Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
tomcat-9.0.36-8.4 on GA media
Notes
Title of the patch
tomcat-9.0.36-8.4 on GA media
Description of the patch
These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-11468
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "tomcat-9.0.36-8.4 on GA media", title: "Title of the patch", }, { category: "description", text: "These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.", title: "Description of the patch", }, { category: "details", text: "openSUSE-Tumbleweed-2024-11468", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11468-1.json", }, { category: "self", summary: "SUSE CVE CVE-2016-8745 page", url: "https://www.suse.com/security/cve/CVE-2016-8745/", }, { category: "self", summary: "SUSE CVE CVE-2017-12617 page", url: "https://www.suse.com/security/cve/CVE-2017-12617/", }, { category: "self", summary: "SUSE CVE CVE-2017-5647 page", url: "https://www.suse.com/security/cve/CVE-2017-5647/", }, { category: "self", summary: "SUSE CVE CVE-2017-5648 page", url: "https://www.suse.com/security/cve/CVE-2017-5648/", }, { category: "self", summary: "SUSE CVE CVE-2017-5664 page", url: "https://www.suse.com/security/cve/CVE-2017-5664/", }, { category: "self", summary: "SUSE CVE CVE-2018-11784 page", url: "https://www.suse.com/security/cve/CVE-2018-11784/", }, { category: "self", summary: "SUSE CVE CVE-2018-1336 page", url: "https://www.suse.com/security/cve/CVE-2018-1336/", }, { category: "self", summary: "SUSE CVE CVE-2018-8014 page", url: "https://www.suse.com/security/cve/CVE-2018-8014/", }, { category: "self", summary: "SUSE CVE CVE-2018-8034 page", url: "https://www.suse.com/security/cve/CVE-2018-8034/", }, { category: "self", summary: "SUSE CVE CVE-2018-8037 page", url: "https://www.suse.com/security/cve/CVE-2018-8037/", }, { category: "self", summary: "SUSE CVE CVE-2019-0199 page", url: "https://www.suse.com/security/cve/CVE-2019-0199/", }, { category: "self", summary: "SUSE CVE CVE-2019-0221 page", url: "https://www.suse.com/security/cve/CVE-2019-0221/", }, { category: "self", summary: "SUSE CVE CVE-2019-10072 page", url: "https://www.suse.com/security/cve/CVE-2019-10072/", }, { category: "self", summary: "SUSE CVE CVE-2019-12418 page", url: "https://www.suse.com/security/cve/CVE-2019-12418/", }, { category: "self", summary: "SUSE CVE CVE-2019-17563 page", url: "https://www.suse.com/security/cve/CVE-2019-17563/", }, { category: "self", summary: "SUSE CVE CVE-2019-17569 page", url: "https://www.suse.com/security/cve/CVE-2019-17569/", }, { category: "self", summary: "SUSE CVE CVE-2020-11996 page", url: "https://www.suse.com/security/cve/CVE-2020-11996/", }, { category: "self", summary: "SUSE CVE CVE-2020-13943 page", url: "https://www.suse.com/security/cve/CVE-2020-13943/", }, { category: "self", summary: "SUSE CVE CVE-2020-17527 page", url: "https://www.suse.com/security/cve/CVE-2020-17527/", }, { category: "self", summary: "SUSE CVE CVE-2020-1935 page", url: "https://www.suse.com/security/cve/CVE-2020-1935/", }, { category: "self", summary: "SUSE CVE CVE-2020-1938 page", url: "https://www.suse.com/security/cve/CVE-2020-1938/", }, { category: "self", summary: "SUSE CVE CVE-2020-9484 page", url: "https://www.suse.com/security/cve/CVE-2020-9484/", }, { category: "self", summary: "SUSE CVE CVE-2021-24122 page", url: "https://www.suse.com/security/cve/CVE-2021-24122/", }, { category: "self", summary: "SUSE CVE CVE-2021-25122 page", url: "https://www.suse.com/security/cve/CVE-2021-25122/", }, { category: "self", summary: "SUSE CVE CVE-2021-25329 page", url: "https://www.suse.com/security/cve/CVE-2021-25329/", }, ], title: "tomcat-9.0.36-8.4 on GA media", tracking: { current_release_date: "2024-06-15T00:00:00Z", generator: { date: "2024-06-15T00:00:00Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "openSUSE-SU-2024:11468-1", initial_release_date: "2024-06-15T00:00:00Z", revision_history: [ { date: "2024-06-15T00:00:00Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "tomcat-9.0.36-8.4.aarch64", product: { name: "tomcat-9.0.36-8.4.aarch64", product_id: "tomcat-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.36-8.4.aarch64", product: { name: "tomcat-admin-webapps-9.0.36-8.4.aarch64", product_id: "tomcat-admin-webapps-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.36-8.4.aarch64", product: { name: "tomcat-docs-webapp-9.0.36-8.4.aarch64", product_id: "tomcat-docs-webapp-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.36-8.4.aarch64", product: { name: "tomcat-el-3_0-api-9.0.36-8.4.aarch64", product_id: "tomcat-el-3_0-api-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-embed-9.0.36-8.4.aarch64", product: { name: "tomcat-embed-9.0.36-8.4.aarch64", product_id: "tomcat-embed-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.36-8.4.aarch64", product: { name: "tomcat-javadoc-9.0.36-8.4.aarch64", product_id: "tomcat-javadoc-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", product: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", product_id: "tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.36-8.4.aarch64", product: { name: "tomcat-jsvc-9.0.36-8.4.aarch64", product_id: "tomcat-jsvc-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-lib-9.0.36-8.4.aarch64", product: { name: "tomcat-lib-9.0.36-8.4.aarch64", product_id: "tomcat-lib-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", product: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", product_id: "tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", }, }, { category: "product_version", name: "tomcat-webapps-9.0.36-8.4.aarch64", product: { name: "tomcat-webapps-9.0.36-8.4.aarch64", product_id: "tomcat-webapps-9.0.36-8.4.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "tomcat-9.0.36-8.4.ppc64le", product: { name: "tomcat-9.0.36-8.4.ppc64le", product_id: "tomcat-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.36-8.4.ppc64le", product: { name: "tomcat-admin-webapps-9.0.36-8.4.ppc64le", product_id: "tomcat-admin-webapps-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.36-8.4.ppc64le", product: { name: "tomcat-docs-webapp-9.0.36-8.4.ppc64le", product_id: "tomcat-docs-webapp-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.36-8.4.ppc64le", product: { name: "tomcat-el-3_0-api-9.0.36-8.4.ppc64le", product_id: "tomcat-el-3_0-api-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-embed-9.0.36-8.4.ppc64le", product: { name: "tomcat-embed-9.0.36-8.4.ppc64le", product_id: "tomcat-embed-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.36-8.4.ppc64le", product: { name: "tomcat-javadoc-9.0.36-8.4.ppc64le", product_id: "tomcat-javadoc-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", product: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", product_id: "tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.36-8.4.ppc64le", product: { name: "tomcat-jsvc-9.0.36-8.4.ppc64le", product_id: "tomcat-jsvc-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-lib-9.0.36-8.4.ppc64le", product: { name: "tomcat-lib-9.0.36-8.4.ppc64le", product_id: "tomcat-lib-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", product: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", product_id: "tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", }, }, { category: "product_version", name: "tomcat-webapps-9.0.36-8.4.ppc64le", product: { name: "tomcat-webapps-9.0.36-8.4.ppc64le", product_id: "tomcat-webapps-9.0.36-8.4.ppc64le", }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "tomcat-9.0.36-8.4.s390x", product: { name: "tomcat-9.0.36-8.4.s390x", product_id: "tomcat-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.36-8.4.s390x", product: { name: "tomcat-admin-webapps-9.0.36-8.4.s390x", product_id: "tomcat-admin-webapps-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.36-8.4.s390x", product: { name: "tomcat-docs-webapp-9.0.36-8.4.s390x", product_id: "tomcat-docs-webapp-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.36-8.4.s390x", product: { name: "tomcat-el-3_0-api-9.0.36-8.4.s390x", product_id: "tomcat-el-3_0-api-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-embed-9.0.36-8.4.s390x", product: { name: "tomcat-embed-9.0.36-8.4.s390x", product_id: "tomcat-embed-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.36-8.4.s390x", product: { name: "tomcat-javadoc-9.0.36-8.4.s390x", product_id: "tomcat-javadoc-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.36-8.4.s390x", product: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.s390x", product_id: "tomcat-jsp-2_3-api-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.36-8.4.s390x", product: { name: "tomcat-jsvc-9.0.36-8.4.s390x", product_id: "tomcat-jsvc-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-lib-9.0.36-8.4.s390x", product: { name: "tomcat-lib-9.0.36-8.4.s390x", product_id: "tomcat-lib-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.36-8.4.s390x", product: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.s390x", product_id: "tomcat-servlet-4_0-api-9.0.36-8.4.s390x", }, }, { category: "product_version", name: "tomcat-webapps-9.0.36-8.4.s390x", product: { name: "tomcat-webapps-9.0.36-8.4.s390x", product_id: "tomcat-webapps-9.0.36-8.4.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "tomcat-9.0.36-8.4.x86_64", product: { name: "tomcat-9.0.36-8.4.x86_64", product_id: "tomcat-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-admin-webapps-9.0.36-8.4.x86_64", product: { name: "tomcat-admin-webapps-9.0.36-8.4.x86_64", product_id: "tomcat-admin-webapps-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-docs-webapp-9.0.36-8.4.x86_64", product: { name: "tomcat-docs-webapp-9.0.36-8.4.x86_64", product_id: "tomcat-docs-webapp-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-el-3_0-api-9.0.36-8.4.x86_64", product: { name: "tomcat-el-3_0-api-9.0.36-8.4.x86_64", product_id: "tomcat-el-3_0-api-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-embed-9.0.36-8.4.x86_64", product: { name: "tomcat-embed-9.0.36-8.4.x86_64", product_id: "tomcat-embed-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-javadoc-9.0.36-8.4.x86_64", product: { name: "tomcat-javadoc-9.0.36-8.4.x86_64", product_id: "tomcat-javadoc-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", product: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", product_id: "tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-jsvc-9.0.36-8.4.x86_64", product: { name: "tomcat-jsvc-9.0.36-8.4.x86_64", product_id: "tomcat-jsvc-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-lib-9.0.36-8.4.x86_64", product: { name: "tomcat-lib-9.0.36-8.4.x86_64", product_id: "tomcat-lib-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", product: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", product_id: "tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", }, }, { category: "product_version", name: "tomcat-webapps-9.0.36-8.4.x86_64", product: { name: "tomcat-webapps-9.0.36-8.4.x86_64", product_id: "tomcat-webapps-9.0.36-8.4.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "openSUSE Tumbleweed", product: { name: "openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed", product_identification_helper: { cpe: "cpe:/o:opensuse:tumbleweed", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "tomcat-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", }, product_reference: "tomcat-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", }, product_reference: "tomcat-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", }, product_reference: "tomcat-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", }, product_reference: "tomcat-admin-webapps-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-admin-webapps-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", }, product_reference: "tomcat-admin-webapps-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-admin-webapps-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", }, product_reference: "tomcat-admin-webapps-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", }, product_reference: "tomcat-docs-webapp-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-docs-webapp-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", }, product_reference: "tomcat-docs-webapp-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-docs-webapp-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", }, product_reference: "tomcat-docs-webapp-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", }, product_reference: "tomcat-el-3_0-api-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-el-3_0-api-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", }, product_reference: "tomcat-el-3_0-api-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-el-3_0-api-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", }, product_reference: "tomcat-el-3_0-api-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-embed-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", }, product_reference: "tomcat-embed-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-embed-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-embed-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-embed-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", }, product_reference: "tomcat-embed-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-embed-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", }, product_reference: "tomcat-embed-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", }, product_reference: "tomcat-javadoc-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-javadoc-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", }, product_reference: "tomcat-javadoc-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-javadoc-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", }, product_reference: "tomcat-javadoc-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", }, product_reference: "tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", }, product_reference: "tomcat-jsp-2_3-api-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsp-2_3-api-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", }, product_reference: "tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsvc-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", }, product_reference: "tomcat-jsvc-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsvc-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-jsvc-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsvc-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", }, product_reference: "tomcat-jsvc-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-jsvc-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", }, product_reference: "tomcat-jsvc-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", }, product_reference: "tomcat-lib-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-lib-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", }, product_reference: "tomcat-lib-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-lib-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", }, product_reference: "tomcat-lib-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", }, product_reference: "tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", }, product_reference: "tomcat-servlet-4_0-api-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-servlet-4_0-api-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", }, product_reference: "tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.36-8.4.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", }, product_reference: "tomcat-webapps-9.0.36-8.4.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.36-8.4.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", }, product_reference: "tomcat-webapps-9.0.36-8.4.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.36-8.4.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", }, product_reference: "tomcat-webapps-9.0.36-8.4.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "tomcat-webapps-9.0.36-8.4.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", }, product_reference: "tomcat-webapps-9.0.36-8.4.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, ], }, vulnerabilities: [ { cve: "CVE-2016-8745", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-8745", }, ], notes: [ { category: "general", text: "A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2016-8745", url: "https://www.suse.com/security/cve/CVE-2016-8745", }, { category: "external", summary: "SUSE Bug 1015119 for CVE-2016-8745", url: "https://bugzilla.suse.com/1015119", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2016-8745", }, { cve: "CVE-2017-12617", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-12617", }, ], notes: [ { category: "general", text: "When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-12617", url: "https://www.suse.com/security/cve/CVE-2017-12617", }, { category: "external", summary: "SUSE Bug 1059554 for CVE-2017-12617", url: "https://bugzilla.suse.com/1059554", }, { category: "external", summary: "SUSE Bug 1062607 for CVE-2017-12617", url: "https://bugzilla.suse.com/1062607", }, { category: "external", summary: "SUSE Bug 1180947 for CVE-2017-12617", url: "https://bugzilla.suse.com/1180947", }, { category: "external", summary: "SUSE Bug 1189861 for CVE-2017-12617", url: "https://bugzilla.suse.com/1189861", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 9.8, baseSeverity: "CRITICAL", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2017-12617", }, { cve: "CVE-2017-5647", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-5647", }, ], notes: [ { category: "general", text: "A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-5647", url: "https://www.suse.com/security/cve/CVE-2017-5647", }, { category: "external", summary: "SUSE Bug 1033448 for CVE-2017-5647", url: "https://bugzilla.suse.com/1033448", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2017-5647", }, { cve: "CVE-2017-5648", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-5648", }, ], notes: [ { category: "general", text: "While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-5648", url: "https://www.suse.com/security/cve/CVE-2017-5648", }, { category: "external", summary: "SUSE Bug 1033447 for CVE-2017-5648", url: "https://bugzilla.suse.com/1033447", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 9.1, baseSeverity: "CRITICAL", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2017-5648", }, { cve: "CVE-2017-5664", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-5664", }, ], notes: [ { category: "general", text: "The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2017-5664", url: "https://www.suse.com/security/cve/CVE-2017-5664", }, { category: "external", summary: "SUSE Bug 1042910 for CVE-2017-5664", url: "https://bugzilla.suse.com/1042910", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2017-5664", }, { cve: "CVE-2018-11784", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-11784", }, ], notes: [ { category: "general", text: "When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-11784", url: "https://www.suse.com/security/cve/CVE-2018-11784", }, { category: "external", summary: "SUSE Bug 1110850 for CVE-2018-11784", url: "https://bugzilla.suse.com/1110850", }, { category: "external", summary: "SUSE Bug 1122212 for CVE-2018-11784", url: "https://bugzilla.suse.com/1122212", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.1, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-11784", }, { cve: "CVE-2018-1336", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-1336", }, ], notes: [ { category: "general", text: "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-1336", url: "https://www.suse.com/security/cve/CVE-2018-1336", }, { category: "external", summary: "SUSE Bug 1102400 for CVE-2018-1336", url: "https://bugzilla.suse.com/1102400", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2018-1336", }, { cve: "CVE-2018-8014", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-8014", }, ], notes: [ { category: "general", text: "The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-8014", url: "https://www.suse.com/security/cve/CVE-2018-8014", }, { category: "external", summary: "SUSE Bug 1093697 for CVE-2018-8014", url: "https://bugzilla.suse.com/1093697", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2018-8014", }, { cve: "CVE-2018-8034", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-8034", }, ], notes: [ { category: "general", text: "The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-8034", url: "https://www.suse.com/security/cve/CVE-2018-8034", }, { category: "external", summary: "SUSE Bug 1102379 for CVE-2018-8034", url: "https://bugzilla.suse.com/1102379", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2018-8034", }, { cve: "CVE-2018-8037", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-8037", }, ], notes: [ { category: "general", text: "If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2018-8037", url: "https://www.suse.com/security/cve/CVE-2018-8037", }, { category: "external", summary: "SUSE Bug 1003579 for CVE-2018-8037", url: "https://bugzilla.suse.com/1003579", }, { category: "external", summary: "SUSE Bug 1102410 for CVE-2018-8037", url: "https://bugzilla.suse.com/1102410", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 9.1, baseSeverity: "CRITICAL", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "critical", }, ], title: "CVE-2018-8037", }, { cve: "CVE-2019-0199", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0199", }, ], notes: [ { category: "general", text: "The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-0199", url: "https://www.suse.com/security/cve/CVE-2019-0199", }, { category: "external", summary: "SUSE Bug 1131055 for CVE-2019-0199", url: "https://bugzilla.suse.com/1131055", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-0199", url: "https://bugzilla.suse.com/1139924", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2019-0199", }, { cve: "CVE-2019-0221", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-0221", }, ], notes: [ { category: "general", text: "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-0221", url: "https://www.suse.com/security/cve/CVE-2019-0221", }, { category: "external", summary: "SUSE Bug 1136085 for CVE-2019-0221", url: "https://bugzilla.suse.com/1136085", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2019-0221", }, { cve: "CVE-2019-10072", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-10072", }, ], notes: [ { category: "general", text: "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-10072", url: "https://www.suse.com/security/cve/CVE-2019-10072", }, { category: "external", summary: "SUSE Bug 1139924 for CVE-2019-10072", url: "https://bugzilla.suse.com/1139924", }, { category: "external", summary: "SUSE Bug 1154162 for CVE-2019-10072", url: "https://bugzilla.suse.com/1154162", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.0", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-10072", }, { cve: "CVE-2019-12418", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-12418", }, ], notes: [ { category: "general", text: "When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-12418", url: "https://www.suse.com/security/cve/CVE-2019-12418", }, { category: "external", summary: "SUSE Bug 1159723 for CVE-2019-12418", url: "https://bugzilla.suse.com/1159723", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.1, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2019-12418", }, { cve: "CVE-2019-17563", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-17563", }, ], notes: [ { category: "general", text: "When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-17563", url: "https://www.suse.com/security/cve/CVE-2019-17563", }, { category: "external", summary: "SUSE Bug 1159729 for CVE-2019-17563", url: "https://bugzilla.suse.com/1159729", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 3.4, baseSeverity: "LOW", vectorString: "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "low", }, ], title: "CVE-2019-17563", }, { cve: "CVE-2019-17569", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2019-17569", }, ], notes: [ { category: "general", text: "The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2019-17569", url: "https://www.suse.com/security/cve/CVE-2019-17569", }, { category: "external", summary: "SUSE Bug 1164825 for CVE-2019-17569", url: "https://bugzilla.suse.com/1164825", }, { category: "external", summary: "SUSE Bug 1165858 for CVE-2019-17569", url: "https://bugzilla.suse.com/1165858", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.8, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2019-17569", }, { cve: "CVE-2020-11996", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-11996", }, ], notes: [ { category: "general", text: "A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-11996", url: "https://www.suse.com/security/cve/CVE-2020-11996", }, { category: "external", summary: "SUSE Bug 1173389 for CVE-2020-11996", url: "https://bugzilla.suse.com/1173389", }, { category: "external", summary: "SUSE Bug 1201081 for CVE-2020-11996", url: "https://bugzilla.suse.com/1201081", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-11996", }, { cve: "CVE-2020-13943", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-13943", }, ], notes: [ { category: "general", text: "If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-13943", url: "https://www.suse.com/security/cve/CVE-2020-13943", }, { category: "external", summary: "SUSE Bug 1177582 for CVE-2020-13943", url: "https://bugzilla.suse.com/1177582", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-13943", }, { cve: "CVE-2020-17527", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-17527", }, ], notes: [ { category: "general", text: "While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-17527", url: "https://www.suse.com/security/cve/CVE-2020-17527", }, { category: "external", summary: "SUSE Bug 1179602 for CVE-2020-17527", url: "https://bugzilla.suse.com/1179602", }, { category: "external", summary: "SUSE Bug 1180830 for CVE-2020-17527", url: "https://bugzilla.suse.com/1180830", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2020-17527", }, { cve: "CVE-2020-1935", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-1935", }, ], notes: [ { category: "general", text: "In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-1935", url: "https://www.suse.com/security/cve/CVE-2020-1935", }, { category: "external", summary: "SUSE Bug 1164860 for CVE-2020-1935", url: "https://bugzilla.suse.com/1164860", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.8, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2020-1935", }, { cve: "CVE-2020-1938", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-1938", }, ], notes: [ { category: "general", text: "When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-1938", url: "https://www.suse.com/security/cve/CVE-2020-1938", }, { category: "external", summary: "SUSE Bug 1164692 for CVE-2020-1938", url: "https://bugzilla.suse.com/1164692", }, { category: "external", summary: "SUSE Bug 1166559 for CVE-2020-1938", url: "https://bugzilla.suse.com/1166559", }, { category: "external", summary: "SUSE Bug 1169066 for CVE-2020-1938", url: "https://bugzilla.suse.com/1169066", }, { category: "external", summary: "SUSE Bug 1175170 for CVE-2020-1938", url: "https://bugzilla.suse.com/1175170", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.6, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2020-1938", }, { cve: "CVE-2020-9484", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-9484", }, ], notes: [ { category: "general", text: "When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2020-9484", url: "https://www.suse.com/security/cve/CVE-2020-9484", }, { category: "external", summary: "SUSE Bug 1171928 for CVE-2020-9484", url: "https://bugzilla.suse.com/1171928", }, { category: "external", summary: "SUSE Bug 1182909 for CVE-2020-9484", url: "https://bugzilla.suse.com/1182909", }, { category: "external", summary: "SUSE Bug 1195255 for CVE-2020-9484", url: "https://bugzilla.suse.com/1195255", }, { category: "external", summary: "SUSE Bug 1196395 for CVE-2020-9484", url: "https://bugzilla.suse.com/1196395", }, { category: "external", summary: "SUSE Bug 1201081 for CVE-2020-9484", url: "https://bugzilla.suse.com/1201081", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2020-9484", }, { cve: "CVE-2021-24122", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-24122", }, ], notes: [ { category: "general", text: "When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-24122", url: "https://www.suse.com/security/cve/CVE-2021-24122", }, { category: "external", summary: "SUSE Bug 1180947 for CVE-2021-24122", url: "https://bugzilla.suse.com/1180947", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2021-24122", }, { cve: "CVE-2021-25122", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-25122", }, ], notes: [ { category: "general", text: "When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-25122", url: "https://www.suse.com/security/cve/CVE-2021-25122", }, { category: "external", summary: "SUSE Bug 1182912 for CVE-2021-25122", url: "https://bugzilla.suse.com/1182912", }, { category: "external", summary: "SUSE Bug 1188549 for CVE-2021-25122", url: "https://bugzilla.suse.com/1188549", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "important", }, ], title: "CVE-2021-25122", }, { cve: "CVE-2021-25329", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2021-25329", }, ], notes: [ { category: "general", text: "The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, references: [ { category: "external", summary: "CVE-2021-25329", url: "https://www.suse.com/security/cve/CVE-2021-25329", }, { category: "external", summary: "SUSE Bug 1182909 for CVE-2021-25329", url: "https://bugzilla.suse.com/1182909", }, { category: "external", summary: "SUSE Bug 1200696 for CVE-2021-25329", url: "https://bugzilla.suse.com/1200696", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:tomcat-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-admin-webapps-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-docs-webapp-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-el-3_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-embed-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-javadoc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsp-2_3-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-jsvc-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-lib-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-servlet-4_0-api-9.0.36-8.4.x86_64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.aarch64", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.ppc64le", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.s390x", "openSUSE Tumbleweed:tomcat-webapps-9.0.36-8.4.x86_64", ], }, ], threats: [ { category: "impact", date: "2024-06-15T00:00:00Z", details: "moderate", }, ], title: "CVE-2021-25329", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.