Skip to content
OpenAdvisories
High RHSA-2014:0525 4 CVEs

Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 tomcat6 security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6 0:6.0.37-19_patch_04.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-admin-webapps 0:6.0.37-19_patch_04.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-docs-webapp 0:6.0.37-19_patch_04.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-el-2.1-api 0:6.0.37-19_patch_04.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-javadoc 0:6.0.37-19_patch_04.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-jsp-2.1-api 0:6.0.37-19_patch_04.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-lib 0:6.0.37-19_patch_04.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-log4j 0:6.0.37-19_patch_04.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-servlet-2.5-api 0:6.0.37-19_patch_04.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el5 tomcat6-webapps 0:6.0.37-19_patch_04.ep6.el5
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6 0:6.0.37-27_patch_04.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-admin-webapps 0:6.0.37-27_patch_04.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-docs-webapp 0:6.0.37-27_patch_04.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-el-2.1-api 0:6.0.37-27_patch_04.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-javadoc 0:6.0.37-27_patch_04.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-jsp-2.1-api 0:6.0.37-27_patch_04.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-lib 0:6.0.37-27_patch_04.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-log4j 0:6.0.37-27_patch_04.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-servlet-2.5-api 0:6.0.37-27_patch_04.ep6.el6
Red Hat · JBoss Web Server 2 jboss_enterprise_web_server:2::el6 tomcat6-webapps 0:6.0.37-27_patch_04.ep6.el6

Vulnerabilities 4

  • High 7.5
    CVE-2014-0050 Public exploit EPSS 83%

    Commons FileUpload Denial of service vulnerability

    MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a…

    org.apache.tomcat:tomcat commons-fileupload:commons-fileupload libcommons-fileupload-java Debian Maven
  • Medium —
    CVE-2013-4286 EPSS 16%

    Apache Tomcat is vulnerable to HTTP request-smuggling

    Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2013-4322 Public exploit

    Apache Tomcat Denial of Service vulnerability

    Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which a…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2014-0033

    Improper Input Validation in Apache Tomcat

    org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.

    org.apache.tomcat:tomcat Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1062337
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1069905
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1069919
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1069921
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0525.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-4286
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4286
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4286
  • report
    https://access.redhat.com/security/cve/CVE-2013-4322
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4322
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4322
  • report
    https://access.redhat.com/security/cve/CVE-2014-0033
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0033
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0033
  • article
    https://access.redhat.com/site/solutions/88203
  • report
    https://access.redhat.com/security/cve/CVE-2014-0050
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0050
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0050