Skip to content
OpenAdvisories
Medium ALAS2-2019-1192 1 CVE

Moderate: tomcat security update (Amazon Linux 2)

Published Apr 4, 2019 · Updated Apr 17, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-11784: When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. 1636512: CVE-2018-11784 tomcat: Open redirect in default servlet

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 tomcat 0:7.0.76-9.amzn2
Amazon Linux · 2 tomcat-admin-webapps 0:7.0.76-9.amzn2
Amazon Linux · 2 tomcat-docs-webapp 0:7.0.76-9.amzn2
Amazon Linux · 2 tomcat-el-2.2-api 0:7.0.76-9.amzn2
Amazon Linux · 2 tomcat-javadoc 0:7.0.76-9.amzn2
Amazon Linux · 2 tomcat-jsp-2.2-api 0:7.0.76-9.amzn2
Amazon Linux · 2 tomcat-jsvc 0:7.0.76-9.amzn2
Amazon Linux · 2 tomcat-lib 0:7.0.76-9.amzn2
Amazon Linux · 2 tomcat-servlet-3.0-api 0:7.0.76-9.amzn2
Amazon Linux · 2 tomcat-webapps 0:7.0.76-9.amzn2

Vulnerabilities 1

  • Medium 4.3
    CVE-2018-11784 Public exploit Scanner template EPSS 98%

    Apache Tomcat Open Redirect vulnerability

    When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redi…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-11784.html