Skip to content
OpenAdvisories
Medium ELSA-2019-2205 4 CVEs

Moderate: tomcat security, bug fix, and enhancement update (Oracle Linux 7)

Published Aug 13, 2019 · Updated Aug 13, 2019

Ecosystem: Oracle Linux

Summary

[0:7.0.76-9]
- Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet
- Resolves: rhbz#1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended expo
sure of resources
- Resolves: rhbz#1552374 CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised us
ers
- Resolves: rhbz#1590182 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
- Resolves: rhbz#1608609 CVE-2018-8034 tomcat: host name verification missing in WebSocket client
- Resolves: rhbz#1588703 Backport of Negative maxCookieCount value causes exception for Tomcat
- Resolves: rhbz#1472950 shutdown_wait option is not working for Tomcat
- Resolves: rhbz#1455483 Add support for characters < and > to the possible whitelist values

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 7 tomcat 0:7.0.76-9.el7
Oracle Linux · 7 tomcat-admin-webapps 0:7.0.76-9.el7
Oracle Linux · 7 tomcat-docs-webapp 0:7.0.76-9.el7
Oracle Linux · 7 tomcat-el-2.2-api 0:7.0.76-9.el7
Oracle Linux · 7 tomcat-javadoc 0:7.0.76-9.el7
Oracle Linux · 7 tomcat-jsp-2.2-api 0:7.0.76-9.el7
Oracle Linux · 7 tomcat-jsvc 0:7.0.76-9.el7
Oracle Linux · 7 tomcat-lib 0:7.0.76-9.el7
Oracle Linux · 7 tomcat-servlet-3.0-api 0:7.0.76-9.el7
Oracle Linux · 7 tomcat-webapps 0:7.0.76-9.el7

Vulnerabilities 4

  • Critical 9.8
    CVE-2018-8014 EPSS 21%

    The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins

    The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.5
    CVE-2018-8034 EPSS 21%

    The host name verification missing in Apache Tomcat

    The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • Medium 6.5
    CVE-2018-1305 Public exploit EPSS 14%

    Apache Tomcat information exposure vulnerability

    Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to th…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • Medium 5.9
    CVE-2018-1304 Public exploit EPSS 17%

    Apache Tomcat unauthorized access vulnerability

    The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven