-2018-1272", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1272", }, { cve: "CVE-2018-1271", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1271", }, { cve: "CVE-2018-1270", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1270", }, { cve: "CVE-2018-1257", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1257", }, { cve: "CVE-2018-1199", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1199", }, { cve: "CVE-2018-1196", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1196", }, { cve: "CVE-2018-11784", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-11784", }, { cve: "CVE-2018-11040", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-11040", }, { cve: "CVE-2018-11039", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-11039", }, { cve: "CVE-2017-8046", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-8046", }, { cve: "CVE-2017-7675", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-7675", }, { cve: "CVE-2017-7674", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-7674", }, { cve: "CVE-2017-5664", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-5664", }, { cve: "CVE-2017-5651", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-5651", }, { cve: "CVE-2017-5650", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-5650", }, { cve: "CVE-2017-5648", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-5648", }, { cve: "CVE-2017-5647", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-5647", }, { cve: "CVE-2017-18640", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-18640", }, { cve: "CVE-2017-12617", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-12617", }, { cve: "CVE-2016-9878", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2016-9878", }, { cve: "CVE-2016-8745", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2016-8745", }, { cve: "CVE-2016-8735", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2016-8735", }, { cve: "CVE-2016-6817", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2016-6817", }, { cve: "CVE-2016-6816", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2016-6816", }, ], }
wid-sec-w-2024-0528
Vulnerability from csaf_certbund
Published
2024-02-29 23:00
Modified
2024-02-29 23:00
Summary
Dell Data Protection Advisor: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Data Protection Advisor ist eine Monitoring Lösung. Der Collector ist der lokale Agent.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.
Betroffene Betriebssysteme
- Windows
{ document: { aggregate_severity: { text: "hoch", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Data Protection Advisor ist eine Monitoring Lösung. Der Collector ist der lokale Agent.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", title: "Angriff", }, { category: "general", text: "- Windows", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2024-0528 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0528.json", }, { category: "self", summary: "WID-SEC-2024-0528 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0528", }, { category: "external", summary: "Dell Security Advisory DSA-2024-107 vom 2024-02-29", url: "https://www.dell.com/support/kbdoc/000222618/dsa-2024-=", }, ], source_lang: "en-US", title: "Dell Data Protection Advisor: Mehrere Schwachstellen", tracking: { current_release_date: "2024-02-29T23:00:00.000+00:00", generator: { date: "2024-08-15T18:05:58.480+00:00", engine: { name: "BSI-WID", version: "1.3.5", }, }, id: "WID-SEC-W-2024-0528", initial_release_date: "2024-02-29T23:00:00.000+00:00", revision_history: [ { date: "2024-02-29T23:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version_range", name: "< 19.10", product: { name: "Dell Data Protection Advisor < 19.10", product_id: "T033198", }, }, ], category: "product_name", name: "Data Protection Advisor", }, ], category: "vendor", name: "Dell", }, ], }, vulnerabilities: [ { cve: "CVE-2023-45648", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-45648", }, { cve: "CVE-2023-42795", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-42795", }, { cve: "CVE-2023-41080", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-41080", }, { cve: "CVE-2023-34055", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-34055", }, { cve: "CVE-2023-28708", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-28708", }, { cve: "CVE-2023-28154", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-28154", }, { cve: "CVE-2023-22081", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-22081", }, { cve: "CVE-2023-22067", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-22067", }, { cve: "CVE-2023-22025", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-22025", }, { cve: "CVE-2023-20883", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-20883", }, { cve: "CVE-2023-20873", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-20873", }, { cve: "CVE-2023-20863", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-20863", }, { cve: "CVE-2023-20861", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2023-20861", }, { cve: "CVE-2022-46175", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-46175", }, { cve: "CVE-2022-41854", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-41854", }, { cve: "CVE-2022-38752", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-38752", }, { cve: "CVE-2022-38751", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-38751", }, { cve: "CVE-2022-38750", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-38750", }, { cve: "CVE-2022-38749", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-38749", }, { cve: "CVE-2022-37603", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-37603", }, { cve: "CVE-2022-37601", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-37601", }, { cve: "CVE-2022-37599", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-37599", }, { cve: "CVE-2022-31129", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-31129", }, { cve: "CVE-2022-27772", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-27772", }, { cve: "CVE-2022-25881", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-25881", }, { cve: "CVE-2022-25858", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-25858", }, { cve: "CVE-2022-22971", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-22971", }, { cve: "CVE-2022-22970", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-22970", }, { cve: "CVE-2022-22968", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-22968", }, { cve: "CVE-2022-22965", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-22965", }, { cve: "CVE-2022-22950", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2022-22950", }, { cve: "CVE-2021-43980", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2021-43980", }, { cve: "CVE-2021-33037", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2021-33037", }, { cve: "CVE-2021-30640", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2021-30640", }, { cve: "CVE-2020-5421", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-5421", }, { cve: "CVE-2020-1938", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-1938", }, { cve: "CVE-2020-1935", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-1935", }, { cve: "CVE-2020-13943", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-13943", }, { cve: "CVE-2020-13935", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-13935", }, { cve: "CVE-2020-13934", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-13934", }, { cve: "CVE-2020-11996", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2020-11996", }, { cve: "CVE-2019-2684", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-2684", }, { cve: "CVE-2019-17563", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-17563", }, { cve: "CVE-2019-12418", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-12418", }, { cve: "CVE-2019-10072", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-10072", }, { cve: "CVE-2019-0232", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-0232", }, { cve: "CVE-2019-0221", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-0221", }, { cve: "CVE-2019-0199", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2019-0199", }, { cve: "CVE-2018-8037", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-8037", }, { cve: "CVE-2018-8034", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-8034", }, { cve: "CVE-2018-8014", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-8014", }, { cve: "CVE-2018-15756", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-15756", }, { cve: "CVE-2018-1336", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1336", }, { cve: "CVE-2018-1305", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1305", }, { cve: "CVE-2018-1304", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1304", }, { cve: "CVE-2018-1275", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1275", }, { cve: "CVE-2018-1272", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1272", }, { cve: "CVE-2018-1271", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1271", }, { cve: "CVE-2018-1270", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1270", }, { cve: "CVE-2018-1257", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1257", }, { cve: "CVE-2018-1199", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1199", }, { cve: "CVE-2018-1196", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-1196", }, { cve: "CVE-2018-11784", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-11784", }, { cve: "CVE-2018-11040", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-11040", }, { cve: "CVE-2018-11039", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2018-11039", }, { cve: "CVE-2017-8046", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-8046", }, { cve: "CVE-2017-7675", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-7675", }, { cve: "CVE-2017-7674", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-7674", }, { cve: "CVE-2017-5664", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-5664", }, { cve: "CVE-2017-5651", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-5651", }, { cve: "CVE-2017-5650", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-5650", }, { cve: "CVE-2017-5648", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-5648", }, { cve: "CVE-2017-5647", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-5647", }, { cve: "CVE-2017-18640", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-18640", }, { cve: "CVE-2017-12617", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2017-12617", }, { cve: "CVE-2016-9878", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2016-9878", }, { cve: "CVE-2016-8745", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2016-8745", }, { cve: "CVE-2016-8735", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2016-8735", }, { cve: "CVE-2016-6817", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2016-6817", }, { cve: "CVE-2016-6816", notes: [ { category: "description", text: "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuführen.", }, ], release_date: "2024-02-29T23:00:00.000+00:00", title: "CVE-2016-6816", }, ], }
suse-su-2019:1895-1
Vulnerability from csaf_suse
Published
2019-07-18 14:26
Modified
2019-07-18 14:26
Summary
Security update for tomcat
Notes
Title of the patch
Security update for tomcat
Description of the patch
This update for tomcat to version 9.0.21 fixes the following issues:
Security issues fixed:
- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to
streams with excessive numbers of SETTINGS frames (bsc#1131055).
- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).
Non-security issues fixed:
- Increase maximum number of threads and open files for tomcat (bsc#1111966).
Patchnames
SUSE-2019-1895,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-1895,SUSE-SLE-Module-Web-Scripting-15-SP1-2019-1895
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for tomcat", title: "Title of the patch", }, { category: "description", text: "This update for tomcat to version 9.0.21 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to \n streams with excessive numbers of SETTINGS frames (bsc#1131055).\n- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).\n\nNon-security issues fixed: \n\n- Increase maximum number of threads and open files for tomcat (bsc#1111966).\n", title: "Description of the patch", }, { category: "details", text: "SUSE-2019-1895,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-1895,SUSE-SLE-Module-Web-Scripting-15-SP1-2019-1895", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_1895-1.json", }, { category: "self", summary: "URL for SUSE-SU-2019:1895-1", url: "https://www.suse.com/support/update/announcement/2019/suse-su-20191895-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2019:1895-1", url: "https://lists.suse.com/pipermail/sle-security-updates/2019-July/005736.html", }, { category: "self", summary: "SUSE Bug 1111966", url: "https://bugzilla.suse.com/1111966", }, { category: "self", summary: "SUSE Bug 1131055", url: "https://bugzilla.suse.com/1131055", }, { category: "self", summary: "SUSE Bug 1136085", url: "https://bugzilla.suse.com/1136085", }, { category: "self", summary: "SUSE CVE CVE-2019-0199 page", url: "https://www.suse.com/security/cve/CVE-2019-0199/", }, { category: "self", summary: "SUSE CVE CVE-2019-0221 page", url: "https://www.suse.com/security/cve/CVE-2019-0221/", }, ], title: "Security update for tomcat", tracking: { current_release_date: "2019-07-18T14:26:09Z", generator: { date: "2019-07-18T14:26:09Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2019:1895-1", initial_release_date: "2019-07-18T14:26:09Z", revision_history: [ { date: "2019-07-18T14:26:09Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "tomcat-9.0.21-4.5.5.noarch", product: { name: "tomcat-9.0.21-4.5.5.noarch", product_id: "tomcat-9.0.21-4.5.5.noarch", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.21-4.5.5.noarch", product: { name: "tomcat-admin-webapps-9.0.21-4.5.5.noarch", product_id: "tomcat-admin-webapps-9.0.21-4.5.5.noarch", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.21-4.5.5.noarch", product: { name: "tomcat-docs-webapp-9.0.21-4.5.5.noarch", product_id: "tomcat-docs-webapp-9.0.21-4.5.5.noarch", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.21-4.5.5.noarch", product: { name: "tomcat-el-3_0-api-9.0.21-4.5.5.noarch", product_id: "tomcat-el-3_0-api-9.0.21-4.5.5.noarch", }, }, { category: "product_version", name: "tomcat-embed-9.0.21-4.5.5.noarch", product: { name: "tomcat-embed-9.0.21-4.5.5.noarch", product_id: "tomcat-embed-9.0.21-4.5.5.noarch", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.21-4.5.5.noarch", product: { name: "tomcat-javadoc-9.0.21-4.5.5.noarch", product_id: "tomcat-javadoc-9.0.21-4.5.5.noarch", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.21-4.5.5.noarch", product: { name: "tomcat-jsp-2_3-api-9.0.21-4.5.5.noarch", product_id: "tomcat-jsp-2_3-api-9.0.21-4.5.5.noarch", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.21-4.5.5.noarch", product: { name: "tomcat-jsvc-9.0.21-4.5.5.noarch", product_id: "tomcat-jsvc-9.0.21-4.5.5.noarch", }, }, { category: "product_version", name: "tomcat-lib-9.0.21-4.5.5.noarch", product: { name: "tomcat-lib-9.0.21-4.5.5.noarch", product_id: "tomcat-lib-9.0.21-4.5.5.noarch", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.21-4.5.5.noarch", product: { name: "tomcat-servlet-4_0-api-9.0.21-4.5.5.noarch", product_id: "tomcat-servlet-4_0-api-9.0.21-4.5.5.noarch", }, }, { category: "product_version", name: "tomcat-webapps-9.0.21-4.5.5.noarch", product: { name: "tomcat-webapps-9.0.21-4.5.5.noarch", product_id: "tomcat-webapps-9.0.21-4.5.5.noarch", }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_name", name: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1", product: { name: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1", product_identification_helper: { cpe: "cpe:/o:suse:sle-module-web-scripting:15:sp1", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "tomcat-9.0.21-4.5.5.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-9.0.21-4.5.5.noarch", }, product_reference: "tomcat-9.0.21-4.5.5.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.21-4.5.5.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-admin-webapps-9.0.21-4.5.5.noarch", }, product_reference: "tomcat-admin-webapps-9.0.21-4.5.5.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.21-4.5.5.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-el-3_0-api-9.0.21-4.5.5.noarch", }, product_reference: "tomcat-el-3_0-api-9.0.21-4.5.5.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.21-4.5.5.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-jsp-2_3-api-9.0.21-4.5.5.noarch", }, product_reference: "tomcat-jsp-2_3-api-9.0.21-4.5.5.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.21-4.5.5.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-lib-9.0.21-4.5.5.noarch", }, product_reference: "tomcat-lib-9.0.21-4.5.5.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.21-4.5.5.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-servlet-4_0-api-9.0.21-4.5.5.noarch", }, product_reference: "tomcat-servlet-4_0-api-9.0.21-4.5.5.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.21-4.5.5.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-webapps-9.0.21-4.5.5.noarch", }, product_reference: "tomcat-webapps-9.0.21-4.5.5.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP1", }, ], }, vulnerabilities: [ { cve: "CVE-2019-0199", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0199", }, ], notes: [ { category: "general", text: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-admin-webapps-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-el-3_0-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-jsp-2_3-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-lib-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-servlet-4_0-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-webapps-9.0.21-4.5.5.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-0199", url: "https://www.suse.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "SUSE Bug 1131055 for CVE-2019-0199", url: "https://bugzilla.suse.com/1131055", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-0199", url: "https://bugzilla.suse.com/1139924", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-admin-webapps-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-el-3_0-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-jsp-2_3-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-lib-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-servlet-4_0-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-webapps-9.0.21-4.5.5.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-admin-webapps-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-el-3_0-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-jsp-2_3-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-lib-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-servlet-4_0-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-webapps-9.0.21-4.5.5.noarch", ], }, ], threats: [ { category: "impact", date: "2019-07-18T14:26:09Z", details: "important", }, ], title: "CVE-2019-0199", }, { cve: "CVE-2019-0221", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0221", }, ], notes: [ { category: "general", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-admin-webapps-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-el-3_0-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-jsp-2_3-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-lib-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-servlet-4_0-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-webapps-9.0.21-4.5.5.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-0221", url: "https://www.suse.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "SUSE Bug 1136085 for CVE-2019-0221", url: "https://bugzilla.suse.com/1136085", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-admin-webapps-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-el-3_0-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-jsp-2_3-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-lib-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-servlet-4_0-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-webapps-9.0.21-4.5.5.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-admin-webapps-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-el-3_0-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-jsp-2_3-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-lib-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-servlet-4_0-api-9.0.21-4.5.5.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-webapps-9.0.21-4.5.5.noarch", ], }, ], threats: [ { category: "impact", date: "2019-07-18T14:26:09Z", details: "low", }, ], title: "CVE-2019-0221", }, ], }
suse-su-2019:1825-1
Vulnerability from csaf_suse
Published
2019-07-12 07:30
Modified
2019-07-12 07:30
Summary
Security update for tomcat
Notes
Title of the patch
Security update for tomcat
Description of the patch
This update for tomcat to version 9.0.21 fixes the following issues:
Security issue fixed:
- CVE-2019-0199: Added additional fixes to address HTTP/2 connection window exhaustion (bsc#1139924).
Patchnames
SUSE-2019-1825,SUSE-SLE-Module-Development-Tools-OBS-15-2019-1825,SUSE-SLE-Module-Web-Scripting-15-2019-1825
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for tomcat", title: "Title of the patch", }, { category: "description", text: "This update for tomcat to version 9.0.21 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-0199: Added additional fixes to address HTTP/2 connection window exhaustion (bsc#1139924).\n", title: "Description of the patch", }, { category: "details", text: "SUSE-2019-1825,SUSE-SLE-Module-Development-Tools-OBS-15-2019-1825,SUSE-SLE-Module-Web-Scripting-15-2019-1825", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_1825-1.json", }, { category: "self", summary: "URL for SUSE-SU-2019:1825-1", url: "https://www.suse.com/support/update/announcement/2019/suse-su-20191825-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2019:1825-1", url: "https://lists.suse.com/pipermail/sle-security-updates/2019-July/005698.html", }, { category: "self", summary: "SUSE Bug 1139924", url: "https://bugzilla.suse.com/1139924", }, { category: "self", summary: "SUSE CVE CVE-2019-0199 page", url: "https://www.suse.com/security/cve/CVE-2019-0199/", }, ], title: "Security update for tomcat", tracking: { current_release_date: "2019-07-12T07:30:47Z", generator: { date: "2019-07-12T07:30:47Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2019:1825-1", initial_release_date: "2019-07-12T07:30:47Z", revision_history: [ { date: "2019-07-12T07:30:47Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "tomcat-9.0.21-3.27.1.noarch", product: { name: "tomcat-9.0.21-3.27.1.noarch", product_id: "tomcat-9.0.21-3.27.1.noarch", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.21-3.27.1.noarch", product: { name: "tomcat-admin-webapps-9.0.21-3.27.1.noarch", product_id: "tomcat-admin-webapps-9.0.21-3.27.1.noarch", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.21-3.27.1.noarch", product: { name: "tomcat-docs-webapp-9.0.21-3.27.1.noarch", product_id: "tomcat-docs-webapp-9.0.21-3.27.1.noarch", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.21-3.27.1.noarch", product: { name: "tomcat-el-3_0-api-9.0.21-3.27.1.noarch", product_id: "tomcat-el-3_0-api-9.0.21-3.27.1.noarch", }, }, { category: "product_version", name: "tomcat-embed-9.0.21-3.27.1.noarch", product: { name: "tomcat-embed-9.0.21-3.27.1.noarch", product_id: "tomcat-embed-9.0.21-3.27.1.noarch", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.21-3.27.1.noarch", product: { name: "tomcat-javadoc-9.0.21-3.27.1.noarch", product_id: "tomcat-javadoc-9.0.21-3.27.1.noarch", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.21-3.27.1.noarch", product: { name: "tomcat-jsp-2_3-api-9.0.21-3.27.1.noarch", product_id: "tomcat-jsp-2_3-api-9.0.21-3.27.1.noarch", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.21-3.27.1.noarch", product: { name: "tomcat-jsvc-9.0.21-3.27.1.noarch", product_id: "tomcat-jsvc-9.0.21-3.27.1.noarch", }, }, { category: "product_version", name: "tomcat-lib-9.0.21-3.27.1.noarch", product: { name: "tomcat-lib-9.0.21-3.27.1.noarch", product_id: "tomcat-lib-9.0.21-3.27.1.noarch", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.21-3.27.1.noarch", product: { name: "tomcat-servlet-4_0-api-9.0.21-3.27.1.noarch", product_id: "tomcat-servlet-4_0-api-9.0.21-3.27.1.noarch", }, }, { category: "product_version", name: "tomcat-webapps-9.0.21-3.27.1.noarch", product: { name: "tomcat-webapps-9.0.21-3.27.1.noarch", product_id: "tomcat-webapps-9.0.21-3.27.1.noarch", }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_name", name: "SUSE Linux Enterprise Module for Web and Scripting 15", product: { name: "SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15", product_identification_helper: { cpe: "cpe:/o:suse:sle-module-web-scripting:15", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "tomcat-9.0.21-3.27.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.21-3.27.1.noarch", }, product_reference: "tomcat-9.0.21-3.27.1.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.21-3.27.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.21-3.27.1.noarch", }, product_reference: "tomcat-admin-webapps-9.0.21-3.27.1.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.21-3.27.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.21-3.27.1.noarch", }, product_reference: "tomcat-el-3_0-api-9.0.21-3.27.1.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.21-3.27.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.21-3.27.1.noarch", }, product_reference: "tomcat-jsp-2_3-api-9.0.21-3.27.1.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.21-3.27.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.21-3.27.1.noarch", }, product_reference: "tomcat-lib-9.0.21-3.27.1.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.21-3.27.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.21-3.27.1.noarch", }, product_reference: "tomcat-servlet-4_0-api-9.0.21-3.27.1.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.21-3.27.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.21-3.27.1.noarch", }, product_reference: "tomcat-webapps-9.0.21-3.27.1.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, ], }, vulnerabilities: [ { cve: "CVE-2019-0199", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0199", }, ], notes: [ { category: "general", text: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.21-3.27.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-0199", url: "https://www.suse.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "SUSE Bug 1131055 for CVE-2019-0199", url: "https://bugzilla.suse.com/1131055", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-0199", url: "https://bugzilla.suse.com/1139924", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.21-3.27.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.21-3.27.1.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.21-3.27.1.noarch", ], }, ], threats: [ { category: "impact", date: "2019-07-12T07:30:47Z", details: "important", }, ], title: "CVE-2019-0199", }, ], }
suse-su-2019:1693-1
Vulnerability from csaf_suse
Published
2019-06-25 09:51
Modified
2019-06-25 09:51
Summary
Security update for tomcat
Notes
Title of the patch
Security update for tomcat
Description of the patch
This update for tomcat to version 9.0.20 fixes the following issues:
Security issues fixed:
- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to
streams with excessive numbers of SETTINGS frames (bsc#1131055).
- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).
Non-security issues fixed:
- Increase maximum number of threads and open files for tomcat (bsc#1111966).
Patchnames
SUSE-2019-1693,SUSE-SLE-Module-Development-Tools-OBS-15-2019-1693,SUSE-SLE-Module-Web-Scripting-15-2019-1693
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for tomcat", title: "Title of the patch", }, { category: "description", text: "This update for tomcat to version 9.0.20 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to \n streams with excessive numbers of SETTINGS frames (bsc#1131055).\n- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).\n\nNon-security issues fixed: \n\n- Increase maximum number of threads and open files for tomcat (bsc#1111966).\n", title: "Description of the patch", }, { category: "details", text: "SUSE-2019-1693,SUSE-SLE-Module-Development-Tools-OBS-15-2019-1693,SUSE-SLE-Module-Web-Scripting-15-2019-1693", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_1693-1.json", }, { category: "self", summary: "URL for SUSE-SU-2019:1693-1", url: "https://www.suse.com/support/update/announcement/2019/suse-su-20191693-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2019:1693-1", url: "https://lists.suse.com/pipermail/sle-security-updates/2019-June/005631.html", }, { category: "self", summary: "SUSE Bug 1111966", url: "https://bugzilla.suse.com/1111966", }, { category: "self", summary: "SUSE Bug 1131055", url: "https://bugzilla.suse.com/1131055", }, { category: "self", summary: "SUSE Bug 1136085", url: "https://bugzilla.suse.com/1136085", }, { category: "self", summary: "SUSE CVE CVE-2019-0199 page", url: "https://www.suse.com/security/cve/CVE-2019-0199/", }, { category: "self", summary: "SUSE CVE CVE-2019-0221 page", url: "https://www.suse.com/security/cve/CVE-2019-0221/", }, ], title: "Security update for tomcat", tracking: { current_release_date: "2019-06-25T09:51:37Z", generator: { date: "2019-06-25T09:51:37Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2019:1693-1", initial_release_date: "2019-06-25T09:51:37Z", revision_history: [ { date: "2019-06-25T09:51:37Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "tomcat-9.0.20-3.24.2.noarch", product: { name: "tomcat-9.0.20-3.24.2.noarch", product_id: "tomcat-9.0.20-3.24.2.noarch", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.20-3.24.2.noarch", product: { name: "tomcat-admin-webapps-9.0.20-3.24.2.noarch", product_id: "tomcat-admin-webapps-9.0.20-3.24.2.noarch", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.20-3.24.2.noarch", product: { name: "tomcat-docs-webapp-9.0.20-3.24.2.noarch", product_id: "tomcat-docs-webapp-9.0.20-3.24.2.noarch", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.20-3.24.2.noarch", product: { name: "tomcat-el-3_0-api-9.0.20-3.24.2.noarch", product_id: "tomcat-el-3_0-api-9.0.20-3.24.2.noarch", }, }, { category: "product_version", name: "tomcat-embed-9.0.20-3.24.2.noarch", product: { name: "tomcat-embed-9.0.20-3.24.2.noarch", product_id: "tomcat-embed-9.0.20-3.24.2.noarch", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.20-3.24.2.noarch", product: { name: "tomcat-javadoc-9.0.20-3.24.2.noarch", product_id: "tomcat-javadoc-9.0.20-3.24.2.noarch", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.20-3.24.2.noarch", product: { name: "tomcat-jsp-2_3-api-9.0.20-3.24.2.noarch", product_id: "tomcat-jsp-2_3-api-9.0.20-3.24.2.noarch", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.20-3.24.2.noarch", product: { name: "tomcat-jsvc-9.0.20-3.24.2.noarch", product_id: "tomcat-jsvc-9.0.20-3.24.2.noarch", }, }, { category: "product_version", name: "tomcat-lib-9.0.20-3.24.2.noarch", product: { name: "tomcat-lib-9.0.20-3.24.2.noarch", product_id: "tomcat-lib-9.0.20-3.24.2.noarch", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.20-3.24.2.noarch", product: { name: "tomcat-servlet-4_0-api-9.0.20-3.24.2.noarch", product_id: "tomcat-servlet-4_0-api-9.0.20-3.24.2.noarch", }, }, { category: "product_version", name: "tomcat-webapps-9.0.20-3.24.2.noarch", product: { name: "tomcat-webapps-9.0.20-3.24.2.noarch", product_id: "tomcat-webapps-9.0.20-3.24.2.noarch", }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_name", name: "SUSE Linux Enterprise Module for Web and Scripting 15", product: { name: "SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15", product_identification_helper: { cpe: "cpe:/o:suse:sle-module-web-scripting:15", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "tomcat-9.0.20-3.24.2.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.20-3.24.2.noarch", }, product_reference: "tomcat-9.0.20-3.24.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.20-3.24.2.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.20-3.24.2.noarch", }, product_reference: "tomcat-admin-webapps-9.0.20-3.24.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.20-3.24.2.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.20-3.24.2.noarch", }, product_reference: "tomcat-el-3_0-api-9.0.20-3.24.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.20-3.24.2.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.20-3.24.2.noarch", }, product_reference: "tomcat-jsp-2_3-api-9.0.20-3.24.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.20-3.24.2.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.20-3.24.2.noarch", }, product_reference: "tomcat-lib-9.0.20-3.24.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.20-3.24.2.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.20-3.24.2.noarch", }, product_reference: "tomcat-servlet-4_0-api-9.0.20-3.24.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.20-3.24.2.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15", product_id: "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.20-3.24.2.noarch", }, product_reference: "tomcat-webapps-9.0.20-3.24.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15", }, ], }, vulnerabilities: [ { cve: "CVE-2019-0199", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0199", }, ], notes: [ { category: "general", text: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.20-3.24.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-0199", url: "https://www.suse.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "SUSE Bug 1131055 for CVE-2019-0199", url: "https://bugzilla.suse.com/1131055", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-0199", url: "https://bugzilla.suse.com/1139924", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.20-3.24.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.20-3.24.2.noarch", ], }, ], threats: [ { category: "impact", date: "2019-06-25T09:51:37Z", details: "important", }, ], title: "CVE-2019-0199", }, { cve: "CVE-2019-0221", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0221", }, ], notes: [ { category: "general", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.20-3.24.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-0221", url: "https://www.suse.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "SUSE Bug 1136085 for CVE-2019-0221", url: "https://bugzilla.suse.com/1136085", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.20-3.24.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.20-3.24.2.noarch", "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.20-3.24.2.noarch", ], }, ], threats: [ { category: "impact", date: "2019-06-25T09:51:37Z", details: "low", }, ], title: "CVE-2019-0221", }, ], }
suse-su-2019:1866-1
Vulnerability from csaf_suse
Published
2019-07-17 11:10
Modified
2019-07-17 11:10
Summary
Security update for tomcat
Notes
Title of the patch
Security update for tomcat
Description of the patch
This update for tomcat to version 9.0.21 fixes the following issues:
Security issues fixed:
- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to
streams with excessive numbers of SETTINGS frames (bsc#1131055).
- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).
- CVE-2019-10072: Fixed incomplete patch for CVE-2019-0199 (bsc#1139924).
Please also see
http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.21_(markt)
and
http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.20_(markt)
Patchnames
SUSE-2019-1866,SUSE-SLE-SERVER-12-SP4-2019-1866
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for tomcat", title: "Title of the patch", }, { category: "description", text: "This update for tomcat to version 9.0.21 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-0199: Fixed a denial of service in the HTTP/2 implementation related to \n streams with excessive numbers of SETTINGS frames (bsc#1131055).\n- CVE-2019-0221: Fixed a cross site scripting vulnerability with the SSI printenv command (bsc#1136085).\n- CVE-2019-10072: Fixed incomplete patch for CVE-2019-0199 (bsc#1139924).\n\nPlease also see\n\thttp://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.21_(markt)\nand\n\thttp://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.20_(markt)\n", title: "Description of the patch", }, { category: "details", text: "SUSE-2019-1866,SUSE-SLE-SERVER-12-SP4-2019-1866", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_1866-1.json", }, { category: "self", summary: "URL for SUSE-SU-2019:1866-1", url: "https://www.suse.com/support/update/announcement/2019/suse-su-20191866-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2019:1866-1", url: "https://lists.suse.com/pipermail/sle-security-updates/2019-July/005728.html", }, { category: "self", summary: "SUSE Bug 1131055", url: "https://bugzilla.suse.com/1131055", }, { category: "self", summary: "SUSE Bug 1136085", url: "https://bugzilla.suse.com/1136085", }, { category: "self", summary: "SUSE Bug 1139924", url: "https://bugzilla.suse.com/1139924", }, { category: "self", summary: "SUSE CVE CVE-2019-0199 page", url: "https://www.suse.com/security/cve/CVE-2019-0199/", }, { category: "self", summary: "SUSE CVE CVE-2019-0221 page", url: "https://www.suse.com/security/cve/CVE-2019-0221/", }, { category: "self", summary: "SUSE CVE CVE-2019-10072 page", url: "https://www.suse.com/security/cve/CVE-2019-10072/", }, ], title: "Security update for tomcat", tracking: { current_release_date: "2019-07-17T11:10:40Z", generator: { date: "2019-07-17T11:10:40Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2019:1866-1", initial_release_date: "2019-07-17T11:10:40Z", revision_history: [ { date: "2019-07-17T11:10:40Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "tomcat-9.0.21-3.13.2.noarch", product: { name: "tomcat-9.0.21-3.13.2.noarch", product_id: "tomcat-9.0.21-3.13.2.noarch", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.21-3.13.2.noarch", product: { name: "tomcat-admin-webapps-9.0.21-3.13.2.noarch", product_id: "tomcat-admin-webapps-9.0.21-3.13.2.noarch", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.21-3.13.2.noarch", product: { name: "tomcat-docs-webapp-9.0.21-3.13.2.noarch", product_id: "tomcat-docs-webapp-9.0.21-3.13.2.noarch", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.21-3.13.2.noarch", product: { name: "tomcat-el-3_0-api-9.0.21-3.13.2.noarch", product_id: "tomcat-el-3_0-api-9.0.21-3.13.2.noarch", }, }, { category: "product_version", name: "tomcat-embed-9.0.21-3.13.2.noarch", product: { name: "tomcat-embed-9.0.21-3.13.2.noarch", product_id: "tomcat-embed-9.0.21-3.13.2.noarch", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.21-3.13.2.noarch", product: { name: "tomcat-javadoc-9.0.21-3.13.2.noarch", product_id: "tomcat-javadoc-9.0.21-3.13.2.noarch", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", product: { name: "tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", product_id: "tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.21-3.13.2.noarch", product: { name: "tomcat-jsvc-9.0.21-3.13.2.noarch", product_id: "tomcat-jsvc-9.0.21-3.13.2.noarch", }, }, { category: "product_version", name: "tomcat-lib-9.0.21-3.13.2.noarch", product: { name: "tomcat-lib-9.0.21-3.13.2.noarch", product_id: "tomcat-lib-9.0.21-3.13.2.noarch", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", product: { name: "tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", product_id: "tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", }, }, { category: "product_version", name: "tomcat-webapps-9.0.21-3.13.2.noarch", product: { name: "tomcat-webapps-9.0.21-3.13.2.noarch", product_id: "tomcat-webapps-9.0.21-3.13.2.noarch", }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_name", name: "SUSE Linux Enterprise Server 12 SP4", product: { name: "SUSE Linux Enterprise Server 12 SP4", product_id: "SUSE Linux Enterprise Server 12 SP4", product_identification_helper: { cpe: "cpe:/o:suse:sles:12:sp4", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Server for SAP Applications 12 SP4", product: { name: "SUSE Linux Enterprise Server for SAP Applications 12 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4", product_identification_helper: { cpe: "cpe:/o:suse:sles_sap:12:sp4", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "tomcat-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server 12 SP4", product_id: "SUSE Linux Enterprise Server 12 SP4:tomcat-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server 12 SP4", product_id: "SUSE Linux Enterprise Server 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-admin-webapps-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server 12 SP4", product_id: "SUSE Linux Enterprise Server 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-docs-webapp-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server 12 SP4", product_id: "SUSE Linux Enterprise Server 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-el-3_0-api-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server 12 SP4", product_id: "SUSE Linux Enterprise Server 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-javadoc-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server 12 SP4", product_id: "SUSE Linux Enterprise Server 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server 12 SP4", product_id: "SUSE Linux Enterprise Server 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-lib-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server 12 SP4", product_id: "SUSE Linux Enterprise Server 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server 12 SP4", product_id: "SUSE Linux Enterprise Server 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-webapps-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-admin-webapps-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-docs-webapp-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-el-3_0-api-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-javadoc-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-lib-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP4", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.21-3.13.2.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4", product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", }, product_reference: "tomcat-webapps-9.0.21-3.13.2.noarch", relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP4", }, ], }, vulnerabilities: [ { cve: "CVE-2019-0199", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0199", }, ], notes: [ { category: "general", text: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-0199", url: "https://www.suse.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "SUSE Bug 1131055 for CVE-2019-0199", url: "https://bugzilla.suse.com/1131055", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-0199", url: "https://bugzilla.suse.com/1139924", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", ], }, ], threats: [ { category: "impact", date: "2019-07-17T11:10:40Z", details: "important", }, ], title: "CVE-2019-0199", }, { cve: "CVE-2019-0221", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0221", }, ], notes: [ { category: "general", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-0221", url: "https://www.suse.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "SUSE Bug 1136085 for CVE-2019-0221", url: "https://bugzilla.suse.com/1136085", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", ], }, ], threats: [ { category: "impact", date: "2019-07-17T11:10:40Z", details: "low", }, ], title: "CVE-2019-0221", }, { cve: "CVE-2019-10072", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-10072", }, ], notes: [ { category: "general", text: "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Server 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2019-10072", url: "https://www.suse.com/security/cve/CVE-2019-10072", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-10072", url: "https://bugzilla.suse.com/1139924", }, { category: "external", summary: "SUSE Bug 1154162 for CVE-2019-10072", url: "https://bugzilla.suse.com/1154162", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Server 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "SUSE Linux Enterprise Server 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-admin-webapps-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-docs-webapp-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-el-3_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-javadoc-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-jsp-2_3-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-lib-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-servlet-4_0-api-9.0.21-3.13.2.noarch", "SUSE Linux Enterprise Server for SAP Applications 12 SP4:tomcat-webapps-9.0.21-3.13.2.noarch", ], }, ], threats: [ { category: "impact", date: "2019-07-17T11:10:40Z", details: "moderate", }, ], title: "CVE-2019-10072", }, ], }
RHSA-2019:3929
Vulnerability from csaf_redhat
Published
2019-11-20 16:08
Modified
2025-01-09 05:46
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release
Notes
Topic
Updated Red Hat JBoss Web Server 5.2.0 packages are now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 5.2 serves as a replacement for Red Hat JBoss Web Server 5.1, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.
Security Fix(es):
* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)
* openssl: 0-byte record padding oracle (CVE-2019-1559)
* tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199 (CVE-2019-10072)
* tomcat: XSS in SSI printenv (CVE-2019-0221)
* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Red Hat JBoss Web Server 5.2.0 packages are now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 5.2 serves as a replacement for Red Hat JBoss Web Server 5.1, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.\n\nSecurity Fix(es):\n\n* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)\n\n* openssl: 0-byte record padding oracle (CVE-2019-1559)\n\n* tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199 (CVE-2019-10072)\n\n* tomcat: XSS in SSI printenv (CVE-2019-0221)\n\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2019:3929", url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.2/", url: "https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.2/", }, { category: "external", summary: "1645695", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1645695", }, { category: "external", summary: "1683804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1683804", }, { category: "external", summary: "1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "1713275", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713275", }, { category: "external", summary: "1723708", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1723708", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3929.json", }, ], title: "Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release", tracking: { current_release_date: "2025-01-09T05:46:56+00:00", generator: { date: "2025-01-09T05:46:56+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.5", }, }, id: "RHSA-2019:3929", initial_release_date: "2019-11-20T16:08:26+00:00", revision_history: [ { date: "2019-11-20T16:08:26+00:00", number: "1", summary: "Initial version", }, { date: "2019-12-02T16:26:41+00:00", number: "2", summary: "Last updated version", }, { date: "2025-01-09T05:46:56+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product: { name: "Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el7", }, }, }, { category: "product_name", name: "Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product: { name: "Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el6", }, }, }, { category: "product_name", name: "Red Hat JBoss Web Server 5.2 for RHEL 8", product: { name: "Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el8", }, }, }, ], category: "product_family", name: "Red Hat JBoss Web Server", }, { branches: [ { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el8jws?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", product: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", product_id: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-python-javapackages@3.4.1-5.15.11.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product_id: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster-tomcat@1.4.1-1.Final_redhat_00001.2.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product_id: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault-javadoc@1.1.8-1.Final_redhat_1.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-lib@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", product: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", product_id: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-python-javapackages@3.4.1-5.15.11.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product_id: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster-tomcat@1.4.1-1.Final_redhat_00001.2.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product_id: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault-javadoc@1.1.8-1.Final_redhat_1.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-lib@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", product: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", product_id: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-python-javapackages@3.4.1-5.15.11.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product_id: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster-tomcat@1.4.1-1.Final_redhat_00001.2.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product_id: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault-javadoc@1.1.8-1.Final_redhat_1.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-lib@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el7jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", product_id: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el7jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el6jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", product_id: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el6jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el8jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", product_id: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el8jws?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el6jws?arch=i686", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", product_id: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el6jws?arch=i686", }, }, }, ], category: "architecture", name: "i686", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", }, product_reference: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", }, product_reference: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", }, product_reference: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", }, product_reference: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", }, product_reference: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", }, product_reference: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", }, product_reference: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", }, product_reference: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", }, product_reference: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Alejandro Cabrera Aldaya", ], organization: "Universidad Tecnologica de la Habana CUJAE; Cuba", }, { names: [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan", ], }, { names: [ "Nicola Tuveri", ], organization: "Tampere University of Technology; Finland", }, ], cve: "CVE-2018-5407", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, discovery_date: "2018-11-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1645695", }, ], notes: [ { category: "description", text: "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", title: "Vulnerability description", }, { category: "summary", text: "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", title: "Vulnerability summary", }, { category: "other", text: "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-5407", }, { category: "external", summary: "RHBZ#1645695", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1645695", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-5407", url: "https://www.cve.org/CVERecord?id=CVE-2018-5407", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", }, { category: "external", summary: "https://github.com/bbbrumley/portsmash", url: "https://github.com/bbbrumley/portsmash", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20181112.txt", url: "https://www.openssl.org/news/secadv/20181112.txt", }, ], release_date: "2018-10-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "workaround", details: "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "PHYSICAL", availabilityImpact: "NONE", baseScore: 4.8, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", }, { cve: "CVE-2019-0199", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-03-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1693325", }, ], notes: [ { category: "description", text: "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Apache Tomcat HTTP/2 DoS", title: "Vulnerability summary", }, { category: "other", text: "pki-servlet-container does not use HTTP/2 in its default configuration.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "RHBZ#1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0199", url: "https://www.cve.org/CVERecord?id=CVE-2019-0199", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", }, ], release_date: "2019-03-25T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat: Apache Tomcat HTTP/2 DoS", }, { cve: "CVE-2019-0221", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2019-05-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1713275", }, ], notes: [ { category: "description", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: XSS in SSI printenv", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "RHBZ#1713275", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713275", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0221", url: "https://www.cve.org/CVERecord?id=CVE-2019-0221", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0221", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0221", }, ], release_date: "2019-04-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "workaround", details: "SSI is disabled in the default Tomcat configuration. The vulnerable printenv command is intended for debugging, and is recommended to not be enabled for a production website.", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat: XSS in SSI printenv", }, { cve: "CVE-2019-0232", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2019-04-16T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1701056", }, ], notes: [ { category: "description", text: "A flaw was discovered in Apache Tomcat, where a Java Runtime Environment can pass a command-line argument in the Windows operating system. The execution of arbitrary commands via Tomcat’s Common Gateway Interface (CGI) Servlet, allows an attacker to perform remote code execution.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Remote Code Execution on Windows", title: "Vulnerability summary", }, { category: "other", text: "This vulnerability is specific to the Windows platform's treatment of file names and how they must be quoted. Tomcat running on Linux hosts is not affected.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0232", }, { category: "external", summary: "RHBZ#1701056", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1701056", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0232", url: "https://www.cve.org/CVERecord?id=CVE-2019-0232", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0232", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0232", }, ], release_date: "2019-04-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat: Remote Code Execution on Windows", }, { cve: "CVE-2019-1559", cwe: { id: "CWE-325", name: "Missing Cryptographic Step", }, discovery_date: "2019-02-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1683804", }, ], notes: [ { category: "description", text: "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", title: "Vulnerability description", }, { category: "summary", text: "openssl: 0-byte record padding oracle", title: "Vulnerability summary", }, { category: "other", text: "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-1559", }, { category: "external", summary: "RHBZ#1683804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1683804", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-1559", url: "https://www.cve.org/CVERecord?id=CVE-2019-1559", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", }, { category: "external", summary: "https://github.com/RUB-NDS/TLS-Padding-Oracles", url: "https://github.com/RUB-NDS/TLS-Padding-Oracles", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20190226.txt", url: "https://www.openssl.org/news/secadv/20190226.txt", }, ], release_date: "2019-02-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "workaround", details: "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: 0-byte record padding oracle", }, { cve: "CVE-2019-10072", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-06-25T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1723708", }, ], notes: [ { category: "description", text: "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-10072", }, { category: "external", summary: "RHBZ#1723708", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1723708", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-10072", url: "https://www.cve.org/CVERecord?id=CVE-2019-10072", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10072", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10072", }, { category: "external", summary: "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41", url: "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41", }, { category: "external", summary: "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20", url: "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20", }, ], release_date: "2019-06-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "workaround", details: "pki-servlet-container does not use HTTP/2 in its default configuration.", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199", }, ], }
rhsa-2019:3931
Vulnerability from csaf_redhat
Published
2019-11-20 16:04
Modified
2025-01-09 05:47
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release
Notes
Topic
Red Hat JBoss Web Server 5.2.0 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is available.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.
Security Fix(es):
* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)
* tomcat: XSS in SSI printenv (CVE-2019-0221)
* openssl: 0-byte record padding oracle (CVE-2019-1559)
* tomcat: HTTP/2 implementation leads to denial of service (CVE-2019-10072)
* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat JBoss Web Server 5.2.0 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is available.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n \nRefer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.\n\nSecurity Fix(es):\n\n* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) \n* tomcat: XSS in SSI printenv (CVE-2019-0221) \n* openssl: 0-byte record padding oracle (CVE-2019-1559) \n* tomcat: HTTP/2 implementation leads to denial of service (CVE-2019-10072)\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2019:3931", url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "1645695", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1645695", }, { category: "external", summary: "1683804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1683804", }, { category: "external", summary: "1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "1713275", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713275", }, { category: "external", summary: "1723708", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1723708", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3931.json", }, ], title: "Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release", tracking: { current_release_date: "2025-01-09T05:47:04+00:00", generator: { date: "2025-01-09T05:47:04+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.5", }, }, id: "RHSA-2019:3931", initial_release_date: "2019-11-20T16:04:24+00:00", revision_history: [ { date: "2019-11-20T16:04:24+00:00", number: "1", summary: "Initial version", }, { date: "2019-12-02T16:22:21+00:00", number: "2", summary: "Last updated version", }, { date: "2025-01-09T05:47:04+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat JBoss Web Server 5", product: { name: "Red Hat JBoss Web Server 5", product_id: "Red Hat JBoss Web Server 5", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.2", }, }, }, ], category: "product_family", name: "Red Hat JBoss Web Server", }, ], category: "vendor", name: "Red Hat", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Alejandro Cabrera Aldaya", ], organization: "Universidad Tecnologica de la Habana CUJAE; Cuba", }, { names: [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan", ], }, { names: [ "Nicola Tuveri", ], organization: "Tampere University of Technology; Finland", }, ], cve: "CVE-2018-5407", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, discovery_date: "2018-11-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1645695", }, ], notes: [ { category: "description", text: "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", title: "Vulnerability description", }, { category: "summary", text: "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", title: "Vulnerability summary", }, { category: "other", text: "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-5407", }, { category: "external", summary: "RHBZ#1645695", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1645695", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-5407", url: "https://www.cve.org/CVERecord?id=CVE-2018-5407", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", }, { category: "external", summary: "https://github.com/bbbrumley/portsmash", url: "https://github.com/bbbrumley/portsmash", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20181112.txt", url: "https://www.openssl.org/news/secadv/20181112.txt", }, ], release_date: "2018-10-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "workaround", details: "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", product_ids: [ "Red Hat JBoss Web Server 5", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "PHYSICAL", availabilityImpact: "NONE", baseScore: 4.8, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", version: "3.0", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", }, { cve: "CVE-2019-0199", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-03-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1693325", }, ], notes: [ { category: "description", text: "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Apache Tomcat HTTP/2 DoS", title: "Vulnerability summary", }, { category: "other", text: "pki-servlet-container does not use HTTP/2 in its default configuration.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "RHBZ#1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0199", url: "https://www.cve.org/CVERecord?id=CVE-2019-0199", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", }, ], release_date: "2019-03-25T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat: Apache Tomcat HTTP/2 DoS", }, { cve: "CVE-2019-0221", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2019-05-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1713275", }, ], notes: [ { category: "description", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: XSS in SSI printenv", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "RHBZ#1713275", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713275", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0221", url: "https://www.cve.org/CVERecord?id=CVE-2019-0221", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0221", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0221", }, ], release_date: "2019-04-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "workaround", details: "SSI is disabled in the default Tomcat configuration. The vulnerable printenv command is intended for debugging, and is recommended to not be enabled for a production website.", product_ids: [ "Red Hat JBoss Web Server 5", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat: XSS in SSI printenv", }, { cve: "CVE-2019-1559", cwe: { id: "CWE-325", name: "Missing Cryptographic Step", }, discovery_date: "2019-02-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1683804", }, ], notes: [ { category: "description", text: "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", title: "Vulnerability description", }, { category: "summary", text: "openssl: 0-byte record padding oracle", title: "Vulnerability summary", }, { category: "other", text: "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-1559", }, { category: "external", summary: "RHBZ#1683804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1683804", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-1559", url: "https://www.cve.org/CVERecord?id=CVE-2019-1559", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", }, { category: "external", summary: "https://github.com/RUB-NDS/TLS-Padding-Oracles", url: "https://github.com/RUB-NDS/TLS-Padding-Oracles", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20190226.txt", url: "https://www.openssl.org/news/secadv/20190226.txt", }, ], release_date: "2019-02-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "workaround", details: "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.", product_ids: [ "Red Hat JBoss Web Server 5", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: 0-byte record padding oracle", }, { cve: "CVE-2019-10072", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-06-25T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1723708", }, ], notes: [ { category: "description", text: "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-10072", }, { category: "external", summary: "RHBZ#1723708", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1723708", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-10072", url: "https://www.cve.org/CVERecord?id=CVE-2019-10072", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10072", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10072", }, { category: "external", summary: "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41", url: "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41", }, { category: "external", summary: "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20", url: "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20", }, ], release_date: "2019-06-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "workaround", details: "pki-servlet-container does not use HTTP/2 in its default configuration.", product_ids: [ "Red Hat JBoss Web Server 5", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199", }, ], }
RHSA-2020:2366
Vulnerability from csaf_redhat
Published
2020-06-04 13:06
Modified
2025-03-17 02:36
Summary
Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update
Notes
Topic
An update is now available for Red Hat OpenShift Application Runtimes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
[NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-02-18. The advisory is informational only; no files in the release have changed.]
Details
Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform.
This release of Red Hat support for Spring Boot 2.1.12 serves as a replacement for Red Hat support for Spring Boot 2.1.6, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
* keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)
* keycloak: session hijack using the user access token (CVE-2019-3868)
* keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875)
* keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)
* keycloak: cross-realm user access auth bypass (CVE-2019-14832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update is now available for Red Hat OpenShift Application Runtimes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\n[NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-02-18. The advisory is informational only; no files in the release have changed.]", title: "Topic", }, { category: "general", text: "Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform.\n\nThis release of Red Hat support for Spring Boot 2.1.12 serves as a replacement for Red Hat support for Spring Boot 2.1.6, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\n* keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)\n\n* keycloak: session hijack using the user access token (CVE-2019-3868)\n\n* keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875)\n\n* keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)\n\n* keycloak: cross-realm user access auth bypass (CVE-2019-14832)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2020:2366", url: "https://access.redhat.com/errata/RHSA-2020:2366", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/", url: "https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/", }, { category: "external", summary: "1729261", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1729261", }, { category: "external", summary: "1749487", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487", }, { category: "external", summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.12", url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.12", }, { category: "external", summary: "1679144", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1679144", }, { category: "external", summary: "1690628", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1690628", }, { category: "external", summary: "1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "1728609", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1728609", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2366.json", }, ], title: "Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update", tracking: { current_release_date: "2025-03-17T02:36:09+00:00", generator: { date: "2025-03-17T02:36:09+00:00", engine: { name: "Red Hat SDEngine", version: "4.4.1", }, }, id: "RHSA-2020:2366", initial_release_date: "2020-06-04T13:06:31+00:00", revision_history: [ { date: "2020-06-04T13:06:31+00:00", number: "1", summary: "Initial version", }, { date: "2020-06-04T13:06:31+00:00", number: "2", summary: "Last updated version", }, { date: "2025-03-17T02:36:09+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Runtimes Spring Boot 2.1.12", product: { name: "Red Hat Runtimes Spring Boot 2.1.12", product_id: "Red Hat Runtimes Spring Boot 2.1.12", product_identification_helper: { cpe: "cpe:/a:redhat:openshift_application_runtimes:1.0", }, }, }, ], category: "product_family", name: "Red Hat OpenShift Application Runtimes", }, ], category: "vendor", name: "Red Hat", }, ], }, vulnerabilities: [ { cve: "CVE-2019-0199", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-03-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1693325", }, ], notes: [ { category: "description", text: "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Apache Tomcat HTTP/2 DoS", title: "Vulnerability summary", }, { category: "other", text: "pki-servlet-container does not use HTTP/2 in its default configuration.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "RHBZ#1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0199", url: "https://www.cve.org/CVERecord?id=CVE-2019-0199", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", }, ], release_date: "2019-03-25T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat: Apache Tomcat HTTP/2 DoS", }, { acknowledgments: [ { names: [ "Caranzo Gideon", "Muzamil Muein", "Siddiqui Najam", ], organization: "Gemalto E&C", }, ], cve: "CVE-2019-3868", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, discovery_date: "2019-02-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1679144", }, ], notes: [ { category: "description", text: "Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: session hijack using the user access token", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-3868", }, { category: "external", summary: "RHBZ#1679144", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1679144", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-3868", url: "https://www.cve.org/CVERecord?id=CVE-2019-3868", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-3868", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-3868", }, ], release_date: "2019-04-23T16:59:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.8, baseSeverity: "LOW", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "keycloak: session hijack using the user access token", }, { acknowledgments: [ { names: [ "Marek Posolda", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2019-3875", cwe: { id: "CWE-295", name: "Improper Certificate Validation", }, discovery_date: "2019-03-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1690628", }, ], notes: [ { category: "description", text: "A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: missing signatures validation on CRL used to verify client certificates", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-3875", }, { category: "external", summary: "RHBZ#1690628", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1690628", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-3875", url: "https://www.cve.org/CVERecord?id=CVE-2019-3875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-3875", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-3875", }, ], release_date: "2019-06-11T14:22:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "keycloak: missing signatures validation on CRL used to verify client certificates", }, { cve: "CVE-2019-10199", cwe: { id: "CWE-352", name: "Cross-Site Request Forgery (CSRF)", }, discovery_date: "2019-07-04T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1729261", }, ], notes: [ { category: "description", text: "It was found that Keycloak's account console did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: CSRF check missing in My Resources functionality in the Account Console", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-10199", }, { category: "external", summary: "RHBZ#1729261", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1729261", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-10199", url: "https://www.cve.org/CVERecord?id=CVE-2019-10199", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10199", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10199", }, ], release_date: "2019-08-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.6, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "keycloak: CSRF check missing in My Resources functionality in the Account Console", }, { cve: "CVE-2019-10201", cwe: { id: "CWE-287", name: "Improper Authentication", }, discovery_date: "2019-07-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1728609", }, ], notes: [ { category: "description", text: "It was found that Keycloak's SAML broker did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: SAML broker does not check existence of signature on document allowing any user impersonation", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-10201", }, { category: "external", summary: "RHBZ#1728609", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1728609", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-10201", url: "https://www.cve.org/CVERecord?id=CVE-2019-10201", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10201", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10201", }, ], release_date: "2019-08-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, { category: "workaround", details: "Administrator can prevent this issue for POST binding by requiring signed assertions.", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "keycloak: SAML broker does not check existence of signature on document allowing any user impersonation", }, { cve: "CVE-2019-14832", cwe: { id: "CWE-863", name: "Incorrect Authorization", }, discovery_date: "2019-07-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1749487", }, ], notes: [ { category: "description", text: "A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: cross-realm user access auth bypass", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-14832", }, { category: "external", summary: "RHBZ#1749487", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-14832", url: "https://www.cve.org/CVERecord?id=CVE-2019-14832", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832", }, ], release_date: "2019-10-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "keycloak: cross-realm user access auth bypass", }, ], }
RHSA-2019:3931
Vulnerability from csaf_redhat
Published
2019-11-20 16:04
Modified
2025-01-09 05:47
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release
Notes
Topic
Red Hat JBoss Web Server 5.2.0 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is available.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.
Security Fix(es):
* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)
* tomcat: XSS in SSI printenv (CVE-2019-0221)
* openssl: 0-byte record padding oracle (CVE-2019-1559)
* tomcat: HTTP/2 implementation leads to denial of service (CVE-2019-10072)
* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat JBoss Web Server 5.2.0 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is available.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n \nRefer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.\n\nSecurity Fix(es):\n\n* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) \n* tomcat: XSS in SSI printenv (CVE-2019-0221) \n* openssl: 0-byte record padding oracle (CVE-2019-1559) \n* tomcat: HTTP/2 implementation leads to denial of service (CVE-2019-10072)\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2019:3931", url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "1645695", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1645695", }, { category: "external", summary: "1683804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1683804", }, { category: "external", summary: "1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "1713275", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713275", }, { category: "external", summary: "1723708", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1723708", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3931.json", }, ], title: "Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release", tracking: { current_release_date: "2025-01-09T05:47:04+00:00", generator: { date: "2025-01-09T05:47:04+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.5", }, }, id: "RHSA-2019:3931", initial_release_date: "2019-11-20T16:04:24+00:00", revision_history: [ { date: "2019-11-20T16:04:24+00:00", number: "1", summary: "Initial version", }, { date: "2019-12-02T16:22:21+00:00", number: "2", summary: "Last updated version", }, { date: "2025-01-09T05:47:04+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat JBoss Web Server 5", product: { name: "Red Hat JBoss Web Server 5", product_id: "Red Hat JBoss Web Server 5", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.2", }, }, }, ], category: "product_family", name: "Red Hat JBoss Web Server", }, ], category: "vendor", name: "Red Hat", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Alejandro Cabrera Aldaya", ], organization: "Universidad Tecnologica de la Habana CUJAE; Cuba", }, { names: [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan", ], }, { names: [ "Nicola Tuveri", ], organization: "Tampere University of Technology; Finland", }, ], cve: "CVE-2018-5407", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, discovery_date: "2018-11-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1645695", }, ], notes: [ { category: "description", text: "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", title: "Vulnerability description", }, { category: "summary", text: "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", title: "Vulnerability summary", }, { category: "other", text: "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-5407", }, { category: "external", summary: "RHBZ#1645695", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1645695", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-5407", url: "https://www.cve.org/CVERecord?id=CVE-2018-5407", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", }, { category: "external", summary: "https://github.com/bbbrumley/portsmash", url: "https://github.com/bbbrumley/portsmash", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20181112.txt", url: "https://www.openssl.org/news/secadv/20181112.txt", }, ], release_date: "2018-10-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "workaround", details: "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", product_ids: [ "Red Hat JBoss Web Server 5", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "PHYSICAL", availabilityImpact: "NONE", baseScore: 4.8, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", version: "3.0", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", }, { cve: "CVE-2019-0199", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-03-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1693325", }, ], notes: [ { category: "description", text: "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Apache Tomcat HTTP/2 DoS", title: "Vulnerability summary", }, { category: "other", text: "pki-servlet-container does not use HTTP/2 in its default configuration.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "RHBZ#1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0199", url: "https://www.cve.org/CVERecord?id=CVE-2019-0199", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", }, ], release_date: "2019-03-25T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat: Apache Tomcat HTTP/2 DoS", }, { cve: "CVE-2019-0221", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2019-05-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1713275", }, ], notes: [ { category: "description", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: XSS in SSI printenv", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "RHBZ#1713275", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713275", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0221", url: "https://www.cve.org/CVERecord?id=CVE-2019-0221", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0221", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0221", }, ], release_date: "2019-04-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "workaround", details: "SSI is disabled in the default Tomcat configuration. The vulnerable printenv command is intended for debugging, and is recommended to not be enabled for a production website.", product_ids: [ "Red Hat JBoss Web Server 5", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat: XSS in SSI printenv", }, { cve: "CVE-2019-1559", cwe: { id: "CWE-325", name: "Missing Cryptographic Step", }, discovery_date: "2019-02-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1683804", }, ], notes: [ { category: "description", text: "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", title: "Vulnerability description", }, { category: "summary", text: "openssl: 0-byte record padding oracle", title: "Vulnerability summary", }, { category: "other", text: "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-1559", }, { category: "external", summary: "RHBZ#1683804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1683804", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-1559", url: "https://www.cve.org/CVERecord?id=CVE-2019-1559", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", }, { category: "external", summary: "https://github.com/RUB-NDS/TLS-Padding-Oracles", url: "https://github.com/RUB-NDS/TLS-Padding-Oracles", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20190226.txt", url: "https://www.openssl.org/news/secadv/20190226.txt", }, ], release_date: "2019-02-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "workaround", details: "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.", product_ids: [ "Red Hat JBoss Web Server 5", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: 0-byte record padding oracle", }, { cve: "CVE-2019-10072", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-06-25T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1723708", }, ], notes: [ { category: "description", text: "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-10072", }, { category: "external", summary: "RHBZ#1723708", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1723708", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-10072", url: "https://www.cve.org/CVERecord?id=CVE-2019-10072", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10072", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10072", }, { category: "external", summary: "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41", url: "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41", }, { category: "external", summary: "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20", url: "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20", }, ], release_date: "2019-06-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "workaround", details: "pki-servlet-container does not use HTTP/2 in its default configuration.", product_ids: [ "Red Hat JBoss Web Server 5", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199", }, ], }
rhsa-2019_3929
Vulnerability from csaf_redhat
Published
2019-11-20 16:08
Modified
2024-11-22 13:26
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release
Notes
Topic
Updated Red Hat JBoss Web Server 5.2.0 packages are now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 5.2 serves as a replacement for Red Hat JBoss Web Server 5.1, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.
Security Fix(es):
* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)
* openssl: 0-byte record padding oracle (CVE-2019-1559)
* tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199 (CVE-2019-10072)
* tomcat: XSS in SSI printenv (CVE-2019-0221)
* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Red Hat JBoss Web Server 5.2.0 packages are now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 5.2 serves as a replacement for Red Hat JBoss Web Server 5.1, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.\n\nSecurity Fix(es):\n\n* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)\n\n* openssl: 0-byte record padding oracle (CVE-2019-1559)\n\n* tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199 (CVE-2019-10072)\n\n* tomcat: XSS in SSI printenv (CVE-2019-0221)\n\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2019:3929", url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.2/", url: "https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.2/", }, { category: "external", summary: "1645695", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1645695", }, { category: "external", summary: "1683804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1683804", }, { category: "external", summary: "1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "1713275", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713275", }, { category: "external", summary: "1723708", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1723708", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3929.json", }, ], title: "Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release", tracking: { current_release_date: "2024-11-22T13:26:19+00:00", generator: { date: "2024-11-22T13:26:19+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2019:3929", initial_release_date: "2019-11-20T16:08:26+00:00", revision_history: [ { date: "2019-11-20T16:08:26+00:00", number: "1", summary: "Initial version", }, { date: "2019-12-02T16:26:41+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T13:26:19+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product: { name: "Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el7", }, }, }, { category: "product_name", name: "Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product: { name: "Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el6", }, }, }, { category: "product_name", name: "Red Hat JBoss Web Server 5.2 for RHEL 8", product: { name: "Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el8", }, }, }, ], category: "product_family", name: "Red Hat JBoss Web Server", }, { branches: [ { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el8jws?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", product: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", product_id: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-python-javapackages@3.4.1-5.15.11.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product_id: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster-tomcat@1.4.1-1.Final_redhat_00001.2.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product_id: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault-javadoc@1.1.8-1.Final_redhat_1.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-lib@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", product: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", product_id: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-python-javapackages@3.4.1-5.15.11.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product_id: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster-tomcat@1.4.1-1.Final_redhat_00001.2.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product_id: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault-javadoc@1.1.8-1.Final_redhat_1.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-lib@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", product: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", product_id: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-python-javapackages@3.4.1-5.15.11.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product_id: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster-tomcat@1.4.1-1.Final_redhat_00001.2.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product_id: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault-javadoc@1.1.8-1.Final_redhat_1.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-lib@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el7jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", product_id: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el7jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el6jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", product_id: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el6jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el8jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", product_id: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el8jws?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el6jws?arch=i686", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", product_id: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el6jws?arch=i686", }, }, }, ], category: "architecture", name: "i686", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", }, product_reference: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", }, product_reference: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", }, product_reference: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", }, product_reference: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", }, product_reference: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", }, product_reference: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", }, product_reference: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", }, product_reference: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", }, product_reference: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Alejandro Cabrera Aldaya", ], organization: "Universidad Tecnologica de la Habana CUJAE; Cuba", }, { names: [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan", ], }, { names: [ "Nicola Tuveri", ], organization: "Tampere University of Technology; Finland", }, ], cve: "CVE-2018-5407", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, discovery_date: "2018-11-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1645695", }, ], notes: [ { category: "description", text: "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", title: "Vulnerability description", }, { category: "summary", text: "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", title: "Vulnerability summary", }, { category: "other", text: "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-5407", }, { category: "external", summary: "RHBZ#1645695", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1645695", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-5407", url: "https://www.cve.org/CVERecord?id=CVE-2018-5407", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", }, { category: "external", summary: "https://github.com/bbbrumley/portsmash", url: "https://github.com/bbbrumley/portsmash", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20181112.txt", url: "https://www.openssl.org/news/secadv/20181112.txt", }, ], release_date: "2018-10-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "workaround", details: "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "PHYSICAL", availabilityImpact: "NONE", baseScore: 4.8, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", }, { cve: "CVE-2019-0199", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-03-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1693325", }, ], notes: [ { category: "description", text: "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Apache Tomcat HTTP/2 DoS", title: "Vulnerability summary", }, { category: "other", text: "pki-servlet-container does not use HTTP/2 in its default configuration.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "RHBZ#1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0199", url: "https://www.cve.org/CVERecord?id=CVE-2019-0199", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", }, ], release_date: "2019-03-25T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat: Apache Tomcat HTTP/2 DoS", }, { cve: "CVE-2019-0221", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2019-05-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1713275", }, ], notes: [ { category: "description", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: XSS in SSI printenv", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "RHBZ#1713275", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713275", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0221", url: "https://www.cve.org/CVERecord?id=CVE-2019-0221", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0221", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0221", }, ], release_date: "2019-04-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "workaround", details: "SSI is disabled in the default Tomcat configuration. The vulnerable printenv command is intended for debugging, and is recommended to not be enabled for a production website.", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat: XSS in SSI printenv", }, { cve: "CVE-2019-0232", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2019-04-16T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1701056", }, ], notes: [ { category: "description", text: "A flaw was discovered in Apache Tomcat, where a Java Runtime Environment can pass a command-line argument in the Windows operating system. The execution of arbitrary commands via Tomcat’s Common Gateway Interface (CGI) Servlet, allows an attacker to perform remote code execution.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Remote Code Execution on Windows", title: "Vulnerability summary", }, { category: "other", text: "This vulnerability is specific to the Windows platform's treatment of file names and how they must be quoted. Tomcat running on Linux hosts is not affected.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0232", }, { category: "external", summary: "RHBZ#1701056", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1701056", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0232", url: "https://www.cve.org/CVERecord?id=CVE-2019-0232", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0232", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0232", }, ], release_date: "2019-04-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat: Remote Code Execution on Windows", }, { cve: "CVE-2019-1559", cwe: { id: "CWE-325", name: "Missing Cryptographic Step", }, discovery_date: "2019-02-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1683804", }, ], notes: [ { category: "description", text: "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", title: "Vulnerability description", }, { category: "summary", text: "openssl: 0-byte record padding oracle", title: "Vulnerability summary", }, { category: "other", text: "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-1559", }, { category: "external", summary: "RHBZ#1683804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1683804", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-1559", url: "https://www.cve.org/CVERecord?id=CVE-2019-1559", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", }, { category: "external", summary: "https://github.com/RUB-NDS/TLS-Padding-Oracles", url: "https://github.com/RUB-NDS/TLS-Padding-Oracles", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20190226.txt", url: "https://www.openssl.org/news/secadv/20190226.txt", }, ], release_date: "2019-02-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "workaround", details: "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: 0-byte record padding oracle", }, { cve: "CVE-2019-10072", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-06-25T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1723708", }, ], notes: [ { category: "description", text: "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-10072", }, { category: "external", summary: "RHBZ#1723708", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1723708", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-10072", url: "https://www.cve.org/CVERecord?id=CVE-2019-10072", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10072", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10072", }, { category: "external", summary: "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41", url: "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41", }, { category: "external", summary: "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20", url: "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20", }, ], release_date: "2019-06-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "workaround", details: "pki-servlet-container does not use HTTP/2 in its default configuration.", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199", }, ], }
rhsa-2020_2366
Vulnerability from csaf_redhat
Published
2020-06-04 13:06
Modified
2024-11-15 05:20
Summary
Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update
Notes
Topic
An update is now available for Red Hat OpenShift Application Runtimes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
[NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-02-18. The advisory is informational only; no files in the release have changed.]
Details
Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform.
This release of Red Hat support for Spring Boot 2.1.12 serves as a replacement for Red Hat support for Spring Boot 2.1.6, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
* keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)
* keycloak: session hijack using the user access token (CVE-2019-3868)
* keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875)
* keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)
* keycloak: cross-realm user access auth bypass (CVE-2019-14832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update is now available for Red Hat OpenShift Application Runtimes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\n[NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-02-18. The advisory is informational only; no files in the release have changed.]", title: "Topic", }, { category: "general", text: "Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform.\n\nThis release of Red Hat support for Spring Boot 2.1.12 serves as a replacement for Red Hat support for Spring Boot 2.1.6, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\n* keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)\n\n* keycloak: session hijack using the user access token (CVE-2019-3868)\n\n* keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875)\n\n* keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)\n\n* keycloak: cross-realm user access auth bypass (CVE-2019-14832)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2020:2366", url: "https://access.redhat.com/errata/RHSA-2020:2366", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.12", url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.12", }, { category: "external", summary: "https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/", url: "https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/", }, { category: "external", summary: "1679144", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1679144", }, { category: "external", summary: "1690628", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1690628", }, { category: "external", summary: "1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "1728609", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1728609", }, { category: "external", summary: "1729261", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1729261", }, { category: "external", summary: "1749487", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2366.json", }, ], title: "Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update", tracking: { current_release_date: "2024-11-15T05:20:16+00:00", generator: { date: "2024-11-15T05:20:16+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2020:2366", initial_release_date: "2020-06-04T13:06:31+00:00", revision_history: [ { date: "2020-06-04T13:06:31+00:00", number: "1", summary: "Initial version", }, { date: "2020-06-04T13:06:31+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-15T05:20:16+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Runtimes Spring Boot 2.1.12", product: { name: "Red Hat Runtimes Spring Boot 2.1.12", product_id: "Red Hat Runtimes Spring Boot 2.1.12", product_identification_helper: { cpe: "cpe:/a:redhat:openshift_application_runtimes:1.0", }, }, }, ], category: "product_family", name: "Red Hat OpenShift Application Runtimes", }, ], category: "vendor", name: "Red Hat", }, ], }, vulnerabilities: [ { cve: "CVE-2019-0199", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-03-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1693325", }, ], notes: [ { category: "description", text: "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Apache Tomcat HTTP/2 DoS", title: "Vulnerability summary", }, { category: "other", text: "pki-servlet-container does not use HTTP/2 in its default configuration.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "RHBZ#1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0199", url: "https://www.cve.org/CVERecord?id=CVE-2019-0199", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", }, ], release_date: "2019-03-25T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat: Apache Tomcat HTTP/2 DoS", }, { acknowledgments: [ { names: [ "Caranzo Gideon", "Muzamil Muein", "Siddiqui Najam", ], organization: "Gemalto E&C", }, ], cve: "CVE-2019-3868", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, discovery_date: "2019-02-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1679144", }, ], notes: [ { category: "description", text: "Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: session hijack using the user access token", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-3868", }, { category: "external", summary: "RHBZ#1679144", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1679144", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-3868", url: "https://www.cve.org/CVERecord?id=CVE-2019-3868", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-3868", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-3868", }, ], release_date: "2019-04-23T16:59:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.8, baseSeverity: "LOW", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "keycloak: session hijack using the user access token", }, { acknowledgments: [ { names: [ "Marek Posolda", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2019-3875", cwe: { id: "CWE-295", name: "Improper Certificate Validation", }, discovery_date: "2019-03-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1690628", }, ], notes: [ { category: "description", text: "A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: missing signatures validation on CRL used to verify client certificates", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-3875", }, { category: "external", summary: "RHBZ#1690628", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1690628", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-3875", url: "https://www.cve.org/CVERecord?id=CVE-2019-3875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-3875", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-3875", }, ], release_date: "2019-06-11T14:22:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "keycloak: missing signatures validation on CRL used to verify client certificates", }, { cve: "CVE-2019-10199", cwe: { id: "CWE-352", name: "Cross-Site Request Forgery (CSRF)", }, discovery_date: "2019-07-04T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1729261", }, ], notes: [ { category: "description", text: "It was found that Keycloak's account console did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: CSRF check missing in My Resources functionality in the Account Console", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-10199", }, { category: "external", summary: "RHBZ#1729261", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1729261", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-10199", url: "https://www.cve.org/CVERecord?id=CVE-2019-10199", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10199", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10199", }, ], release_date: "2019-08-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.6, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "keycloak: CSRF check missing in My Resources functionality in the Account Console", }, { cve: "CVE-2019-10201", cwe: { id: "CWE-287", name: "Improper Authentication", }, discovery_date: "2019-07-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1728609", }, ], notes: [ { category: "description", text: "It was found that Keycloak's SAML broker did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: SAML broker does not check existence of signature on document allowing any user impersonation", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-10201", }, { category: "external", summary: "RHBZ#1728609", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1728609", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-10201", url: "https://www.cve.org/CVERecord?id=CVE-2019-10201", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10201", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10201", }, ], release_date: "2019-08-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, { category: "workaround", details: "Administrator can prevent this issue for POST binding by requiring signed assertions.", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "keycloak: SAML broker does not check existence of signature on document allowing any user impersonation", }, { cve: "CVE-2019-14832", cwe: { id: "CWE-863", name: "Incorrect Authorization", }, discovery_date: "2019-07-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1749487", }, ], notes: [ { category: "description", text: "A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: cross-realm user access auth bypass", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-14832", }, { category: "external", summary: "RHBZ#1749487", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-14832", url: "https://www.cve.org/CVERecord?id=CVE-2019-14832", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832", }, ], release_date: "2019-10-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "keycloak: cross-realm user access auth bypass", }, ], }
rhsa-2019:3929
Vulnerability from csaf_redhat
Published
2019-11-20 16:08
Modified
2025-01-09 05:46
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release
Notes
Topic
Updated Red Hat JBoss Web Server 5.2.0 packages are now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 5.2 serves as a replacement for Red Hat JBoss Web Server 5.1, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.
Security Fix(es):
* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)
* openssl: 0-byte record padding oracle (CVE-2019-1559)
* tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199 (CVE-2019-10072)
* tomcat: XSS in SSI printenv (CVE-2019-0221)
* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated Red Hat JBoss Web Server 5.2.0 packages are now available for Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n\nThis release of Red Hat JBoss Web Server 5.2 serves as a replacement for Red Hat JBoss Web Server 5.1, and includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes, linked to in the References.\n\nSecurity Fix(es):\n\n* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)\n\n* openssl: 0-byte record padding oracle (CVE-2019-1559)\n\n* tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199 (CVE-2019-10072)\n\n* tomcat: XSS in SSI printenv (CVE-2019-0221)\n\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2019:3929", url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.2/", url: "https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.2/", }, { category: "external", summary: "1645695", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1645695", }, { category: "external", summary: "1683804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1683804", }, { category: "external", summary: "1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "1713275", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713275", }, { category: "external", summary: "1723708", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1723708", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3929.json", }, ], title: "Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release", tracking: { current_release_date: "2025-01-09T05:46:56+00:00", generator: { date: "2025-01-09T05:46:56+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.5", }, }, id: "RHSA-2019:3929", initial_release_date: "2019-11-20T16:08:26+00:00", revision_history: [ { date: "2019-11-20T16:08:26+00:00", number: "1", summary: "Initial version", }, { date: "2019-12-02T16:26:41+00:00", number: "2", summary: "Last updated version", }, { date: "2025-01-09T05:46:56+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product: { name: "Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el7", }, }, }, { category: "product_name", name: "Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product: { name: "Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el6", }, }, }, { category: "product_name", name: "Red Hat JBoss Web Server 5.2 for RHEL 8", product: { name: "Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el8", }, }, }, ], category: "product_family", name: "Red Hat JBoss Web Server", }, { branches: [ { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el7jws?arch=src", }, }, }, { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el6jws?arch=src", }, }, }, { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el8jws?arch=src", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el8jws?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", product: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", product_id: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-python-javapackages@3.4.1-5.15.11.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product_id: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster-tomcat@1.4.1-1.Final_redhat_00001.2.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product_id: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault-javadoc@1.1.8-1.Final_redhat_1.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-lib@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_id: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.21-10.redhat_4.1.el7jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", product: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", product_id: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-python-javapackages@3.4.1-5.15.11.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product_id: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster-tomcat@1.4.1-1.Final_redhat_00001.2.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product_id: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault-javadoc@1.1.8-1.Final_redhat_1.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-lib@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_id: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.21-10.redhat_4.1.el6jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", product: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", product_id: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-jboss-logging@3.3.2-1.Final_redhat_00001.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", product: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", product_id: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-python-javapackages@3.4.1-5.15.11.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", product: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", product_id: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-javapackages-tools@3.4.1-5.15.11.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product_id: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster@1.4.1-1.Final_redhat_00001.2.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product_id: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-mod_cluster-tomcat@1.4.1-1.Final_redhat_00001.2.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", product: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", product_id: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-ecj@4.12.0-1.redhat_1.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product_id: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault@1.1.8-1.Final_redhat_1.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product_id: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-vault-javadoc@1.1.8-1.Final_redhat_1.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-admin-webapps@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-docs-webapp@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-el-3.0-api@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-javadoc@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-jsp-2.3-api@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-lib@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-selinux@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-servlet-4.0-api@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, { category: "product_version", name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_id: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-webapps@9.0.21-10.redhat_4.1.el8jws?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el7jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", product_id: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el7jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el6jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", product_id: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el6jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el8jws?arch=x86_64", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", product_id: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el8jws?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", product: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", product_id: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native@1.2.21-34.redhat_34.el6jws?arch=i686", }, }, }, { category: "product_version", name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", product: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", product_id: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", product_identification_helper: { purl: "pkg:rpm/redhat/jws5-tomcat-native-debuginfo@1.2.21-34.redhat_34.el6jws?arch=i686", }, }, }, ], category: "architecture", name: "i686", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", }, product_reference: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", }, product_reference: "jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", }, product_reference: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 6 Server", product_id: "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", }, product_reference: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", relates_to_product_reference: "6Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", }, product_reference: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", }, product_reference: "jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", }, product_reference: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 7 Server", product_id: "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", }, product_reference: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", relates_to_product_reference: "7Server-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", }, product_reference: "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", }, product_reference: "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", }, product_reference: "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", }, product_reference: "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", }, product_reference: "jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", }, product_reference: "jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", }, product_reference: "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", }, product_reference: "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64 as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", }, product_reference: "jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", }, product_reference: "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", }, product_reference: "jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, { category: "default_component_of", full_product_name: { name: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch as a component of Red Hat JBoss Web Server 5.2 for RHEL 8", product_id: "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", }, product_reference: "jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", relates_to_product_reference: "8Base-JWS-5.2", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Alejandro Cabrera Aldaya", ], organization: "Universidad Tecnologica de la Habana CUJAE; Cuba", }, { names: [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan", ], }, { names: [ "Nicola Tuveri", ], organization: "Tampere University of Technology; Finland", }, ], cve: "CVE-2018-5407", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, discovery_date: "2018-11-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1645695", }, ], notes: [ { category: "description", text: "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", title: "Vulnerability description", }, { category: "summary", text: "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", title: "Vulnerability summary", }, { category: "other", text: "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-5407", }, { category: "external", summary: "RHBZ#1645695", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1645695", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-5407", url: "https://www.cve.org/CVERecord?id=CVE-2018-5407", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", }, { category: "external", summary: "https://github.com/bbbrumley/portsmash", url: "https://github.com/bbbrumley/portsmash", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20181112.txt", url: "https://www.openssl.org/news/secadv/20181112.txt", }, ], release_date: "2018-10-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "workaround", details: "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "PHYSICAL", availabilityImpact: "NONE", baseScore: 4.8, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", }, { cve: "CVE-2019-0199", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-03-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1693325", }, ], notes: [ { category: "description", text: "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Apache Tomcat HTTP/2 DoS", title: "Vulnerability summary", }, { category: "other", text: "pki-servlet-container does not use HTTP/2 in its default configuration.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "RHBZ#1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0199", url: "https://www.cve.org/CVERecord?id=CVE-2019-0199", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", }, ], release_date: "2019-03-25T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat: Apache Tomcat HTTP/2 DoS", }, { cve: "CVE-2019-0221", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2019-05-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1713275", }, ], notes: [ { category: "description", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: XSS in SSI printenv", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "RHBZ#1713275", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713275", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0221", url: "https://www.cve.org/CVERecord?id=CVE-2019-0221", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0221", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0221", }, ], release_date: "2019-04-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "workaround", details: "SSI is disabled in the default Tomcat configuration. The vulnerable printenv command is intended for debugging, and is recommended to not be enabled for a production website.", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat: XSS in SSI printenv", }, { cve: "CVE-2019-0232", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2019-04-16T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1701056", }, ], notes: [ { category: "description", text: "A flaw was discovered in Apache Tomcat, where a Java Runtime Environment can pass a command-line argument in the Windows operating system. The execution of arbitrary commands via Tomcat’s Common Gateway Interface (CGI) Servlet, allows an attacker to perform remote code execution.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Remote Code Execution on Windows", title: "Vulnerability summary", }, { category: "other", text: "This vulnerability is specific to the Windows platform's treatment of file names and how they must be quoted. Tomcat running on Linux hosts is not affected.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0232", }, { category: "external", summary: "RHBZ#1701056", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1701056", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0232", url: "https://www.cve.org/CVERecord?id=CVE-2019-0232", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0232", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0232", }, ], release_date: "2019-04-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat: Remote Code Execution on Windows", }, { cve: "CVE-2019-1559", cwe: { id: "CWE-325", name: "Missing Cryptographic Step", }, discovery_date: "2019-02-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1683804", }, ], notes: [ { category: "description", text: "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", title: "Vulnerability description", }, { category: "summary", text: "openssl: 0-byte record padding oracle", title: "Vulnerability summary", }, { category: "other", text: "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-1559", }, { category: "external", summary: "RHBZ#1683804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1683804", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-1559", url: "https://www.cve.org/CVERecord?id=CVE-2019-1559", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", }, { category: "external", summary: "https://github.com/RUB-NDS/TLS-Padding-Oracles", url: "https://github.com/RUB-NDS/TLS-Padding-Oracles", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20190226.txt", url: "https://www.openssl.org/news/secadv/20190226.txt", }, ], release_date: "2019-02-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "workaround", details: "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: 0-byte record padding oracle", }, { cve: "CVE-2019-10072", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-06-25T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1723708", }, ], notes: [ { category: "description", text: "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-10072", }, { category: "external", summary: "RHBZ#1723708", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1723708", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-10072", url: "https://www.cve.org/CVERecord?id=CVE-2019-10072", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10072", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10072", }, { category: "external", summary: "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41", url: "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41", }, { category: "external", summary: "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20", url: "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20", }, ], release_date: "2019-06-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:08:26+00:00", details: "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { category: "workaround", details: "pki-servlet-container does not use HTTP/2 in its default configuration.", product_ids: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws.src", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.noarch", "6Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws.src", "6Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el6jws.noarch", "6Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.i686", "6Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el6jws.x86_64", "6Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws.src", "6Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el6jws.noarch", "6Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el6jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws.src", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.noarch", "7Server-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws.src", "7Server-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el7jws.noarch", "7Server-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el7jws.x86_64", "7Server-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws.src", "7Server-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el7jws.noarch", "7Server-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el7jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws.src", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.noarch", "8Base-JWS-5.2:jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws.src", "8Base-JWS-5.2:jws5-mod_cluster-tomcat-0:1.4.1-1.Final_redhat_00001.2.el8jws.noarch", "8Base-JWS-5.2:jws5-python-javapackages-0:3.4.1-5.15.11.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-admin-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-docs-webapp-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-el-3.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-javadoc-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-jsp-2.3-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-lib-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-native-debuginfo-0:1.2.21-34.redhat_34.el8jws.x86_64", "8Base-JWS-5.2:jws5-tomcat-selinux-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-servlet-4.0-api-0:9.0.21-10.redhat_4.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws.src", "8Base-JWS-5.2:jws5-tomcat-vault-javadoc-0:1.1.8-1.Final_redhat_1.1.el8jws.noarch", "8Base-JWS-5.2:jws5-tomcat-webapps-0:9.0.21-10.redhat_4.1.el8jws.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199", }, ], }
rhsa-2020:2366
Vulnerability from csaf_redhat
Published
2020-06-04 13:06
Modified
2025-03-17 02:36
Summary
Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update
Notes
Topic
An update is now available for Red Hat OpenShift Application Runtimes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
[NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-02-18. The advisory is informational only; no files in the release have changed.]
Details
Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform.
This release of Red Hat support for Spring Boot 2.1.12 serves as a replacement for Red Hat support for Spring Boot 2.1.6, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
* keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)
* keycloak: session hijack using the user access token (CVE-2019-3868)
* keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875)
* keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)
* keycloak: cross-realm user access auth bypass (CVE-2019-14832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update is now available for Red Hat OpenShift Application Runtimes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\n[NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-02-18. The advisory is informational only; no files in the release have changed.]", title: "Topic", }, { category: "general", text: "Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform.\n\nThis release of Red Hat support for Spring Boot 2.1.12 serves as a replacement for Red Hat support for Spring Boot 2.1.6, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\n* keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)\n\n* keycloak: session hijack using the user access token (CVE-2019-3868)\n\n* keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875)\n\n* keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)\n\n* keycloak: cross-realm user access auth bypass (CVE-2019-14832)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2020:2366", url: "https://access.redhat.com/errata/RHSA-2020:2366", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/", url: "https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/", }, { category: "external", summary: "1729261", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1729261", }, { category: "external", summary: "1749487", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487", }, { category: "external", summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.12", url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.12", }, { category: "external", summary: "1679144", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1679144", }, { category: "external", summary: "1690628", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1690628", }, { category: "external", summary: "1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "1728609", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1728609", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2366.json", }, ], title: "Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.12 security and bug fix update", tracking: { current_release_date: "2025-03-17T02:36:09+00:00", generator: { date: "2025-03-17T02:36:09+00:00", engine: { name: "Red Hat SDEngine", version: "4.4.1", }, }, id: "RHSA-2020:2366", initial_release_date: "2020-06-04T13:06:31+00:00", revision_history: [ { date: "2020-06-04T13:06:31+00:00", number: "1", summary: "Initial version", }, { date: "2020-06-04T13:06:31+00:00", number: "2", summary: "Last updated version", }, { date: "2025-03-17T02:36:09+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Runtimes Spring Boot 2.1.12", product: { name: "Red Hat Runtimes Spring Boot 2.1.12", product_id: "Red Hat Runtimes Spring Boot 2.1.12", product_identification_helper: { cpe: "cpe:/a:redhat:openshift_application_runtimes:1.0", }, }, }, ], category: "product_family", name: "Red Hat OpenShift Application Runtimes", }, ], category: "vendor", name: "Red Hat", }, ], }, vulnerabilities: [ { cve: "CVE-2019-0199", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-03-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1693325", }, ], notes: [ { category: "description", text: "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Apache Tomcat HTTP/2 DoS", title: "Vulnerability summary", }, { category: "other", text: "pki-servlet-container does not use HTTP/2 in its default configuration.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "RHBZ#1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0199", url: "https://www.cve.org/CVERecord?id=CVE-2019-0199", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", }, ], release_date: "2019-03-25T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat: Apache Tomcat HTTP/2 DoS", }, { acknowledgments: [ { names: [ "Caranzo Gideon", "Muzamil Muein", "Siddiqui Najam", ], organization: "Gemalto E&C", }, ], cve: "CVE-2019-3868", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, discovery_date: "2019-02-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1679144", }, ], notes: [ { category: "description", text: "Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: session hijack using the user access token", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-3868", }, { category: "external", summary: "RHBZ#1679144", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1679144", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-3868", url: "https://www.cve.org/CVERecord?id=CVE-2019-3868", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-3868", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-3868", }, ], release_date: "2019-04-23T16:59:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 3.8, baseSeverity: "LOW", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "HIGH", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "keycloak: session hijack using the user access token", }, { acknowledgments: [ { names: [ "Marek Posolda", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2019-3875", cwe: { id: "CWE-295", name: "Improper Certificate Validation", }, discovery_date: "2019-03-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1690628", }, ], notes: [ { category: "description", text: "A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: missing signatures validation on CRL used to verify client certificates", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-3875", }, { category: "external", summary: "RHBZ#1690628", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1690628", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-3875", url: "https://www.cve.org/CVERecord?id=CVE-2019-3875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-3875", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-3875", }, ], release_date: "2019-06-11T14:22:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "keycloak: missing signatures validation on CRL used to verify client certificates", }, { cve: "CVE-2019-10199", cwe: { id: "CWE-352", name: "Cross-Site Request Forgery (CSRF)", }, discovery_date: "2019-07-04T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1729261", }, ], notes: [ { category: "description", text: "It was found that Keycloak's account console did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: CSRF check missing in My Resources functionality in the Account Console", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-10199", }, { category: "external", summary: "RHBZ#1729261", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1729261", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-10199", url: "https://www.cve.org/CVERecord?id=CVE-2019-10199", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10199", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10199", }, ], release_date: "2019-08-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 4.6, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "keycloak: CSRF check missing in My Resources functionality in the Account Console", }, { cve: "CVE-2019-10201", cwe: { id: "CWE-287", name: "Improper Authentication", }, discovery_date: "2019-07-05T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1728609", }, ], notes: [ { category: "description", text: "It was found that Keycloak's SAML broker did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: SAML broker does not check existence of signature on document allowing any user impersonation", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-10201", }, { category: "external", summary: "RHBZ#1728609", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1728609", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-10201", url: "https://www.cve.org/CVERecord?id=CVE-2019-10201", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10201", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10201", }, ], release_date: "2019-08-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, { category: "workaround", details: "Administrator can prevent this issue for POST binding by requiring signed assertions.", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 8.1, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "keycloak: SAML broker does not check existence of signature on document allowing any user impersonation", }, { cve: "CVE-2019-14832", cwe: { id: "CWE-863", name: "Incorrect Authorization", }, discovery_date: "2019-07-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1749487", }, ], notes: [ { category: "description", text: "A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.", title: "Vulnerability description", }, { category: "summary", text: "keycloak: cross-realm user access auth bypass", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-14832", }, { category: "external", summary: "RHBZ#1749487", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1749487", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-14832", url: "https://www.cve.org/CVERecord?id=CVE-2019-14832", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-14832", }, ], release_date: "2019-10-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2020-06-04T13:06:31+00:00", details: "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", product_ids: [ "Red Hat Runtimes Spring Boot 2.1.12", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2020:2366", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "Red Hat Runtimes Spring Boot 2.1.12", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "keycloak: cross-realm user access auth bypass", }, ], }
rhsa-2019_3931
Vulnerability from csaf_redhat
Published
2019-11-20 16:04
Modified
2024-11-22 13:26
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release
Notes
Topic
Red Hat JBoss Web Server 5.2.0 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is available.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.
Security Fix(es):
* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)
* tomcat: XSS in SSI printenv (CVE-2019-0221)
* openssl: 0-byte record padding oracle (CVE-2019-1559)
* tomcat: HTTP/2 implementation leads to denial of service (CVE-2019-10072)
* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat JBoss Web Server 5.2.0 zip release for RHEL 6, RHEL 7, RHEL 8 and Microsoft Windows is available.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.\n \nRefer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.\n\nSecurity Fix(es):\n\n* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) \n* tomcat: XSS in SSI printenv (CVE-2019-0221) \n* openssl: 0-byte record padding oracle (CVE-2019-1559) \n* tomcat: HTTP/2 implementation leads to denial of service (CVE-2019-10072)\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2019:3931", url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "1645695", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1645695", }, { category: "external", summary: "1683804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1683804", }, { category: "external", summary: "1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "1713275", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713275", }, { category: "external", summary: "1723708", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1723708", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3931.json", }, ], title: "Red Hat Security Advisory: Red Hat JBoss Web Server 5.2 security release", tracking: { current_release_date: "2024-11-22T13:26:27+00:00", generator: { date: "2024-11-22T13:26:27+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2019:3931", initial_release_date: "2019-11-20T16:04:24+00:00", revision_history: [ { date: "2019-11-20T16:04:24+00:00", number: "1", summary: "Initial version", }, { date: "2019-12-02T16:22:21+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T13:26:27+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat JBoss Web Server 5", product: { name: "Red Hat JBoss Web Server 5", product_id: "Red Hat JBoss Web Server 5", product_identification_helper: { cpe: "cpe:/a:redhat:jboss_enterprise_web_server:5.2", }, }, }, ], category: "product_family", name: "Red Hat JBoss Web Server", }, ], category: "vendor", name: "Red Hat", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Alejandro Cabrera Aldaya", ], organization: "Universidad Tecnologica de la Habana CUJAE; Cuba", }, { names: [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan", ], }, { names: [ "Nicola Tuveri", ], organization: "Tampere University of Technology; Finland", }, ], cve: "CVE-2018-5407", cwe: { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", }, discovery_date: "2018-11-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1645695", }, ], notes: [ { category: "description", text: "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", title: "Vulnerability description", }, { category: "summary", text: "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", title: "Vulnerability summary", }, { category: "other", text: "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-5407", }, { category: "external", summary: "RHBZ#1645695", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1645695", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-5407", url: "https://www.cve.org/CVERecord?id=CVE-2018-5407", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", }, { category: "external", summary: "https://github.com/bbbrumley/portsmash", url: "https://github.com/bbbrumley/portsmash", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20181112.txt", url: "https://www.openssl.org/news/secadv/20181112.txt", }, ], release_date: "2018-10-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "workaround", details: "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", product_ids: [ "Red Hat JBoss Web Server 5", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "PHYSICAL", availabilityImpact: "NONE", baseScore: 4.8, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "CHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", version: "3.0", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", }, { cve: "CVE-2019-0199", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-03-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1693325", }, ], notes: [ { category: "description", text: "A flaw was found in Apache Tomcat, where the HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open, which enables them to cause server-side threads to block. This flaw eventually leads to a denial of service attack.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: Apache Tomcat HTTP/2 DoS", title: "Vulnerability summary", }, { category: "other", text: "pki-servlet-container does not use HTTP/2 in its default configuration.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "RHBZ#1693325", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1693325", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0199", url: "https://www.cve.org/CVERecord?id=CVE-2019-0199", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", }, ], release_date: "2019-03-25T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Important", }, ], title: "tomcat: Apache Tomcat HTTP/2 DoS", }, { cve: "CVE-2019-0221", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2019-05-23T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1713275", }, ], notes: [ { category: "description", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: XSS in SSI printenv", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "RHBZ#1713275", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1713275", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-0221", url: "https://www.cve.org/CVERecord?id=CVE-2019-0221", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-0221", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0221", }, ], release_date: "2019-04-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "workaround", details: "SSI is disabled in the default Tomcat configuration. The vulnerable printenv command is intended for debugging, and is recommended to not be enabled for a production website.", product_ids: [ "Red Hat JBoss Web Server 5", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Low", }, ], title: "tomcat: XSS in SSI printenv", }, { cve: "CVE-2019-1559", cwe: { id: "CWE-325", name: "Missing Cryptographic Step", }, discovery_date: "2019-02-26T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1683804", }, ], notes: [ { category: "description", text: "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", title: "Vulnerability description", }, { category: "summary", text: "openssl: 0-byte record padding oracle", title: "Vulnerability summary", }, { category: "other", text: "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-1559", }, { category: "external", summary: "RHBZ#1683804", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1683804", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-1559", url: "https://www.cve.org/CVERecord?id=CVE-2019-1559", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", }, { category: "external", summary: "https://github.com/RUB-NDS/TLS-Padding-Oracles", url: "https://github.com/RUB-NDS/TLS-Padding-Oracles", }, { category: "external", summary: "https://www.openssl.org/news/secadv/20190226.txt", url: "https://www.openssl.org/news/secadv/20190226.txt", }, ], release_date: "2019-02-26T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "workaround", details: "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.", product_ids: [ "Red Hat JBoss Web Server 5", ], }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "openssl: 0-byte record padding oracle", }, { cve: "CVE-2019-10072", cwe: { id: "CWE-400", name: "Uncontrolled Resource Consumption", }, discovery_date: "2019-06-25T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1723708", }, ], notes: [ { category: "description", text: "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "Vulnerability description", }, { category: "summary", text: "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "Red Hat JBoss Web Server 5", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2019-10072", }, { category: "external", summary: "RHBZ#1723708", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1723708", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2019-10072", url: "https://www.cve.org/CVERecord?id=CVE-2019-10072", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2019-10072", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-10072", }, { category: "external", summary: "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41", url: "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41", }, { category: "external", summary: "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20", url: "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20", }, ], release_date: "2019-06-21T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-11-20T16:04:24+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "Red Hat JBoss Web Server 5", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { category: "workaround", details: "pki-servlet-container does not use HTTP/2 in its default configuration.", product_ids: [ "Red Hat JBoss Web Server 5", ], }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "LOW", baseScore: 5.3, baseSeverity: "MEDIUM", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "Red Hat JBoss Web Server 5", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199", }, ], }
gsd-2019-0199
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Aliases
Aliases
{ GSD: { alias: "CVE-2019-0199", description: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", id: "GSD-2019-0199", references: [ "https://www.suse.com/security/cve/CVE-2019-0199.html", "https://www.debian.org/security/2019/dsa-4596", "https://access.redhat.com/errata/RHSA-2020:2366", "https://access.redhat.com/errata/RHSA-2019:3931", "https://access.redhat.com/errata/RHSA-2019:3929", "https://advisories.mageia.org/CVE-2019-0199.html", "https://alas.aws.amazon.com/cve/html/CVE-2019-0199.html", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2019-0199", ], details: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", id: "GSD-2019-0199", modified: "2023-12-13T01:23:39.102975Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "security@apache.org", ID: "CVE-2019-0199", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "Apache Tomcat", version: { version_data: [ { version_value: "Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "DoS", }, ], }, ], }, references: { reference_data: [ { name: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E", refsource: "MISC", url: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E", }, { name: "https://security.netapp.com/advisory/ntap-20190419-0001/", refsource: "CONFIRM", url: "https://security.netapp.com/advisory/ntap-20190419-0001/", }, { name: "[tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199", refsource: "MLIST", url: "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e@%3Ccommits.tomee.apache.org%3E", }, { name: "[tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067@%3Cusers.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094@%3Cdev.tomcat.apache.org%3E", }, { name: "[announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef@%3Cannounce.apache.org%3E", }, { name: "[tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml", refsource: "MLIST", url: "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c@%3Cusers.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600@%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6@%3Cusers.tomcat.apache.org%3E", }, { name: "[announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "MLIST", url: "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9@%3Cannounce.apache.org%3E", }, { name: "FEDORA-2019-1a3f878d27", refsource: "FEDORA", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/", }, { name: "https://support.f5.com/csp/article/K17321505", refsource: "CONFIRM", url: "https://support.f5.com/csp/article/K17321505", }, { name: "openSUSE-SU-2019:1673", refsource: "SUSE", url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html", }, { name: "FEDORA-2019-d66febb5df", refsource: "FEDORA", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/", }, { name: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", refsource: "MISC", url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", }, { name: "107674", refsource: "BID", url: "http://www.securityfocus.com/bid/107674", }, { name: "openSUSE-SU-2019:1723", refsource: "SUSE", url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html", }, { name: "openSUSE-SU-2019:1808", refsource: "SUSE", url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html", }, { name: "RHSA-2019:3929", refsource: "REDHAT", url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { name: "RHSA-2019:3931", refsource: "REDHAT", url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { name: "DSA-4596", refsource: "DEBIAN", url: "https://www.debian.org/security/2019/dsa-4596", }, { name: "20191229 [SECURITY] [DSA 4596-1] tomcat8 security update", refsource: "BUGTRAQ", url: "https://seclists.org/bugtraq/2019/Dec/43", }, { name: "https://www.oracle.com/security-alerts/cpujan2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpujan2020.html", }, { name: "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E", }, { name: "https://www.oracle.com/security-alerts/cpuapr2020.html", refsource: "MISC", url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, ], }, }, "gitlab.com": { advisories: [ { affected_range: "[9.0.0,9.0.16),[8.0.0,8.5.38)", affected_versions: "All versions starting from 9.0.0 before 9.0.16, all versions starting from 8.0.0 before 8.5.38", cvss_v2: "AV:N/AC:L/Au:N/C:N/I:N/A:P", cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", cwe_ids: [ "CWE-1035", "CWE-400", "CWE-937", ], date: "2021-08-30", description: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", fixed_versions: [ "9.0.16", "9.0.16", ], identifier: "CVE-2019-0199", identifiers: [ "GHSA-qcxh-w3j9-58qr", "CVE-2019-0199", ], not_impacted: "All versions before 9.0.0, all versions starting from 9.0.16, all versions before 8.0.0, all versions starting from 8.5.38", package_slug: "maven/org.apache.tomcat.embed/tomcat-embed-core", pubdate: "2020-06-15", solution: "Upgrade to versions 9.0.16, 9.0.16 or above.", title: "Uncontrolled Resource Consumption", urls: [ "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", "https://access.redhat.com/errata/RHSA-2019:3929", "https://access.redhat.com/errata/RHSA-2019:3931", "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a@%3Cdev.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094@%3Cdev.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6@%3Cusers.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067@%3Cusers.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50@%3Cdev.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600@%3Cannounce.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e@%3Ccommits.tomee.apache.org%3E", "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c@%3Cusers.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E", "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/", "https://seclists.org/bugtraq/2019/Dec/43", "https://security.netapp.com/advisory/ntap-20190419-0001/", "https://support.f5.com/csp/article/K17321505", "https://www.debian.org/security/2019/dsa-4596", "https://www.oracle.com/security-alerts/cpuapr2020.html", "https://www.oracle.com/security-alerts/cpujan2020.html", "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html", "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html", "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html", "http://www.securityfocus.com/bid/107674", "https://github.com/advisories/GHSA-qcxh-w3j9-58qr", ], uuid: "19804a66-65a8-4c72-848b-90d17b602a42", }, { affected_range: "[8.5.0,8.5.37],[9.0.0.M1,9.0.14]", affected_versions: "All versions starting from 8.5.0 up to 8.5.37, all versions starting from 9.0.0.M1 up to 9.0.14", cvss_v2: "AV:N/AC:L/Au:N/C:N/I:N/A:P", cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", cwe_ids: [ "CWE-1035", "CWE-400", "CWE-937", ], date: "2019-05-28", description: "The HTTP/2 implementation in Apache Tomcat accepted streams with excessive numbers of `SETTINGS` frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", fixed_versions: [ "8.5.38", "9.0.16", ], identifier: "CVE-2019-0199", identifiers: [ "CVE-2019-0199", ], not_impacted: "All versions before 8.5.0, all versions after 8.5.37 before 9.0.0.M1, all versions after 9.0.14", package_slug: "maven/org.apache.tomcat/tomcat-util", pubdate: "2019-04-10", solution: "Upgrade to versions 8.5.38, 9.0.16 or above.", title: "Uncontrolled Resource Consumption", urls: [ "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", ], uuid: "f8f33450-a363-4e6a-8623-97f78eb8e090", }, { affected_range: "[8.5.0,8.5.37],[9.0.0.M1,9.0.14]", affected_versions: "All versions starting from 8.5.0 up to 8.5.37, all versions starting from 9.0.0.M1 up to 9.0.14", cvss_v2: "AV:N/AC:L/Au:N/C:N/I:N/A:P", cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", cwe_ids: [ "CWE-1035", "CWE-400", "CWE-937", ], date: "2019-05-28", description: "The HTTP/2 implementation in Apache Tomcat accepted streams with excessive numbers of `SETTINGS` frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", fixed_versions: [ "8.5.38", "9.0.16", ], identifier: "CVE-2019-0199", identifiers: [ "CVE-2019-0199", ], not_impacted: "All versions before 8.5.0, all versions after 8.5.37 before 9.0.0.M1, all versions after 9.0.14", package_slug: "maven/org.apache.tomcat/tomcat", pubdate: "2019-04-10", solution: "Upgrade to versions 8.5.38, 9.0.16 or above.", title: "Uncontrolled Resource Consumption", urls: [ "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", ], uuid: "8583efcf-fbee-4841-aed9-a9bdec997d8a", }, ], }, "nvd.nist.gov": { configurations: { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", cpe_name: [], versionEndIncluding: "9.0.14", versionStartIncluding: "9.0.1", vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", cpe_name: [], versionEndIncluding: "8.5.37", versionStartIncluding: "8.5.0", vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, cve: { CVE_data_meta: { ASSIGNER: "security@apache.org", ID: "CVE-2019-0199", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "en", value: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "en", value: "CWE-400", }, ], }, ], }, references: { reference_data: [ { name: "https://security.netapp.com/advisory/ntap-20190419-0001/", refsource: "CONFIRM", tags: [ "Third Party Advisory", ], url: "https://security.netapp.com/advisory/ntap-20190419-0001/", }, { name: "https://support.f5.com/csp/article/K17321505", refsource: "CONFIRM", tags: [], url: "https://support.f5.com/csp/article/K17321505", }, { name: "openSUSE-SU-2019:1673", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html", }, { name: "107674", refsource: "BID", tags: [], url: "http://www.securityfocus.com/bid/107674", }, { name: "RHSA-2019:3929", refsource: "REDHAT", tags: [], url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { name: "RHSA-2019:3931", refsource: "REDHAT", tags: [], url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { name: "DSA-4596", refsource: "DEBIAN", tags: [], url: "https://www.debian.org/security/2019/dsa-4596", }, { name: "20191229 [SECURITY] [DSA 4596-1] tomcat8 security update", refsource: "BUGTRAQ", tags: [], url: "https://seclists.org/bugtraq/2019/Dec/43", }, { name: "https://www.oracle.com/security-alerts/cpujan2020.html", refsource: "MISC", tags: [], url: "https://www.oracle.com/security-alerts/cpujan2020.html", }, { name: "N/A", refsource: "N/A", tags: [], url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, { name: "openSUSE-SU-2019:1808", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html", }, { name: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", refsource: "MISC", tags: [], url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", }, { name: "openSUSE-SU-2019:1723", refsource: "SUSE", tags: [], url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html", }, { name: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomee-commits] 20190528 [jira] [Closed] (TOMEE-2497) Upgrade Tomcat in TomEE 7.0.x/7.1.x/8.0.x for CVE-2019-0199", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E", }, { name: "[tomcat-users] 20190620 Re: [EXTERNAL] [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E", }, { name: "[announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E", }, { name: "[tomcat-announce] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 svn commit: r1861711 - in /tomcat/site/trunk: docs/security-8.html docs/security-9.html xdocs/security-8.xml xdocs/security-9.xml", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-users] 20190620 [SECURITY] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E", }, { name: "[tomcat-users] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E", }, { name: "[announce] 20190620 [SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E", }, { name: "FEDORA-2019-1a3f878d27", refsource: "", tags: [], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/", }, { name: "FEDORA-2019-d66febb5df", refsource: "", tags: [], url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/", }, { name: "[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E", }, { name: "[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/", refsource: "", tags: [], url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E", }, ], }, }, impact: { baseMetricV2: { acInsufInfo: false, cvssV2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", integrityImpact: "NONE", vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", userInteractionRequired: false, }, baseMetricV3: { cvssV3: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, exploitabilityScore: 3.9, impactScore: 3.6, }, }, lastModifiedDate: "2023-12-08T16:41Z", publishedDate: "2019-04-10T15:29Z", }, }, }
ghsa-qcxh-w3j9-58qr
Vulnerability from github
Published
2020-06-15 18:51
Modified
2023-12-08 22:47
Severity ?
Summary
Apache Tomcat Denial of Service vulnerability
Details
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
{ affected: [ { package: { ecosystem: "Maven", name: "org.apache.tomcat.embed:tomcat-embed-core", }, ranges: [ { events: [ { introduced: "9.0.0", }, { fixed: "9.0.16", }, ], type: "ECOSYSTEM", }, ], }, { package: { ecosystem: "Maven", name: "org.apache.tomcat.embed:tomcat-embed-core", }, ranges: [ { events: [ { introduced: "8.0.0", }, { fixed: "8.5.38", }, ], type: "ECOSYSTEM", }, ], }, ], aliases: [ "CVE-2019-0199", ], database_specific: { cwe_ids: [ "CWE-400", ], github_reviewed: true, github_reviewed_at: "2020-06-15T16:43:54Z", nvd_published_at: "2019-04-10T15:29:00Z", severity: "HIGH", }, details: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", id: "GHSA-qcxh-w3j9-58qr", modified: "2023-12-08T22:47:08Z", published: "2020-06-15T18:51:09Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2019-0199", }, { type: "WEB", url: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e@%3Ccommits.tomee.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c@%3Cusers.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3", }, { type: "WEB", url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46", }, { type: "WEB", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3", }, { type: "WEB", url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46", }, { type: "WEB", url: "https://seclists.org/bugtraq/2019/Dec/43", }, { type: "WEB", url: "https://security.netapp.com/advisory/ntap-20190419-0001", }, { type: "WEB", url: "https://support.f5.com/csp/article/K17321505", }, { type: "WEB", url: "https://web.archive.org/web/20200227030041/http://www.securityfocus.com/bid/107674", }, { type: "WEB", url: "https://www.debian.org/security/2019/dsa-4596", }, { type: "WEB", url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, { type: "WEB", url: "https://www.oracle.com/security-alerts/cpujan2020.html", }, { type: "WEB", url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2019:3929", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2019:3931", }, { type: "PACKAGE", url: "https://github.com/apache/tomcat", }, { type: "WEB", url: "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a@%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094@%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6@%3Cusers.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067@%3Cusers.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50@%3Cdev.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9@%3Cannounce.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef@%3Cannounce.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600@%3Cannounce.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html", }, { type: "WEB", url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html", }, ], schema_version: "1.4.0", severity: [ { score: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", type: "CVSS_V3", }, ], summary: "Apache Tomcat Denial of Service vulnerability", }
var-201904-1069
Vulnerability from variot
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. Apache Tomcat Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Apache Tomcat is a lightweight web application server from the Apache Software Foundation. This program implements support for Servlet and JavaServerPage (JSP). There is a security vulnerability in Apache Tomcat. An attacker could exploit the vulnerability to cause a denial of service. Attackers may leverage this issue to cause denial-of-service conditions. A vulnerability in Apache Tomcat could allow an unauthenticated, remote malicious user to cause a denial of service (DoS) condition on a targeted system. The vulnerability is due to a resource exhaustion condition in the HTTP/2 implementation of the affected software. A successful exploit could result in a DoS condition on the targeted system. Apache has confirmed the vulnerability and released software updates. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Debian Security Advisory DSA-4596-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff December 27, 2019 https://www.debian.org/security/faq
Package : tomcat8 CVE ID : CVE-2018-8014 CVE-2018-11784 CVE-2019-0199 CVE-2019-0221 CVE-2019-12418 CVE-2019-17563
Several issues were discovered in the Tomcat servlet and JSP engine, which could result in session fixation attacks, information disclosure, cross- site scripting, denial of service via resource exhaustion and insecure redirects.
For the oldstable distribution (stretch), these problems have been fixed in version 8.5.50-0+deb9u1. This update also requires an updated version of tomcat-native which has been updated to 1.2.21-1~deb9u1.
We recommend that you upgrade your tomcat8 packages.
For the detailed security status of tomcat8 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/tomcat8
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl4GgDcACgkQEMKTtsN8 TjaVxA//dmUGPdFZSI6VW/avTJ8YKIgVaKTLJz47hl9GKWJoGI4lG5TE4INs193y xKf2gtuPb/YCdqZj2VphPTiPiIbycXrRXTq9uGnioteeAZfgKnqSokcQ+EvUItsp Q7nBeuFNdSHaK1TAQ74Ty4qcwM/WXQ5c0UfZvAbMzYp3PRrkHkMXhUHMj7MJNz7W 6I/ehY+h+VkvTj7P6U3icEoLsTqOwKiHFiAVKD9DiUZqRI62nmbMW2il1zgF3pOZ QNrDGhNsaVfhJbIES3/vuF/qSQIm6GryQ1dwxbFBszemdHTGEQmANsxLLXWnPDH1 2KigZh5bkSlQZvJRHgbJp+LdM+DSY7VI1KtwTIkpwFZ2/kbz+kMGGT+TQplSORyL IY9SK1aQduWBx2yi3X7/wPXVdV7KA1cMCPhSt8fVieYxZWtONALBuCdnSSEweIEq myd2GD75QIHjZy7JZoVc421kCjH4IrXxuwEQDkHjKTladjdklOREEocAc8R+NjSS kUKdS2cOel6M2yjH/ieOv3DVaUPplgl+0KJGXqAhdkCQUwTMsw1tmR/ObWkCHQov k79Isubwc5kuQD/iBCuIQM8TgfNcyWXNAyHbpKR7kGkrn/ihN7dsCdvRjrMPrvRJ x/PLd3rjlgS5D1cEf7PTZZjym4mwDPrKgamSt9V3f3RwFwV75vY= =je4v -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Important: Red Hat support for Spring Boot 2.1.12 security and bug fix update Advisory ID: RHSA-2020:2366-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2020:2366 Issue date: 2020-06-04 CVE Names: CVE-2019-0199 CVE-2019-3868 CVE-2019-3875 CVE-2019-10199 CVE-2019-10201 CVE-2019-14832 =====================================================================
- Summary:
An update is now available for Red Hat OpenShift Application Runtimes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
[NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-02-18. The advisory is informational only; no files in the release have changed.]
- Description:
Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform.
This release of Red Hat support for Spring Boot 2.1.12 serves as a replacement for Red Hat support for Spring Boot 2.1.6, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
-
tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)
-
keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201)
-
keycloak: session hijack using the user access token (CVE-2019-3868)
-
keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875)
-
keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199)
-
keycloak: cross-realm user access auth bypass (CVE-2019-14832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Solution:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
The References section of this erratum contains a download link (you must log in to download the update).
- Bugs fixed (https://bugzilla.redhat.com/):
1679144 - CVE-2019-3868 keycloak: session hijack using the user access token 1690628 - CVE-2019-3875 keycloak: missing signatures validation on CRL used to verify client certificates 1693325 - CVE-2019-0199 tomcat: Apache Tomcat HTTP/2 DoS 1728609 - CVE-2019-10201 keycloak: SAML broker does not check existence of signature on document allowing any user impersonation 1729261 - CVE-2019-10199 keycloak: CSRF check missing in My Resources functionality in the Account Console 1749487 - CVE-2019-14832 keycloak: cross-realm user access auth bypass
- References:
https://access.redhat.com/security/cve/CVE-2019-0199 https://access.redhat.com/security/cve/CVE-2019-3868 https://access.redhat.com/security/cve/CVE-2019-3875 https://access.redhat.com/security/cve/CVE-2019-10199 https://access.redhat.com/security/cve/CVE-2019-10201 https://access.redhat.com/security/cve/CVE-2019-14832 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.12 https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBXtjx9tzjgjWX9erEAQhFOA//Tkk46vAF4/aJiKVApEHvF5R96081W2Hq G96k3lUPuatTrcD/2yek9whs1Bf9MQgWcaFWCgx63nsNs6Mm81frsR/dt4YV8mWc 97y4u6kz6nvQQ6Wz6Xuic9km17/yXuNl5JqgmcLtltgNhtWgZhpQUKfbP3ot0T2X FStJvnZlPrgDnpnVZ8y6x++otaDfbXGiy2FyGepXei8WWxXtQ/XYPoQC/mYbuXgM eUNsFLEyY9hWLCE4vfavLCM4fHs+djrL2E6N431JhpLyCrbTx0nYkaMkoOoJlLe2 agJjBzd5iYnBbD6p9K5okIWR1U2gNsdV6Q7UROTLiEFoxBOr1hO1mzqYkJ80t1Pm d48N7OuQ4MhYgiKftVDmsVgXuQzySUrjZWnZZnDbVZo02gwD8T1NXgq9zCX64/sl ucKvbDnnmLDYQYsKRCjf1aH1ZDrrPOPIOkTbMlb4+Wqc/O8jrRfzvya0ym9wnN8v CG3VmxPBPeNgp6/pmTBrJU9c+dER9qmavAB77Vl09dH88V9Ne4GLiVfqSVOEhY1w vwZo31fNXNYFYT/NV2v9CiZwrRcsqn60VH0E4Qc+zTOb5esR7bIidcBMGtPm+BI0 80uR7D6DwjVmZsfzwakCIiGMaChysonql+P72iOd2Xerj7osdvMSEQHSVSjuILh7 wiv1ksQVw/s= =pUHq -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-201904-1069", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "tomcat", scope: "eq", trust: 1.1, vendor: "apache", version: "9.0.0", }, { model: "tomcat", scope: "gte", trust: 1, vendor: "apache", version: "9.0.1", }, { model: "tomcat", scope: "lte", trust: 1, vendor: "apache", version: "9.0.14", }, { model: "tomcat", scope: "lte", trust: 1, vendor: "apache", version: "8.5.37", }, { model: "tomcat", scope: "gte", trust: 1, vendor: "apache", version: "8.5.0", }, { model: "tomcat", scope: "eq", trust: 0.8, vendor: "apache", version: "8.5.0 to 8.5.37", }, { model: "tomcat", scope: "eq", trust: 0.8, vendor: "apache", version: "9.0.0.m1 to 9.0.14", }, { model: "tomcat", scope: null, trust: 0.6, vendor: "apache", version: null, }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.0", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.1", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.2", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.3", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.4", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.5", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.6", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.7", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.8", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.9", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.11", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.12", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.13", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.14", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.15", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.16", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.23", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.24", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.27", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.28", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.30", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.31", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.32", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.34", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "8.5.37", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "9.0.1", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "9.0.4", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "9.0.5", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "9.0.7", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "9.0.8", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "9.0.9", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "9.0.10", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "9.0.12", }, { model: "tomcat", scope: "eq", trust: 0.4, vendor: "apache", version: "9.0.14", }, { model: "instantis enterprisetrack", scope: "eq", trust: 0.3, vendor: "oracle", version: "17.3", }, { model: "instantis enterprisetrack", scope: "eq", trust: 0.3, vendor: "oracle", version: "17.2", }, { model: "instantis enterprisetrack", scope: "eq", trust: 0.3, vendor: "oracle", version: "17.1", }, { model: "tomcat 9.0.0m8", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0m6", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m9", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m7", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m5", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m4", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m3", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m22", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m21", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m20", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m2", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m19", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m18", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m17", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m15", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m13", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m12", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m11", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m10", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat 9.0.0.m1", scope: null, trust: 0.3, vendor: "apache", version: null, }, { model: "tomcat", scope: "ne", trust: 0.3, vendor: "apache", version: "9.0.16", }, { model: "tomcat", scope: "ne", trust: 0.3, vendor: "apache", version: "8.5.38", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.10", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.17", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.18", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.19", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.20", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.21", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.22", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.25", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.26", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.29", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.33", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.35", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "8.5.36", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "9.0.2", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "9.0.3", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "9.0.6", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "9.0.11", }, { model: "tomcat", scope: "eq", trust: 0.1, vendor: "apache", version: "9.0.13", }, ], sources: [ { db: "CNVD", id: "CNVD-2019-15086", }, { db: "VULMON", id: "CVE-2019-0199", }, { db: "BID", id: "107674", }, { db: "JVNDB", id: "JVNDB-2019-003375", }, { db: "NVD", id: "CVE-2019-0199", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", cpe_name: [], versionEndIncluding: "9.0.14", versionStartIncluding: "9.0.1", vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", cpe_name: [], versionEndIncluding: "8.5.37", versionStartIncluding: "8.5.0", vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "NVD", id: "CVE-2019-0199", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Inc,Debian,Michal Karm Babacek from Red Hat", sources: [ { db: "CNNVD", id: "CNNVD-201903-919", }, ], trust: 0.6, }, cve: "CVE-2019-0199", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { acInsufInfo: false, accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "NVD", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", exploitabilityScore: 10, impactScore: 2.9, integrityImpact: "NONE", obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", trust: 1, userInteractionRequired: false, vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, { acInsufInfo: null, accessComplexity: "Low", accessVector: "Network", authentication: "None", author: "NVD", availabilityImpact: "Partial", baseScore: 5, confidentialityImpact: "None", exploitabilityScore: null, id: "CVE-2019-0199", impactScore: null, integrityImpact: "None", obtainAllPrivilege: null, obtainOtherPrivilege: null, obtainUserPrivilege: null, severity: "Medium", trust: 0.9, userInteractionRequired: null, vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "CNVD", availabilityImpact: "PARTIAL", baseScore: 5, confidentialityImpact: "NONE", exploitabilityScore: 10, id: "CNVD-2019-15086", impactScore: 2.9, integrityImpact: "NONE", severity: "MEDIUM", trust: 0.6, vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P", version: "2.0", }, ], cvssV3: [ { attackComplexity: "LOW", attackVector: "NETWORK", author: "NVD", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", exploitabilityScore: 3.9, impactScore: 3.6, integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", trust: 1, userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, { attackComplexity: "Low", attackVector: "Network", author: "NVD", availabilityImpact: "High", baseScore: 7.5, baseSeverity: "High", confidentialityImpact: "None", exploitabilityScore: null, id: "CVE-2019-0199", impactScore: null, integrityImpact: "None", privilegesRequired: "None", scope: "Unchanged", trust: 0.8, userInteraction: "None", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, ], severity: [ { author: "NVD", id: "CVE-2019-0199", trust: 1.8, value: "HIGH", }, { author: "CNVD", id: "CNVD-2019-15086", trust: 0.6, value: "MEDIUM", }, { author: "CNNVD", id: "CNNVD-201903-919", trust: 0.6, value: "HIGH", }, { author: "VULMON", id: "CVE-2019-0199", trust: 0.1, value: "MEDIUM", }, ], }, ], sources: [ { db: "CNVD", id: "CNVD-2019-15086", }, { db: "VULMON", id: "CVE-2019-0199", }, { db: "JVNDB", id: "JVNDB-2019-003375", }, { db: "NVD", id: "CVE-2019-0199", }, { db: "CNNVD", id: "CNNVD-201903-919", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. Apache Tomcat Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Apache Tomcat is a lightweight web application server from the Apache Software Foundation. This program implements support for Servlet and JavaServerPage (JSP). There is a security vulnerability in Apache Tomcat. An attacker could exploit the vulnerability to cause a denial of service. \nAttackers may leverage this issue to cause denial-of-service conditions. A vulnerability in Apache Tomcat could allow an unauthenticated, remote malicious user to cause a denial of service (DoS) condition on a targeted system. \nThe vulnerability is due to a resource exhaustion condition in the HTTP/2 implementation of the affected software. A successful exploit could result in a DoS condition on the targeted system. \nApache has confirmed the vulnerability and released software updates. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4596-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nDecember 27, 2019 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : tomcat8\nCVE ID : CVE-2018-8014 CVE-2018-11784 CVE-2019-0199 CVE-2019-0221 \n CVE-2019-12418 CVE-2019-17563\n\nSeveral issues were discovered in the Tomcat servlet and JSP engine, which\ncould result in session fixation attacks, information disclosure, cross-\nsite scripting, denial of service via resource exhaustion and insecure\nredirects. \n\nFor the oldstable distribution (stretch), these problems have been fixed\nin version 8.5.50-0+deb9u1. This update also requires an updated version\nof tomcat-native which has been updated to 1.2.21-1~deb9u1. \n\nWe recommend that you upgrade your tomcat8 packages. \n\nFor the detailed security status of tomcat8 please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/tomcat8\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl4GgDcACgkQEMKTtsN8\nTjaVxA//dmUGPdFZSI6VW/avTJ8YKIgVaKTLJz47hl9GKWJoGI4lG5TE4INs193y\nxKf2gtuPb/YCdqZj2VphPTiPiIbycXrRXTq9uGnioteeAZfgKnqSokcQ+EvUItsp\nQ7nBeuFNdSHaK1TAQ74Ty4qcwM/WXQ5c0UfZvAbMzYp3PRrkHkMXhUHMj7MJNz7W\n6I/ehY+h+VkvTj7P6U3icEoLsTqOwKiHFiAVKD9DiUZqRI62nmbMW2il1zgF3pOZ\nQNrDGhNsaVfhJbIES3/vuF/qSQIm6GryQ1dwxbFBszemdHTGEQmANsxLLXWnPDH1\n2KigZh5bkSlQZvJRHgbJp+LdM+DSY7VI1KtwTIkpwFZ2/kbz+kMGGT+TQplSORyL\nIY9SK1aQduWBx2yi3X7/wPXVdV7KA1cMCPhSt8fVieYxZWtONALBuCdnSSEweIEq\nmyd2GD75QIHjZy7JZoVc421kCjH4IrXxuwEQDkHjKTladjdklOREEocAc8R+NjSS\nkUKdS2cOel6M2yjH/ieOv3DVaUPplgl+0KJGXqAhdkCQUwTMsw1tmR/ObWkCHQov\nk79Isubwc5kuQD/iBCuIQM8TgfNcyWXNAyHbpKR7kGkrn/ihN7dsCdvRjrMPrvRJ\nx/PLd3rjlgS5D1cEf7PTZZjym4mwDPrKgamSt9V3f3RwFwV75vY=\n=je4v\n-----END PGP SIGNATURE-----\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Important: Red Hat support for Spring Boot 2.1.12 security and bug fix update\nAdvisory ID: RHSA-2020:2366-01\nProduct: Red Hat OpenShift Application Runtimes\nAdvisory URL: https://access.redhat.com/errata/RHSA-2020:2366\nIssue date: 2020-06-04\nCVE Names: CVE-2019-0199 CVE-2019-3868 CVE-2019-3875 \n CVE-2019-10199 CVE-2019-10201 CVE-2019-14832 \n=====================================================================\n\n1. Summary:\n\nAn update is now available for Red Hat OpenShift Application Runtimes. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n[NOTE: This security advisory was unintentionally omitted at the time of\nthe initial software release on 2020-02-18. The advisory is informational\nonly; no files in the release have changed.]\n\n2. Description:\n\nRed Hat support for Spring Boot provides an application platform that\nreduces the complexity of developing and operating applications (monoliths\nand microservices) for OpenShift as a containerized platform. \n\nThis release of Red Hat support for Spring Boot 2.1.12 serves as a\nreplacement for Red Hat support for Spring Boot 2.1.6, and includes\nsecurity and bug fixes and enhancements. For further information, refer to\nthe release notes linked to in the References section. \n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199)\n\n* keycloak: SAML broker does not check existence of signature on document\nallowing any user impersonation (CVE-2019-10201)\n\n* keycloak: session hijack using the user access token (CVE-2019-3868)\n\n* keycloak: missing signatures validation on CRL used to verify client\ncertificates (CVE-2019-3875)\n\n* keycloak: CSRF check missing in My Resources functionality in the Account\nConsole (CVE-2019-10199)\n\n* keycloak: cross-realm user access auth bypass (CVE-2019-14832)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n3. Solution:\n\nBefore applying the update, back up your existing installation, including\nall applications, configuration files, databases and database settings, and\nso on. \n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). \n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1679144 - CVE-2019-3868 keycloak: session hijack using the user access token\n1690628 - CVE-2019-3875 keycloak: missing signatures validation on CRL used to verify client certificates\n1693325 - CVE-2019-0199 tomcat: Apache Tomcat HTTP/2 DoS\n1728609 - CVE-2019-10201 keycloak: SAML broker does not check existence of signature on document allowing any user impersonation\n1729261 - CVE-2019-10199 keycloak: CSRF check missing in My Resources functionality in the Account Console\n1749487 - CVE-2019-14832 keycloak: cross-realm user access auth bypass\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2019-0199\nhttps://access.redhat.com/security/cve/CVE-2019-3868\nhttps://access.redhat.com/security/cve/CVE-2019-3875\nhttps://access.redhat.com/security/cve/CVE-2019-10199\nhttps://access.redhat.com/security/cve/CVE-2019-10201\nhttps://access.redhat.com/security/cve/CVE-2019-14832\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.12\nhttps://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/\n\n6. Contact:\n\nThe Red Hat security contact is <secalert@redhat.com>. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXtjx9tzjgjWX9erEAQhFOA//Tkk46vAF4/aJiKVApEHvF5R96081W2Hq\nG96k3lUPuatTrcD/2yek9whs1Bf9MQgWcaFWCgx63nsNs6Mm81frsR/dt4YV8mWc\n97y4u6kz6nvQQ6Wz6Xuic9km17/yXuNl5JqgmcLtltgNhtWgZhpQUKfbP3ot0T2X\nFStJvnZlPrgDnpnVZ8y6x++otaDfbXGiy2FyGepXei8WWxXtQ/XYPoQC/mYbuXgM\neUNsFLEyY9hWLCE4vfavLCM4fHs+djrL2E6N431JhpLyCrbTx0nYkaMkoOoJlLe2\nagJjBzd5iYnBbD6p9K5okIWR1U2gNsdV6Q7UROTLiEFoxBOr1hO1mzqYkJ80t1Pm\nd48N7OuQ4MhYgiKftVDmsVgXuQzySUrjZWnZZnDbVZo02gwD8T1NXgq9zCX64/sl\nucKvbDnnmLDYQYsKRCjf1aH1ZDrrPOPIOkTbMlb4+Wqc/O8jrRfzvya0ym9wnN8v\nCG3VmxPBPeNgp6/pmTBrJU9c+dER9qmavAB77Vl09dH88V9Ne4GLiVfqSVOEhY1w\nvwZo31fNXNYFYT/NV2v9CiZwrRcsqn60VH0E4Qc+zTOb5esR7bIidcBMGtPm+BI0\n80uR7D6DwjVmZsfzwakCIiGMaChysonql+P72iOd2Xerj7osdvMSEQHSVSjuILh7\nwiv1ksQVw/s=\n=pUHq\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n", sources: [ { db: "NVD", id: "CVE-2019-0199", }, { db: "JVNDB", id: "JVNDB-2019-003375", }, { db: "CNVD", id: "CNVD-2019-15086", }, { db: "BID", id: "107674", }, { db: "VULMON", id: "CVE-2019-0199", }, { db: "PACKETSTORM", id: "155792", }, { db: "PACKETSTORM", id: "157964", }, ], trust: 2.7, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2019-0199", trust: 3.6, }, { db: "BID", id: "107674", trust: 1.9, }, { db: "JVNDB", id: "JVNDB-2019-003375", trust: 0.8, }, { db: "PACKETSTORM", id: "155792", trust: 0.7, }, { db: "PACKETSTORM", id: "157964", trust: 0.7, }, { db: "CNVD", id: "CNVD-2019-15086", trust: 0.6, }, { db: "AUSCERT", id: "ESB-2019.2230", trust: 0.6, }, { db: "AUSCERT", id: "ESB-2019.1958", trust: 0.6, }, { db: "AUSCERT", id: "ESB-2019.0980", trust: 0.6, }, { db: "AUSCERT", id: "ESB-2019.4405", trust: 0.6, }, { db: "AUSCERT", id: "ESB-2020.0014", trust: 0.6, }, { db: "AUSCERT", id: "ESB-2019.2295", trust: 0.6, }, { db: "AUSCERT", id: "ESB-2019.1966", trust: 0.6, }, { db: "AUSCERT", id: "ESB-2020.1983", trust: 0.6, }, { db: "CNNVD", id: "CNNVD-201903-919", trust: 0.6, }, { db: "VULMON", id: "CVE-2019-0199", trust: 0.1, }, ], sources: [ { db: "CNVD", id: "CNVD-2019-15086", }, { db: "VULMON", id: "CVE-2019-0199", }, { db: "BID", id: "107674", }, { db: "JVNDB", id: "JVNDB-2019-003375", }, { db: "PACKETSTORM", id: "155792", }, { db: "PACKETSTORM", id: "157964", }, { db: "NVD", id: "CVE-2019-0199", }, { db: "CNNVD", id: "CNNVD-201903-919", }, ], }, id: "VAR-201904-1069", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "CNVD", id: "CNVD-2019-15086", }, ], trust: 0.06, }, iot_taxonomy: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { category: [ "Network device", ], sub_category: null, trust: 0.6, }, ], sources: [ { db: "CNVD", id: "CNVD-2019-15086", }, ], }, last_update_date: "2023-12-18T11:09:51.022000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", trust: 0.8, url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3cdev.tomcat.apache.org%3e", }, { title: "svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/", trust: 0.8, url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3cdev.tomcat.apache.org%3e", }, { title: "svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/", trust: 0.8, url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3cdev.tomcat.apache.org%3e", }, { title: "[SECURITY] CVE-2019-0199 Apache Tomcat HTTP/2 DoS", trust: 0.8, url: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3cannounce.tomcat.apache.org%3e", }, { title: "svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/", trust: 0.8, url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3cdev.tomcat.apache.org%3e", }, { title: "Patch for ApacheTomcat Resource Management Error Vulnerability (CNVD-2019-15086)", trust: 0.6, url: "https://www.cnvd.org.cn/patchinfo/show/161993", }, { title: "Apache Tomcat Security vulnerabilities", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=90371", }, { title: "Debian CVElist Bug Report Logs: tomcat9: CVE-2019-10072", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=7966741ad75ea9ed4ce251ef47c32196", }, { title: "Ubuntu Security Notice: tomcat9 vulnerabilities", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=usn-4128-2", }, { title: "Ubuntu Security Notice: tomcat8 vulnerabilities", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=usn-4128-1", }, { title: "Red Hat: Moderate: Red Hat JBoss Web Server 5.2 security release", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=rhsa-20193929 - security advisory", }, { title: "Amazon Linux AMI: ALAS-2019-1234", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=alas-2019-1234", }, { title: "IBM: Security Bulletin: CVE-2019-10072", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=4cfa73e64dc3855ace71ce18bac6fba2", }, { title: "IBM: IBM Security Bulletin: Apache Tomcat as used in IBM QRadar SIEM is vulnerable to denial of service (CVE-2019-0199)", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=2579e74a8148d49567b550a034c8f808", }, { title: "Amazon Linux AMI: ALAS-2019-1208", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=alas-2019-1208", }, { title: "IBM: IBM Security Bulletin: IBM WebSphere Cast Iron Solution & App Connect Professional is affected by Apache Tomcat vulnerabilities.", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=6a3950e54c50353235e3e8004916f871", }, { title: "Red Hat: Moderate: Red Hat JBoss Web Server 5.2 security release", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=rhsa-20193931 - security advisory", }, { title: "Debian Security Advisories: DSA-4596-1 tomcat8 -- security update", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=4cb7c55b01cbf593c9c3969d59695c8a", }, { title: "tool", trust: 0.1, url: "https://github.com/mal-lol-git/tool ", }, { title: "AwareIM-resources", trust: 0.1, url: "https://github.com/rennurapps/awareim-resources ", }, { title: "cybsec", trust: 0.1, url: "https://github.com/ilmari666/cybsec ", }, { title: "cybersecuritybase-project", trust: 0.1, url: "https://github.com/mikademo/cybersecuritybase-project ", }, ], sources: [ { db: "CNVD", id: "CNVD-2019-15086", }, { db: "VULMON", id: "CVE-2019-0199", }, { db: "JVNDB", id: "JVNDB-2019-003375", }, { db: "CNNVD", id: "CNNVD-201903-919", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-400", trust: 1.8, }, ], sources: [ { db: "JVNDB", id: "JVNDB-2019-003375", }, { db: "NVD", id: "CVE-2019-0199", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 2.2, url: "https://nvd.nist.gov/vuln/detail/cve-2019-0199", }, { trust: 1.9, url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", }, { trust: 1.7, url: "https://security.netapp.com/advisory/ntap-20190419-0001/", }, { trust: 1.6, url: "http://www.securityfocus.com/bid/107674", }, { trust: 1.6, url: "https://access.redhat.com/errata/rhsa-2019:3929", }, { trust: 1.6, url: "https://access.redhat.com/errata/rhsa-2019:3931", }, { trust: 1.6, url: "https://www.debian.org/security/2019/dsa-4596", }, { trust: 1, url: "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html", }, { trust: 1, url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html", }, { trust: 1, url: "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html", }, { trust: 1, url: "https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3cdev.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3cdev.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3cdev.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3cdev.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3cusers.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3cdev.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3cusers.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3cdev.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3cannounce.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3cannounce.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3cannounce.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3cannounce.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3cannounce.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3ccommits.tomee.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3cdev.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3cusers.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3cdev.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3cdev.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3cdev.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3cdev.tomcat.apache.org%3e", }, { trust: 1, url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/nphqel5aq6lzszd2y6tyz4rc3wi7nxj3/", }, { trust: 1, url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/zqtz5bj5f4kv6n53sgnksw3uy5dbiq46/", }, { trust: 1, url: "https://seclists.org/bugtraq/2019/dec/43", }, { trust: 1, url: "https://support.f5.com/csp/article/k17321505", }, { trust: 1, url: "https://www.oracle.com/security-alerts/cpuapr2020.html", }, { trust: 1, url: "https://www.oracle.com/security-alerts/cpujan2020.html", }, { trust: 0.9, url: "http://tomcat.apache.org/security-8.html", }, { trust: 0.9, url: "http://tomcat.apache.org/security-9.html", }, { trust: 0.9, url: "http://tomcat.apache.org/", }, { trust: 0.8, url: "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0199", }, { trust: 0.7, url: "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3cdev.tomcat.apache.org%3e", }, { trust: 0.7, url: "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3cdev.tomcat.apache.org%3e", }, { trust: 0.7, url: "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3cdev.tomcat.apache.org%3e", }, { trust: 0.7, url: "https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3cannounce.tomcat.apache.org%3e", }, { trust: 0.7, url: "https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e@%3ccommits.tomee.apache.org%3e", }, { trust: 0.7, url: "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3cdev.tomcat.apache.org%3e", }, { trust: 0.6, url: "https://www.mail-archive.com/dev", }, { trust: 0.6, url: "http://www.ibm.com/support/docview.wss?uid=ibm10886317", }, { trust: 0.6, url: "https://www.mail-archive.com/users@tomcat.apache.org/msg132248.html", }, { trust: 0.6, url: "http://www.ibm.com/support/docview.wss?uid=ibm10885114", }, { trust: 0.6, url: "https://www.suse.com/support/update/announcement/2019/suse-su-20191693-1.html", }, { trust: 0.6, url: "https://www.auscert.org.au/bulletins/esb-2019.4405/", }, { trust: 0.6, url: "https://packetstormsecurity.com/files/155792/debian-security-advisory-4596-1.html", }, { trust: 0.6, url: "https://www-01.ibm.com/support/docview.wss?uid=ibm10886317", }, { trust: 0.6, url: "https://www.auscert.org.au/bulletins/esb-2019.2230/", }, { trust: 0.6, url: "https://vigilance.fr/vulnerability/apache-tomcat-denial-of-service-via-http-2-frames-28842", }, { trust: 0.6, url: "https://www.auscert.org.au/bulletins/esb-2020.0014/", }, { trust: 0.6, url: "https://www.auscert.org.au/bulletins/esb-2019.2295/", }, { trust: 0.6, url: "https://packetstormsecurity.com/files/157964/red-hat-security-advisory-2020-2366-01.html", }, { trust: 0.6, url: "https://www.auscert.org.au/bulletins/esb-2019.1958/", }, { trust: 0.6, url: "https://www.auscert.org.au/bulletins/77766", }, { trust: 0.6, url: "https://www.auscert.org.au/bulletins/esb-2019.1966/", }, { trust: 0.6, url: "http-2-implementation-in-embded-apache-tomcat-denial-of-service-vulnerability/", }, { trust: 0.6, url: "https://www.ibm.com/blogs/psirt/security-bulletin-cve-2019-0199-the-", }, { trust: 0.6, url: "https://www.auscert.org.au/bulletins/esb-2020.1983/", }, { trust: 0.1, url: "https://cwe.mitre.org/data/definitions/400.html", }, { trust: 0.1, url: "https://www.rapid7.com/db/vulnerabilities/apache-tomcat-cve-2019-0199", }, { trust: 0.1, url: "https://nvd.nist.gov", }, { trust: 0.1, url: "https://usn.ubuntu.com/4128-2/", }, { trust: 0.1, url: "https://tools.cisco.com/security/center/viewalert.x?alertid=59989", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2019-17563", }, { trust: 0.1, url: "https://www.debian.org/security/faq", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2018-8014", }, { trust: 0.1, url: "https://www.debian.org/security/", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2019-0221", }, { trust: 0.1, url: "https://security-tracker.debian.org/tracker/tomcat8", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2019-12418", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2018-11784", }, { trust: 0.1, url: "https://access.redhat.com/security/cve/cve-2019-3875", }, { trust: 0.1, url: "https://access.redhat.com/security/cve/cve-2019-14832", }, { trust: 0.1, url: "https://access.redhat.com/security/updates/classification/#important", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2019-10201", }, { trust: 0.1, url: "https://access.redhat.com/errata/rhsa-2020:2366", }, { trust: 0.1, url: "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=catrhoar.spring.boot&downloadtype=distributions&version=2.1.12", }, { trust: 0.1, url: "https://access.redhat.com/security/cve/cve-2019-3868", }, { trust: 0.1, url: "https://access.redhat.com/security/cve/cve-2019-0199", }, { trust: 0.1, url: "https://access.redhat.com/security/cve/cve-2019-10201", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2019-3875", }, { trust: 0.1, url: "https://access.redhat.com/security/team/contact/", }, { trust: 0.1, url: "https://www.redhat.com/mailman/listinfo/rhsa-announce", }, { trust: 0.1, url: "https://bugzilla.redhat.com/):", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2019-3868", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2019-14832", }, { trust: 0.1, url: "https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/", }, { trust: 0.1, url: "https://nvd.nist.gov/vuln/detail/cve-2019-10199", }, { trust: 0.1, url: "https://access.redhat.com/security/cve/cve-2019-10199", }, ], sources: [ { db: "CNVD", id: "CNVD-2019-15086", }, { db: "VULMON", id: "CVE-2019-0199", }, { db: "BID", id: "107674", }, { db: "JVNDB", id: "JVNDB-2019-003375", }, { db: "PACKETSTORM", id: "155792", }, { db: "PACKETSTORM", id: "157964", }, { db: "NVD", id: "CVE-2019-0199", }, { db: "CNNVD", id: "CNNVD-201903-919", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "CNVD", id: "CNVD-2019-15086", }, { db: "VULMON", id: "CVE-2019-0199", }, { db: "BID", id: "107674", }, { db: "JVNDB", id: "JVNDB-2019-003375", }, { db: "PACKETSTORM", id: "155792", }, { db: "PACKETSTORM", id: "157964", }, { db: "NVD", id: "CVE-2019-0199", }, { db: "CNNVD", id: "CNNVD-201903-919", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2019-05-23T00:00:00", db: "CNVD", id: "CNVD-2019-15086", }, { date: "2019-04-10T00:00:00", db: "VULMON", id: "CVE-2019-0199", }, { date: "2019-02-08T00:00:00", db: "BID", id: "107674", }, { date: "2019-05-15T00:00:00", db: "JVNDB", id: "JVNDB-2019-003375", }, { date: "2019-12-30T18:38:42", db: "PACKETSTORM", id: "155792", }, { date: "2020-06-05T18:32:22", db: "PACKETSTORM", id: "157964", }, { date: "2019-04-10T15:29:00.390000", db: "NVD", id: "CVE-2019-0199", }, { date: "2019-03-25T00:00:00", db: "CNNVD", id: "CNNVD-201903-919", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2019-05-23T00:00:00", db: "CNVD", id: "CNVD-2019-15086", }, { date: "2019-05-28T00:00:00", db: "VULMON", id: "CVE-2019-0199", }, { date: "2019-07-17T09:00:00", db: "BID", id: "107674", }, { date: "2019-05-15T00:00:00", db: "JVNDB", id: "JVNDB-2019-003375", }, { date: "2023-12-08T16:41:18.860000", db: "NVD", id: "CVE-2019-0199", }, { date: "2020-06-09T00:00:00", db: "CNNVD", id: "CNNVD-201903-919", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "remote", sources: [ { db: "CNNVD", id: "CNNVD-201903-919", }, ], trust: 0.6, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Apache Tomcat Vulnerable to resource exhaustion", sources: [ { db: "JVNDB", id: "JVNDB-2019-003375", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "resource management error", sources: [ { db: "CNNVD", id: "CNNVD-201903-919", }, ], trust: 0.6, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.