Skip to content
OpenAdvisories
Unscored RHSA-2007:1069 7 CVEs

Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server

Published Sep 15, 2024 · Updated Jan 7, 2026

Ecosystem: Red Hat

Fixed packages 21

ReleasePackageFixed in
Red Hat · Network Satellite 4 network_satellite:4.0::el3 jakarta-commons-pool 0:1.2-2jpp_2rh
Red Hat · Network Satellite 4 network_satellite:4.0::el3 tomcat5 0:5.0.30-0jpp_6rh
Red Hat · Network Satellite 4 network_satellite:4.0::el3 tyrex 0:1.0.1-2jpp_2rh
Red Hat · Network Satellite 4 network_satellite:4.0::el4 jakarta-commons-pool 0:1.2-2jpp_2rh
Red Hat · Network Satellite 4 network_satellite:4.0::el4 tomcat5 0:5.0.30-0jpp_6rh
Red Hat · Network Satellite 4 network_satellite:4.0::el4 tyrex 0:1.0.1-2jpp_2rh
Red Hat · Network Satellite 4 network_satellite:4.1::el3 jakarta-commons-pool 0:1.2-2jpp_2rh
Red Hat · Network Satellite 4 network_satellite:4.1::el3 tomcat5 0:5.0.30-0jpp_6rh
Red Hat · Network Satellite 4 network_satellite:4.1::el3 tyrex 0:1.0.1-2jpp_2rh
Red Hat · Network Satellite 4 network_satellite:4.1::el4 jakarta-commons-pool 0:1.2-2jpp_2rh
Red Hat · Network Satellite 4 network_satellite:4.1::el4 tomcat5 0:5.0.30-0jpp_6rh
Red Hat · Network Satellite 4 network_satellite:4.1::el4 tyrex 0:1.0.1-2jpp_2rh
Red Hat · Network Satellite 4 network_satellite:4.2::el3 jakarta-commons-pool 0:1.2-2jpp_2rh
Red Hat · Network Satellite 4 network_satellite:4.2::el3 tomcat5 0:5.0.30-0jpp_6rh
Red Hat · Network Satellite 4 network_satellite:4.2::el3 tyrex 0:1.0.1-2jpp_2rh
Red Hat · Network Satellite 4 network_satellite:4.2::el4 jakarta-commons-pool 0:1.2-2jpp_2rh
Red Hat · Network Satellite 4 network_satellite:4.2::el4 tomcat5 0:5.0.30-0jpp_6rh
Red Hat · Network Satellite 4 network_satellite:4.2::el4 tyrex 0:1.0.1-2jpp_2rh
Red Hat · Network Satellite 5 network_satellite:5.0:el4 jakarta-commons-pool 0:1.2-2jpp_2rh
Red Hat · Network Satellite 5 network_satellite:5.0:el4 tomcat5 0:5.0.30-0jpp_6rh
Red Hat · Network Satellite 5 network_satellite:5.0:el4 tyrex 0:1.0.1-2jpp_2rh

Vulnerabilities 7

  • Medium —
    CVE-2005-2090 EPSS 26%

    Tomcat Vulnerable to Web Cache Poisoning

    Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Co…

    org.apache.tomcat:tomcat Maven
  • High —
    CVE-2005-3510

    Apache Tomcat Vulnerable to Denial of Service (DoS) via Simultaneous Requests

    Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2006-3835 Public exploit EPSS 48%

    Apache Tomcat Reveals Directories

    Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2007-0450 Public exploit EPSS 91%

    Apache Tomcat Directory Traversal

    Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with com…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2007-1858 Public exploit EPSS 18%

    The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.…

  • Medium —
    CVE-2007-3382 Public exploit EPSS 37%

    Apache Tomcat treats single quotes as delimiters in cookies

    Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to cond…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2007-3385 EPSS 17%

    Apache Tomcat Mishandles Character Sequence in Cookies

    Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attacke…

    org.apache.tomcat:tomcat Maven

References

  • article
    http://tomcat.apache.org/security-5.html
  • article
    http://www.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237079
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237080
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237083
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237084
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=237085
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=247972
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=247976
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_1069.json
  • report
    https://access.redhat.com/security/cve/CVE-2005-2090
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2005-2090
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2005-2090
  • report
    https://access.redhat.com/security/cve/CVE-2005-3510
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2005-3510
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2005-3510
  • report
    https://access.redhat.com/security/cve/CVE-2006-3835
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2006-3835
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2006-3835
  • report
    https://access.redhat.com/security/cve/CVE-2007-0450
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2007-0450
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2007-0450
  • report
    https://access.redhat.com/security/cve/CVE-2007-1858
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2007-1858
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2007-1858
  • report
    https://access.redhat.com/security/cve/CVE-2007-3382
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2007-3382
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2007-3382
  • report
    https://access.redhat.com/security/cve/CVE-2007-3385
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2007-3385
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2007-3385