csaf_redhat - rhsa-2020

rhsa-2020_2840

Vulnerability from csaf_redhat

Published

2020-07-07 10:31

Modified

2024-11-15 06:12

Summary

Red Hat Security Advisory: tomcat security update

Notes

Topic

An update for tomcat is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability (CVE-2020-1938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for tomcat is now available for Red Hat Enterprise Linux 7.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability (CVE-2020-1938)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2020:2840",
        "url": "https://access.redhat.com/errata/RHSA-2020:2840"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1806398",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1806398"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2840.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat security update",
    "tracking": {
      "current_release_date": "2024-11-15T06:12:00+00:00",
      "generator": {
        "date": "2024-11-15T06:12:00+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2020:2840",
      "initial_release_date": "2020-07-07T10:31:39+00:00",
      "revision_history": [
        {
          "date": "2020-07-07T10:31:39+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2020-07-07T10:31:40+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T06:12:00+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
                  "product_id": "7ComputeNode-7.6.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:7.6::computenode"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
                  "product_id": "7ComputeNode-optional-7.6.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:7.6::computenode"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server EUS (v. 7.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server EUS (v. 7.6)",
                  "product_id": "7Server-7.6.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:7.6::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
                  "product_id": "7Server-optional-7.6.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:7.6::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
                  "product_id": "7Server-Alt-7.6-EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:7.6::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
                "product": {
                  "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
                  "product_id": "7Server-optional-Alt-7.6-EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:7.6::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-0:7.0.76-10.el7_6.noarch",
                "product": {
                  "name": "tomcat-0:7.0.76-10.el7_6.noarch",
                  "product_id": "tomcat-0:7.0.76-10.el7_6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat@7.0.76-10.el7_6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
                "product": {
                  "name": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
                  "product_id": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-admin-webapps@7.0.76-10.el7_6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
                "product": {
                  "name": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
                  "product_id": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-docs-webapp@7.0.76-10.el7_6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
                "product": {
                  "name": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
                  "product_id": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-el-2.2-api@7.0.76-10.el7_6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
                "product": {
                  "name": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
                  "product_id": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-javadoc@7.0.76-10.el7_6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
                "product": {
                  "name": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
                  "product_id": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-jsp-2.2-api@7.0.76-10.el7_6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
                "product": {
                  "name": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
                  "product_id": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-jsvc@7.0.76-10.el7_6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-0:7.0.76-10.el7_6.noarch",
                "product": {
                  "name": "tomcat-lib-0:7.0.76-10.el7_6.noarch",
                  "product_id": "tomcat-lib-0:7.0.76-10.el7_6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-lib@7.0.76-10.el7_6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-0:7.0.76-10.el7_6.noarch",
                "product": {
                  "name": "tomcat-webapps-0:7.0.76-10.el7_6.noarch",
                  "product_id": "tomcat-webapps-0:7.0.76-10.el7_6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-webapps@7.0.76-10.el7_6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
                "product": {
                  "name": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
                  "product_id": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat-servlet-3.0-api@7.0.76-10.el7_6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-0:7.0.76-10.el7_6.src",
                "product": {
                  "name": "tomcat-0:7.0.76-10.el7_6.src",
                  "product_id": "tomcat-0:7.0.76-10.el7_6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat@7.0.76-10.el7_6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
          "product_id": "7ComputeNode-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:7.0.76-10.el7_6.src as a component of Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
          "product_id": "7ComputeNode-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src"
        },
        "product_reference": "tomcat-0:7.0.76-10.el7_6.src",
        "relates_to_product_reference": "7ComputeNode-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
          "product_id": "7ComputeNode-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
          "product_id": "7ComputeNode-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
          "product_id": "7ComputeNode-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
          "product_id": "7ComputeNode-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
          "product_id": "7ComputeNode-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
          "product_id": "7ComputeNode-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
          "product_id": "7ComputeNode-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-lib-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
          "product_id": "7ComputeNode-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)",
          "product_id": "7ComputeNode-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-webapps-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
          "product_id": "7ComputeNode-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:7.0.76-10.el7_6.src as a component of Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
          "product_id": "7ComputeNode-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src"
        },
        "product_reference": "tomcat-0:7.0.76-10.el7_6.src",
        "relates_to_product_reference": "7ComputeNode-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
          "product_id": "7ComputeNode-optional-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
          "product_id": "7ComputeNode-optional-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
          "product_id": "7ComputeNode-optional-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
          "product_id": "7ComputeNode-optional-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
          "product_id": "7ComputeNode-optional-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
          "product_id": "7ComputeNode-optional-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
          "product_id": "7ComputeNode-optional-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-lib-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
          "product_id": "7ComputeNode-optional-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)",
          "product_id": "7ComputeNode-optional-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-webapps-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7ComputeNode-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:7.0.76-10.el7_6.src as a component of Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src"
        },
        "product_reference": "tomcat-0:7.0.76-10.el7_6.src",
        "relates_to_product_reference": "7Server-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-lib-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-webapps-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:7.0.76-10.el7_6.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.src"
        },
        "product_reference": "tomcat-0:7.0.76-10.el7_6.src",
        "relates_to_product_reference": "7Server-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.6-EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.6-EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.6-EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.6-EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.6-EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.6-EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.6-EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-lib-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.6-EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
          "product_id": "7Server-Alt-7.6-EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-webapps-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
          "product_id": "7Server-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:7.0.76-10.el7_6.src as a component of Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
          "product_id": "7Server-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src"
        },
        "product_reference": "tomcat-0:7.0.76-10.el7_6.src",
        "relates_to_product_reference": "7Server-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
          "product_id": "7Server-optional-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
          "product_id": "7Server-optional-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
          "product_id": "7Server-optional-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
          "product_id": "7Server-optional-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
          "product_id": "7Server-optional-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
          "product_id": "7Server-optional-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
          "product_id": "7Server-optional-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-lib-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
          "product_id": "7Server-optional-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux Server Optional EUS (v. 7.6)",
          "product_id": "7Server-optional-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-webapps-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-7.6.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
          "product_id": "7Server-optional-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-0:7.0.76-10.el7_6.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
          "product_id": "7Server-optional-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.src"
        },
        "product_reference": "tomcat-0:7.0.76-10.el7_6.src",
        "relates_to_product_reference": "7Server-optional-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
          "product_id": "7Server-optional-Alt-7.6-EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
          "product_id": "7Server-optional-Alt-7.6-EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
          "product_id": "7Server-optional-Alt-7.6-EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
          "product_id": "7Server-optional-Alt-7.6-EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
          "product_id": "7Server-optional-Alt-7.6-EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
          "product_id": "7Server-optional-Alt-7.6-EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
          "product_id": "7Server-optional-Alt-7.6-EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-lib-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
          "product_id": "7Server-optional-Alt-7.6-EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-Alt-7.6-EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-0:7.0.76-10.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)",
          "product_id": "7Server-optional-Alt-7.6-EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch"
        },
        "product_reference": "tomcat-webapps-0:7.0.76-10.el7_6.noarch",
        "relates_to_product_reference": "7Server-optional-Alt-7.6-EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-1938",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "discovery_date": "2020-02-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1806398"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "CVE-2020-1938 is a file read/inclusion vulnerability in the AJP connector in Apache Tomcat. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution (RCE).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Please refer to the Red Hat knowledgebase article: https://access.redhat.com/solutions/4851251 and CVE page https://access.redhat.com/security/cve/cve-2020-1745",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7ComputeNode-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
          "7ComputeNode-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
          "7ComputeNode-optional-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-optional-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-optional-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-optional-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-optional-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-optional-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-optional-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-optional-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
          "7ComputeNode-optional-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
          "7Server-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
          "7Server-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
          "7Server-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
          "7Server-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
          "7Server-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
          "7Server-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
          "7Server-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
          "7Server-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
          "7Server-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
          "7Server-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
          "7Server-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
          "7Server-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.noarch",
          "7Server-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.src",
          "7Server-Alt-7.6-EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
          "7Server-Alt-7.6-EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
          "7Server-Alt-7.6-EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
          "7Server-Alt-7.6-EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
          "7Server-Alt-7.6-EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
          "7Server-Alt-7.6-EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
          "7Server-Alt-7.6-EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
          "7Server-Alt-7.6-EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
          "7Server-Alt-7.6-EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
          "7Server-optional-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.src",
          "7Server-optional-Alt-7.6-EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-Alt-7.6-EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-Alt-7.6-EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-Alt-7.6-EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-Alt-7.6-EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-Alt-7.6-EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-Alt-7.6-EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-Alt-7.6-EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
          "7Server-optional-Alt-7.6-EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-1938"
        },
        {
          "category": "external",
          "summary": "RHBZ#1806398",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1806398"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1938",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-1938"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938"
        },
        {
          "category": "external",
          "summary": "https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/",
          "url": "https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/"
        },
        {
          "category": "external",
          "summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100",
          "url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100"
        },
        {
          "category": "external",
          "summary": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51",
          "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51"
        },
        {
          "category": "external",
          "summary": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31",
          "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31"
        },
        {
          "category": "external",
          "summary": "https://www.cnvd.org.cn/webinfo/show/5415",
          "url": "https://www.cnvd.org.cn/webinfo/show/5415"
        },
        {
          "category": "external",
          "summary": "https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487",
          "url": "https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2020-02-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-07-07T10:31:39+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7ComputeNode-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7ComputeNode-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7ComputeNode-optional-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7Server-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7Server-Alt-7.6-EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7Server-optional-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7Server-optional-Alt-7.6-EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:2840"
        },
        {
          "category": "workaround",
          "details": "Please refer to the Red Hat knowledgebase article: https://access.redhat.com/solutions/4851251",
          "product_ids": [
            "7ComputeNode-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7ComputeNode-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7ComputeNode-optional-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7Server-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7Server-Alt-7.6-EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7Server-optional-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7Server-optional-Alt-7.6-EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "7ComputeNode-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7ComputeNode-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7ComputeNode-optional-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7ComputeNode-optional-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7Server-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7Server-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7Server-Alt-7.6-EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7Server-Alt-7.6-EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7Server-optional-7.6.EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-7.6.EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-0:7.0.76-10.el7_6.src",
            "7Server-optional-Alt-7.6-EUS:tomcat-admin-webapps-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-docs-webapp-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-el-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-javadoc-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-jsp-2.2-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-jsvc-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-lib-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-servlet-3.0-api-0:7.0.76-10.el7_6.noarch",
            "7Server-optional-Alt-7.6-EUS:tomcat-webapps-0:7.0.76-10.el7_6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-03-03T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability"
    }
  ]
}

cve-2020-1938

Vulnerability from cvelistv5

Published

2020-02-24 21:19

Modified

2024-08-04 06:54

Severity ?

Summary

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

References

▼	URL	Tags
	https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r856cdd87eda7af40b50278d6de80ee4b42d63adeb433a34a7bdaf9db%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63e074152049c3f399d%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7%40%3Ccommits.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r74328b178f9f37fe759dffbc9c1f2793e66d79d7a8a20d3836551794%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rad36ec6a1ffc9e43266b030c22ceeea569243555d34fb4187ff08522%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada455580258f9%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r4afa11e0464408e68f0e9560e90b185749363a66398b1491254f7864%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r772335e6851ad33ddb076218fa4ff70de1bf398d5b43e2ddf0130e5d%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r5e2f1201b92ee05a0527cfc076a81ea0c270be299b87895c0ddbe02b%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r549b43509e387a42656f0641fa311bf27c127c244fe02007d5b8d6f6%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r61f280a76902b594692f0b24a1dbf647bb5a4c197b9395e9a6796e7c%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r4f86cb260196e5cfcbbe782822c225ddcc70f54560f14a8f11c6926f%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9f119d9ce9239114022e13dbfe385b3de7c972f24f05d6dbd35c1a2f%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r089dc67c0358a1556dd279c762c74f32d7a254a54836b7ee2d839d8e%40%3Cdev.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15f7364a%40%3Cdev.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html	vendor-advisory, x_refsource_SUSE
	https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rf26663f42e7f1a1d1cac732469fb5e92c89908a48b61ec546dbb79ca%40%3Cbugs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/202003-43	vendor-advisory, x_refsource_GENTOO
	https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194%40%3Ccommits.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d7039668821be28df3%40%3Ccommits.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r6a5633cad1b560a1e51f5b425f02918bdf30e090fdf18c5f7c2617eb%40%3Ccommits.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XFLQB3O5QVP4ZBIPVIXBEZV7F2R7ZMS/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L46WJIV6UV3FWA5O5YEY6XLA73RYD53B/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3IPNHCKFVUKSHDTM45UL4Q765EHHTFG/	vendor-advisory, x_refsource_FEDORA
	https://lists.apache.org/thread.html/r43faacf64570b1d9a4bada407a5af3b2738b0c007b905f1b6b608c65%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://www.debian.org/security/2020/dsa-4673	vendor-advisory, x_refsource_DEBIAN
	https://www.debian.org/security/2020/dsa-4680	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200226-0002/	x_refsource_CONFIRM
	http://support.blackberry.com/kb/articleDetail?articleNumber=000062739	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/r92d78655c068d0bc991d1edbdfb24f9c5134603e647cade1113d4e0a%40%3Cusers.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://lists.apache.org/thread.html/r57f5e4ced436ace518a9e222fabe27fb785f09f5bf974814cc48ca97%40%3Ccommits.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r47caef01f663106c2bb81d116b8380d62beac9e543dd3f3bc2c2beda%40%3Ccommits.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

▼	Vendor	Product
	Apache	Apache Tomcat

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:54:00.412Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[tomcat-announce] 20200224 [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E"
          },
          {
            "name": "[ofbiz-notifications] 20200225 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r856cdd87eda7af40b50278d6de80ee4b42d63adeb433a34a7bdaf9db%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "name": "[ofbiz-notifications] 20200225 [jira] [Updated] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63e074152049c3f399d%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "name": "[ofbiz-commits] 20200227 [ofbiz-plugins] branch release17.12 updated: Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) (OFBIZ-11407)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7%40%3Ccommits.ofbiz.apache.org%3E"
          },
          {
            "name": "[ofbiz-notifications] 20200227 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r74328b178f9f37fe759dffbc9c1f2793e66d79d7a8a20d3836551794%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "name": "[ofbiz-notifications] 20200228 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "name": "[ofbiz-notifications] 20200228 [jira] [Comment Edited] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rad36ec6a1ffc9e43266b030c22ceeea569243555d34fb4187ff08522%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "name": "[tomcat-users] 20200301 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada455580258f9%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-users] 20200302 Re: AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-users] 20200302 AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-users] 20200302 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-users] 20200304 Re: Fix for CVE-2020-1938",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4afa11e0464408e68f0e9560e90b185749363a66398b1491254f7864%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200304 Re: Tagging 10.0.x, 9.0.x, 8.5.x",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r772335e6851ad33ddb076218fa4ff70de1bf398d5b43e2ddf0130e5d%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[debian-lts-announce] 20200304 [SECURITY] [DLA 2133-1] tomcat7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html"
          },
          {
            "name": "[tomcat-users] 20200305 Aw: Re: Fix for CVE-2020-1938",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-users] 20200305 Re: Aw: Re: Fix for CVE-2020-1938",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r5e2f1201b92ee05a0527cfc076a81ea0c270be299b87895c0ddbe02b%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200309 [Bug 64206] Answer file not being used",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r549b43509e387a42656f0641fa311bf27c127c244fe02007d5b8d6f6%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-users] 20200309 Re: Apache Tomcat AJP File Inclusion Vulnerability (unauthenticated check)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r61f280a76902b594692f0b24a1dbf647bb5a4c197b9395e9a6796e7c%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-users] 20200310 Aw: Re: Re: Fix for CVE-2020-1938",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r4f86cb260196e5cfcbbe782822c225ddcc70f54560f14a8f11c6926f%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-users] 20200310 Re: Re: Re: Fix for CVE-2020-1938",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r9f119d9ce9239114022e13dbfe385b3de7c972f24f05d6dbd35c1a2f%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "[tomee-dev] 20200311 CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r089dc67c0358a1556dd279c762c74f32d7a254a54836b7ee2d839d8e%40%3Cdev.tomee.apache.org%3E"
          },
          {
            "name": "[tomee-dev] 20200311 Re: CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15f7364a%40%3Cdev.tomee.apache.org%3E"
          },
          {
            "name": "openSUSE-SU-2020:0345",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html"
          },
          {
            "name": "[tomee-dev] 20200316 RE: CVE-2020-8840 on TomEE 8.0.1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E"
          },
          {
            "name": "[httpd-bugs] 20200319 [Bug 53098] mod_proxy_ajp: patch to set worker secret passed to tomcat",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf26663f42e7f1a1d1cac732469fb5e92c89908a48b61ec546dbb79ca%40%3Cbugs.httpd.apache.org%3E"
          },
          {
            "name": "GLSA-202003-43",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-43"
          },
          {
            "name": "[tomee-commits] 20200320 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "name": "[tomee-commits] 20200320 [jira] [Created] (TOMEE-2789) TomEE plus is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d7039668821be28df3%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "name": "[tomee-commits] 20200323 [jira] [Commented] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r6a5633cad1b560a1e51f5b425f02918bdf30e090fdf18c5f7c2617eb%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "name": "FEDORA-2020-0e42878ba7",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XFLQB3O5QVP4ZBIPVIXBEZV7F2R7ZMS/"
          },
          {
            "name": "FEDORA-2020-c870aa8378",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L46WJIV6UV3FWA5O5YEY6XLA73RYD53B/"
          },
          {
            "name": "FEDORA-2020-04ac174fa9",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3IPNHCKFVUKSHDTM45UL4Q765EHHTFG/"
          },
          {
            "name": "[tomcat-users] 20200413 RE: Alternatives for AJP",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r43faacf64570b1d9a4bada407a5af3b2738b0c007b905f1b6b608c65%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "name": "openSUSE-SU-2020:0597",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html"
          },
          {
            "name": "DSA-4673",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4673"
          },
          {
            "name": "DSA-4680",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4680"
          },
          {
            "name": "[debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html"
          },
          {
            "name": "[tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[ofbiz-notifications] 20200628 [jira] [Updated] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "name": "[ofbiz-notifications] 20200628 [jira] [Created] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200226-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000062739"
          },
          {
            "name": "[tomee-users] 20200723 Re: TomEE on Docker",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r92d78655c068d0bc991d1edbdfb24f9c5134603e647cade1113d4e0a%40%3Cusers.tomee.apache.org%3E"
          },
          {
            "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "name": "[tomee-commits] 20201127 [jira] [Resolved] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r57f5e4ced436ace518a9e222fabe27fb785f09f5bf974814cc48ca97%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "name": "[tomee-commits] 20201127 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r47caef01f663106c2bb81d116b8380d62beac9e543dd3f3bc2c2beda%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "name": "[announce] 20210125 Apache Software Foundation Security Report: 2020",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E"
          },
          {
            "name": "[announce] 20210223 Re: Apache Software Foundation Security Report: 2020",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Tomcat",
          "vendor": "Apache",
          "versions": [
            {
              "status": "affected",
              "version": "Apache Tomcat 9.0.0.M1 to 9.0.0.30"
            },
            {
              "status": "affected",
              "version": "8.5.0 to 8.5.50"
            },
            {
              "status": "affected",
              "version": "7.0.0 to 7.0.99"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "AJP Request Injection leading to possible Remote Code Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-02-24T03:06:28",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "[tomcat-announce] 20200224 [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E"
        },
        {
          "name": "[ofbiz-notifications] 20200225 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r856cdd87eda7af40b50278d6de80ee4b42d63adeb433a34a7bdaf9db%40%3Cnotifications.ofbiz.apache.org%3E"
        },
        {
          "name": "[ofbiz-notifications] 20200225 [jira] [Updated] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63e074152049c3f399d%40%3Cnotifications.ofbiz.apache.org%3E"
        },
        {
          "name": "[ofbiz-commits] 20200227 [ofbiz-plugins] branch release17.12 updated: Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) (OFBIZ-11407)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7%40%3Ccommits.ofbiz.apache.org%3E"
        },
        {
          "name": "[ofbiz-notifications] 20200227 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r74328b178f9f37fe759dffbc9c1f2793e66d79d7a8a20d3836551794%40%3Cnotifications.ofbiz.apache.org%3E"
        },
        {
          "name": "[ofbiz-notifications] 20200228 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425%40%3Cnotifications.ofbiz.apache.org%3E"
        },
        {
          "name": "[ofbiz-notifications] 20200228 [jira] [Comment Edited] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rad36ec6a1ffc9e43266b030c22ceeea569243555d34fb4187ff08522%40%3Cnotifications.ofbiz.apache.org%3E"
        },
        {
          "name": "[tomcat-users] 20200301 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada455580258f9%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-users] 20200302 Re: AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-users] 20200302 AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-users] 20200302 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-users] 20200304 Re: Fix for CVE-2020-1938",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4afa11e0464408e68f0e9560e90b185749363a66398b1491254f7864%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200304 Re: Tagging 10.0.x, 9.0.x, 8.5.x",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r772335e6851ad33ddb076218fa4ff70de1bf398d5b43e2ddf0130e5d%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[debian-lts-announce] 20200304 [SECURITY] [DLA 2133-1] tomcat7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html"
        },
        {
          "name": "[tomcat-users] 20200305 Aw: Re: Fix for CVE-2020-1938",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-users] 20200305 Re: Aw: Re: Fix for CVE-2020-1938",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r5e2f1201b92ee05a0527cfc076a81ea0c270be299b87895c0ddbe02b%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200309 [Bug 64206] Answer file not being used",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r549b43509e387a42656f0641fa311bf27c127c244fe02007d5b8d6f6%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-users] 20200309 Re: Apache Tomcat AJP File Inclusion Vulnerability (unauthenticated check)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r61f280a76902b594692f0b24a1dbf647bb5a4c197b9395e9a6796e7c%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-users] 20200310 Aw: Re: Re: Fix for CVE-2020-1938",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r4f86cb260196e5cfcbbe782822c225ddcc70f54560f14a8f11c6926f%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-users] 20200310 Re: Re: Re: Fix for CVE-2020-1938",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r9f119d9ce9239114022e13dbfe385b3de7c972f24f05d6dbd35c1a2f%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "[tomee-dev] 20200311 CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r089dc67c0358a1556dd279c762c74f32d7a254a54836b7ee2d839d8e%40%3Cdev.tomee.apache.org%3E"
        },
        {
          "name": "[tomee-dev] 20200311 Re: CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15f7364a%40%3Cdev.tomee.apache.org%3E"
        },
        {
          "name": "openSUSE-SU-2020:0345",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html"
        },
        {
          "name": "[tomee-dev] 20200316 RE: CVE-2020-8840 on TomEE 8.0.1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E"
        },
        {
          "name": "[httpd-bugs] 20200319 [Bug 53098] mod_proxy_ajp: patch to set worker secret passed to tomcat",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf26663f42e7f1a1d1cac732469fb5e92c89908a48b61ec546dbb79ca%40%3Cbugs.httpd.apache.org%3E"
        },
        {
          "name": "GLSA-202003-43",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-43"
        },
        {
          "name": "[tomee-commits] 20200320 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194%40%3Ccommits.tomee.apache.org%3E"
        },
        {
          "name": "[tomee-commits] 20200320 [jira] [Created] (TOMEE-2789) TomEE plus is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d7039668821be28df3%40%3Ccommits.tomee.apache.org%3E"
        },
        {
          "name": "[tomee-commits] 20200323 [jira] [Commented] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r6a5633cad1b560a1e51f5b425f02918bdf30e090fdf18c5f7c2617eb%40%3Ccommits.tomee.apache.org%3E"
        },
        {
          "name": "FEDORA-2020-0e42878ba7",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XFLQB3O5QVP4ZBIPVIXBEZV7F2R7ZMS/"
        },
        {
          "name": "FEDORA-2020-c870aa8378",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L46WJIV6UV3FWA5O5YEY6XLA73RYD53B/"
        },
        {
          "name": "FEDORA-2020-04ac174fa9",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3IPNHCKFVUKSHDTM45UL4Q765EHHTFG/"
        },
        {
          "name": "[tomcat-users] 20200413 RE: Alternatives for AJP",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r43faacf64570b1d9a4bada407a5af3b2738b0c007b905f1b6b608c65%40%3Cusers.tomcat.apache.org%3E"
        },
        {
          "name": "openSUSE-SU-2020:0597",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html"
        },
        {
          "name": "DSA-4673",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4673"
        },
        {
          "name": "DSA-4680",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4680"
        },
        {
          "name": "[debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html"
        },
        {
          "name": "[tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[ofbiz-notifications] 20200628 [jira] [Updated] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E"
        },
        {
          "name": "[ofbiz-notifications] 20200628 [jira] [Created] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200226-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000062739"
        },
        {
          "name": "[tomee-users] 20200723 Re: TomEE on Docker",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r92d78655c068d0bc991d1edbdfb24f9c5134603e647cade1113d4e0a%40%3Cusers.tomee.apache.org%3E"
        },
        {
          "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "name": "[tomee-commits] 20201127 [jira] [Resolved] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r57f5e4ced436ace518a9e222fabe27fb785f09f5bf974814cc48ca97%40%3Ccommits.tomee.apache.org%3E"
        },
        {
          "name": "[tomee-commits] 20201127 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r47caef01f663106c2bb81d116b8380d62beac9e543dd3f3bc2c2beda%40%3Ccommits.tomee.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "name": "[announce] 20210125 Apache Software Foundation Security Report: 2020",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E"
        },
        {
          "name": "[announce] 20210223 Re: Apache Software Foundation Security Report: 2020",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2020-1938",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Tomcat",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Apache Tomcat 9.0.0.M1 to 9.0.0.30"
                          },
                          {
                            "version_value": "8.5.0 to 8.5.50"
                          },
                          {
                            "version_value": "7.0.0 to 7.0.99"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "AJP Request Injection leading to possible Remote Code Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[tomcat-announce] 20200224 [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E"
            },
            {
              "name": "[ofbiz-notifications] 20200225 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r856cdd87eda7af40b50278d6de80ee4b42d63adeb433a34a7bdaf9db@%3Cnotifications.ofbiz.apache.org%3E"
            },
            {
              "name": "[ofbiz-notifications] 20200225 [jira] [Updated] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63e074152049c3f399d@%3Cnotifications.ofbiz.apache.org%3E"
            },
            {
              "name": "[ofbiz-commits] 20200227 [ofbiz-plugins] branch release17.12 updated: Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) (OFBIZ-11407)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7@%3Ccommits.ofbiz.apache.org%3E"
            },
            {
              "name": "[ofbiz-notifications] 20200227 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r74328b178f9f37fe759dffbc9c1f2793e66d79d7a8a20d3836551794@%3Cnotifications.ofbiz.apache.org%3E"
            },
            {
              "name": "[ofbiz-notifications] 20200228 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425@%3Cnotifications.ofbiz.apache.org%3E"
            },
            {
              "name": "[ofbiz-notifications] 20200228 [jira] [Comment Edited] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rad36ec6a1ffc9e43266b030c22ceeea569243555d34fb4187ff08522@%3Cnotifications.ofbiz.apache.org%3E"
            },
            {
              "name": "[tomcat-users] 20200301 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada455580258f9@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-users] 20200302 Re: AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-users] 20200302 AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-users] 20200302 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-users] 20200304 Re: Fix for CVE-2020-1938",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4afa11e0464408e68f0e9560e90b185749363a66398b1491254f7864@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20200304 Re: Tagging 10.0.x, 9.0.x, 8.5.x",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r772335e6851ad33ddb076218fa4ff70de1bf398d5b43e2ddf0130e5d@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[debian-lts-announce] 20200304 [SECURITY] [DLA 2133-1] tomcat7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html"
            },
            {
              "name": "[tomcat-users] 20200305 Aw: Re: Fix for CVE-2020-1938",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-users] 20200305 Re: Aw: Re: Fix for CVE-2020-1938",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r5e2f1201b92ee05a0527cfc076a81ea0c270be299b87895c0ddbe02b@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20200309 [Bug 64206] Answer file not being used",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r549b43509e387a42656f0641fa311bf27c127c244fe02007d5b8d6f6@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-users] 20200309 Re: Apache Tomcat AJP File Inclusion Vulnerability (unauthenticated check)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r61f280a76902b594692f0b24a1dbf647bb5a4c197b9395e9a6796e7c@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-users] 20200310 Aw: Re: Re: Fix for CVE-2020-1938",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r4f86cb260196e5cfcbbe782822c225ddcc70f54560f14a8f11c6926f@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-users] 20200310 Re: Re: Re: Fix for CVE-2020-1938",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r9f119d9ce9239114022e13dbfe385b3de7c972f24f05d6dbd35c1a2f@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "[tomee-dev] 20200311 CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r089dc67c0358a1556dd279c762c74f32d7a254a54836b7ee2d839d8e@%3Cdev.tomee.apache.org%3E"
            },
            {
              "name": "[tomee-dev] 20200311 Re: CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15f7364a@%3Cdev.tomee.apache.org%3E"
            },
            {
              "name": "openSUSE-SU-2020:0345",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html"
            },
            {
              "name": "[tomee-dev] 20200316 RE: CVE-2020-8840 on TomEE 8.0.1",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2@%3Cdev.tomee.apache.org%3E"
            },
            {
              "name": "[httpd-bugs] 20200319 [Bug 53098] mod_proxy_ajp: patch to set worker secret passed to tomcat",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf26663f42e7f1a1d1cac732469fb5e92c89908a48b61ec546dbb79ca@%3Cbugs.httpd.apache.org%3E"
            },
            {
              "name": "GLSA-202003-43",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-43"
            },
            {
              "name": "[tomee-commits] 20200320 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194@%3Ccommits.tomee.apache.org%3E"
            },
            {
              "name": "[tomee-commits] 20200320 [jira] [Created] (TOMEE-2789) TomEE plus is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d7039668821be28df3@%3Ccommits.tomee.apache.org%3E"
            },
            {
              "name": "[tomee-commits] 20200323 [jira] [Commented] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r6a5633cad1b560a1e51f5b425f02918bdf30e090fdf18c5f7c2617eb@%3Ccommits.tomee.apache.org%3E"
            },
            {
              "name": "FEDORA-2020-0e42878ba7",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2XFLQB3O5QVP4ZBIPVIXBEZV7F2R7ZMS/"
            },
            {
              "name": "FEDORA-2020-c870aa8378",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L46WJIV6UV3FWA5O5YEY6XLA73RYD53B/"
            },
            {
              "name": "FEDORA-2020-04ac174fa9",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K3IPNHCKFVUKSHDTM45UL4Q765EHHTFG/"
            },
            {
              "name": "[tomcat-users] 20200413 RE: Alternatives for AJP",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r43faacf64570b1d9a4bada407a5af3b2738b0c007b905f1b6b608c65@%3Cusers.tomcat.apache.org%3E"
            },
            {
              "name": "openSUSE-SU-2020:0597",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html"
            },
            {
              "name": "DSA-4673",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4673"
            },
            {
              "name": "DSA-4680",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4680"
            },
            {
              "name": "[debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html"
            },
            {
              "name": "[tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[ofbiz-notifications] 20200628 [jira] [Updated] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760@%3Cnotifications.ofbiz.apache.org%3E"
            },
            {
              "name": "[ofbiz-notifications] 20200628 [jira] [Created] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1@%3Cnotifications.ofbiz.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200226-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200226-0002/"
            },
            {
              "name": "http://support.blackberry.com/kb/articleDetail?articleNumber=000062739",
              "refsource": "CONFIRM",
              "url": "http://support.blackberry.com/kb/articleDetail?articleNumber=000062739"
            },
            {
              "name": "[tomee-users] 20200723 Re: TomEE on Docker",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r92d78655c068d0bc991d1edbdfb24f9c5134603e647cade1113d4e0a@%3Cusers.tomee.apache.org%3E"
            },
            {
              "name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "[tomee-commits] 20201127 [jira] [Resolved] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r57f5e4ced436ace518a9e222fabe27fb785f09f5bf974814cc48ca97@%3Ccommits.tomee.apache.org%3E"
            },
            {
              "name": "[tomee-commits] 20201127 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r47caef01f663106c2bb81d116b8380d62beac9e543dd3f3bc2c2beda@%3Ccommits.tomee.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "[announce] 20210125 Apache Software Foundation Security Report: 2020",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E"
            },
            {
              "name": "[announce] 20210223 Re: Apache Software Foundation Security Report: 2020",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2020-1938",
    "datePublished": "2020-02-24T21:19:18",
    "dateReserved": "2019-12-02T00:00:00",
    "dateUpdated": "2024-08-04T06:54:00.412Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted