Skip to content
OpenAdvisories
Unscored RHSA-2007:0340 8 CVEs

Red Hat Security Advisory: tomcat security update

Published Sep 15, 2024 · Updated Jan 7, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · Rhel Application Server 1 rhel_application_server:1 tomcat5 0:5.0.30-0jpp_5rh
Red Hat · Rhel Application Server 1 rhel_application_server:1 tomcat5-admin-webapps 0:5.0.30-0jpp_5rh
Red Hat · Rhel Application Server 1 rhel_application_server:1 tomcat5-webapps 0:5.0.30-0jpp_5rh

Vulnerabilities 8

  • Medium —
    CVE-2005-2090 EPSS 26%

    Tomcat Vulnerable to Web Cache Poisoning

    Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Co…

    org.apache.tomcat:tomcat Maven
  • High —
    CVE-2005-3510

    Apache Tomcat Vulnerable to Denial of Service (DoS) via Simultaneous Requests

    Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2005-4838

    Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlie…

  • Medium —
    CVE-2006-3835 Public exploit EPSS 48%

    Apache Tomcat Reveals Directories

    Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2006-7195

    Apache Tomcat XSS Vulnerability

    Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2006-7196 Public exploit EPSS 72%

    Cross-site scripting in Apache Tomcat

    Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2007-0450 Public exploit EPSS 91%

    Apache Tomcat Directory Traversal

    Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with com…

    org.apache.tomcat:tomcat apache2 Wolfi Maven
  • Unscored —
    CVE-2007-1858 Public exploit EPSS 18%

    The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    http://tomcat.apache.org/security-5.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=238402
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0340.json
  • report
    https://access.redhat.com/security/cve/CVE-2005-2090
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237079
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2005-2090
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2005-2090
  • report
    https://access.redhat.com/security/cve/CVE-2005-3510
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237085
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2005-3510
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2005-3510
  • report
    https://access.redhat.com/security/cve/CVE-2005-4838
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=238401
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2005-4838
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2005-4838
  • report
    https://access.redhat.com/security/cve/CVE-2006-3835
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237084
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2006-3835
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2006-3835
  • report
    https://access.redhat.com/security/cve/CVE-2006-7195
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237081
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2006-7195
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2006-7195
  • report
    https://access.redhat.com/security/cve/CVE-2006-7196
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=238131
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2006-7196
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2006-7196
  • report
    https://access.redhat.com/security/cve/CVE-2007-0450
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237080
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2007-0450
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2007-0450
  • report
    https://access.redhat.com/security/cve/CVE-2007-1858
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237083
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2007-1858
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2007-1858