Skip to content
OpenAdvisories
Medium ELSA-2019-0485 1 CVE

Moderate: tomcat security update (Oracle Linux 7)

Published Mar 13, 2019 · Updated Mar 13, 2019

Ecosystem: Oracle Linux

Summary

[0:7.0.76-9]
- Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 7 tomcat 0:7.0.76-9.el7_6
Oracle Linux · 7 tomcat-admin-webapps 0:7.0.76-9.el7_6
Oracle Linux · 7 tomcat-docs-webapp 0:7.0.76-9.el7_6
Oracle Linux · 7 tomcat-el-2.2-api 0:7.0.76-9.el7_6
Oracle Linux · 7 tomcat-javadoc 0:7.0.76-9.el7_6
Oracle Linux · 7 tomcat-jsp-2.2-api 0:7.0.76-9.el7_6
Oracle Linux · 7 tomcat-jsvc 0:7.0.76-9.el7_6
Oracle Linux · 7 tomcat-lib 0:7.0.76-9.el7_6
Oracle Linux · 7 tomcat-servlet-3.0-api 0:7.0.76-9.el7_6
Oracle Linux · 7 tomcat-webapps 0:7.0.76-9.el7_6

Vulnerabilities 1

  • Medium 4.3
    CVE-2018-11784 Public exploit Scanner template EPSS 98%

    Apache Tomcat Open Redirect vulnerability

    When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redi…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven