Skip to content
OpenAdvisories
High RHSA-2014:0429 3 CVEs

Red Hat Security Advisory: tomcat6 security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 36

ReleasePackageFixed in
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-admin-webapps 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-docs-webapp 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-el-2.1-api 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-javadoc 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-jsp-2.1-api 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-lib 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-servlet-2.5-api 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-webapps 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-admin-webapps 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-docs-webapp 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-el-2.1-api 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-javadoc 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-jsp-2.1-api 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-lib 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-servlet-2.5-api 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-webapps 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-admin-webapps 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-docs-webapp 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-el-2.1-api 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-javadoc 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-jsp-2.1-api 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-lib 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-servlet-2.5-api 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-webapps 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-admin-webapps 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-docs-webapp 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-el-2.1-api 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-javadoc 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-jsp-2.1-api 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-lib 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-servlet-2.5-api 0:6.0.24-64.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-webapps 0:6.0.24-64.el6_5

Vulnerabilities 3

  • High 7.5
    CVE-2014-0050 Public exploit EPSS 83%

    Commons FileUpload Denial of service vulnerability

    MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a…

    org.apache.tomcat:tomcat commons-fileupload:commons-fileupload libcommons-fileupload-java Debian Maven
  • Medium —
    CVE-2013-4286 EPSS 16%

    Apache Tomcat is vulnerable to HTTP request-smuggling

    Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2013-4322 Public exploit

    Apache Tomcat Denial of Service vulnerability

    Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which a…

    org.apache.tomcat:tomcat Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://tomcat.apache.org/security-6.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1062337
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1069905
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1069921
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0429.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-4286
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4286
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4286
  • report
    https://access.redhat.com/security/cve/CVE-2013-4322
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4322
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4322
  • report
    https://access.redhat.com/security/cve/CVE-2014-0050
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0050
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0050