tomcat8 - security update

Fixed packages 1

Vulnerabilities 4

• Critical 9.8
  CVE-2020-1938 Exploited Public exploit Scanner template EPSS 99%

  Improper Privilege Management in Tomcat

  When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…

  Apache Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  Feb 24, 2020

  KEV Mar 3, 2022
• High 7.5
  CVE-2019-17563 EPSS 11%

  In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack

  When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical …

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  Dec 23, 2019
• High 7.0
  CVE-2020-9484 Public exploit Scanner template EPSS 56%

  Potential remote code execution in Apache Tomcat

  When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManage…

  tomcat9 tomcat8 tomcat9 tomcat7 Debian Ubuntu Maven
  May 20, 2020
• Medium 4.8
  CVE-2020-1935

  Potential HTTP request smuggling in Apache Tomcat

  In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if …

  Apache Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Feb 24, 2020