Skip to content
OpenAdvisories
High DLA-2077-1 2 CVEs

tomcat7 - security update

Published Jan 27, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 tomcat7 7.0.56-3+really7.0.99-1

Vulnerabilities 2

  • High 7.5
    CVE-2019-17563 EPSS 11%

    In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack

    When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical …

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  • High 7.0
    CVE-2019-12418

    Insufficiently Protected Credentials in Apache Tomcat

    When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven