Skip to content
OpenAdvisories
High ELSA-2018-2921 1 CVE

Important: tomcat security update (Oracle Linux 7)

Published Oct 16, 2018 · Updated Oct 16, 2018

Ecosystem: Oracle Linux

Summary

[0:7.0.76-8]
- Resolves: rhbz#1608608 CVE-2018-1336 tomcat: A bug in the UTF 8 decoder can lead to DoS

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 7 tomcat 0:7.0.76-8.el7_5
Oracle Linux · 7 tomcat-admin-webapps 0:7.0.76-8.el7_5
Oracle Linux · 7 tomcat-docs-webapp 0:7.0.76-8.el7_5
Oracle Linux · 7 tomcat-el-2.2-api 0:7.0.76-8.el7_5
Oracle Linux · 7 tomcat-javadoc 0:7.0.76-8.el7_5
Oracle Linux · 7 tomcat-jsp-2.2-api 0:7.0.76-8.el7_5
Oracle Linux · 7 tomcat-jsvc 0:7.0.76-8.el7_5
Oracle Linux · 7 tomcat-lib 0:7.0.76-8.el7_5
Oracle Linux · 7 tomcat-servlet-3.0-api 0:7.0.76-8.el7_5
Oracle Linux · 7 tomcat-webapps 0:7.0.76-8.el7_5

Vulnerabilities 1

  • High 7.5
    CVE-2018-1336 EPSS 20%

    In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder

    An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven