Skip to content
OpenAdvisories
Medium RHSA-2009:1164 6 CVEs

Red Hat Security Advisory: tomcat security update

Published Sep 15, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 26

ReleasePackageFixed in
Red Hat · RHEL 5 enterprise_linux:5::client tomcat5 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client tomcat5-debuginfo 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client tomcat5-jsp-2.0-api 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client tomcat5-servlet-2.4-api 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation tomcat5 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation tomcat5-admin-webapps 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation tomcat5-common-lib 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation tomcat5-debuginfo 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation tomcat5-jasper 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation tomcat5-jasper-javadoc 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation tomcat5-jsp-2.0-api-javadoc 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation tomcat5-server-lib 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation tomcat5-servlet-2.4-api-javadoc 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation tomcat5-webapps 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-admin-webapps 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-common-lib 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-debuginfo 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-jasper 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-jasper-javadoc 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-jsp-2.0-api 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-jsp-2.0-api-javadoc 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-server-lib 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-servlet-2.4-api 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-servlet-2.4-api-javadoc 0:5.5.23-0jpp.7.el5_3.2
Red Hat · RHEL 5 enterprise_linux:5::server tomcat5-webapps 0:5.5.23-0jpp.7.el5_3.2

Vulnerabilities 6

  • Medium 5.3
    CVE-2008-5515 EPSS 19%

    Directory Traversal in Apache Tomcat

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass int…

    org.apache.tomcat:tomcat Maven
  • Medium 4.2
    CVE-2009-0783

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2007-5333 Public exploit EPSS 63%

    Exposure of Sensitive Information in Apache Tomcat

    Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2009-0033 EPSS 10%

    Apache Tomcat Denial of Service via Malformed Request Headers

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid he…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2009-0580 Public exploit EPSS 94%

    Exposure of Sensitive Information in Apache Tomcat

    Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to i…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2009-0781

    Cross-site scripting in Apache Tomcat

    Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web scri…

    org.apache.tomcat:tomcat Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    http://tomcat.apache.org/security-5.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=427766
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=489028
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=493381
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=503978
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=504153
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=504753
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1164.json
  • report
    https://access.redhat.com/security/cve/CVE-2007-5333
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2007-5333
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2007-5333
  • report
    https://access.redhat.com/security/cve/CVE-2008-5515
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2008-5515
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2008-5515
  • report
    https://access.redhat.com/security/cve/CVE-2009-0033
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-0033
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-0033
  • report
    https://access.redhat.com/security/cve/CVE-2009-0580
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-0580
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-0580
  • report
    https://access.redhat.com/security/cve/CVE-2009-0781
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-0781
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-0781
  • report
    https://access.redhat.com/security/cve/CVE-2009-0783
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2009-0783
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2009-0783