Skip to content
OpenAdvisories
High ELSA-2020-2530 1 CVE

Important: tomcat security update (Oracle Linux 7)

Published Jun 11, 2020 · Updated Jun 11, 2020

Ecosystem: Oracle Linux

Summary

[0:7.0.76-12]
- Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 7 tomcat 0:7.0.76-12.el7_8
Oracle Linux · 7 tomcat-admin-webapps 0:7.0.76-12.el7_8
Oracle Linux · 7 tomcat-docs-webapp 0:7.0.76-12.el7_8
Oracle Linux · 7 tomcat-el-2.2-api 0:7.0.76-12.el7_8
Oracle Linux · 7 tomcat-javadoc 0:7.0.76-12.el7_8
Oracle Linux · 7 tomcat-jsp-2.2-api 0:7.0.76-12.el7_8
Oracle Linux · 7 tomcat-jsvc 0:7.0.76-12.el7_8
Oracle Linux · 7 tomcat-lib 0:7.0.76-12.el7_8
Oracle Linux · 7 tomcat-servlet-3.0-api 0:7.0.76-12.el7_8
Oracle Linux · 7 tomcat-webapps 0:7.0.76-12.el7_8

Vulnerabilities 1

  • High 7.0
    CVE-2020-9484 Public exploit Scanner template EPSS 56%

    Potential remote code execution in Apache Tomcat

    When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManage…

    tomcat9 tomcat8 tomcat9 tomcat7 Debian Ubuntu Maven