Skip to content
OpenAdvisories
High 1 exploited CVE ELSA-2020-0855 1 CVE

Important: tomcat security update (Oracle Linux 7)

Published Mar 22, 2020 · Updated Mar 22, 2020

Ecosystem: Oracle Linux

Summary

[0:7.0.76-11]
- Resolves: rhbz#1806801 CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 7 tomcat 0:7.0.76-11.el7_7
Oracle Linux · 7 tomcat-admin-webapps 0:7.0.76-11.el7_7
Oracle Linux · 7 tomcat-docs-webapp 0:7.0.76-11.el7_7
Oracle Linux · 7 tomcat-el-2.2-api 0:7.0.76-11.el7_7
Oracle Linux · 7 tomcat-javadoc 0:7.0.76-11.el7_7
Oracle Linux · 7 tomcat-jsp-2.2-api 0:7.0.76-11.el7_7
Oracle Linux · 7 tomcat-jsvc 0:7.0.76-11.el7_7
Oracle Linux · 7 tomcat-lib 0:7.0.76-11.el7_7
Oracle Linux · 7 tomcat-servlet-3.0-api 0:7.0.76-11.el7_7
Oracle Linux · 7 tomcat-webapps 0:7.0.76-11.el7_7

Vulnerabilities 1

  • Critical 9.8
    CVE-2020-1938 Exploited Public exploit Scanner template EPSS 99%

    Improper Privilege Management in Tomcat

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…

    Apache Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
    KEV Mar 3, 2022