Skip to content
OpenAdvisories
Unscored RHSA-2014:0686 3 CVEs

Red Hat Security Advisory: tomcat security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 40

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client tomcat 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-admin-webapps 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-docs-webapp 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-el-2.2-api 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-javadoc 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsp-2.2-api 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsvc 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-lib 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-servlet-3.0-api 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-webapps 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-admin-webapps 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-docs-webapp 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-el-2.2-api 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-javadoc 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsp-2.2-api 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsvc 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-lib 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-servlet-3.0-api 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-webapps 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::server tomcat 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-admin-webapps 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-docs-webapp 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-el-2.2-api 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-javadoc 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsp-2.2-api 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsvc 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-lib 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-servlet-3.0-api 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-webapps 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-admin-webapps 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-docs-webapp 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-el-2.2-api 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-javadoc 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsp-2.2-api 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsvc 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-lib 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-servlet-3.0-api 0:7.0.42-5.el7_0
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-webapps 0:7.0.42-5.el7_0

Vulnerabilities 3

  • Medium —
    CVE-2013-4286 EPSS 16%

    Apache Tomcat is vulnerable to HTTP request-smuggling

    Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2013-4322 Public exploit

    Apache Tomcat Denial of Service vulnerability

    Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which a…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2014-0186

    A certain tomcat7 package for Apache Tomcat 7 in Red Hat Enterprise Linux (RHEL) 7 allows remote attackers to cause a d…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1069905
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1069921
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1089884
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0686.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-4286
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4286
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4286
  • report
    https://access.redhat.com/security/cve/CVE-2013-4322
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4322
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4322
  • report
    https://access.redhat.com/security/cve/CVE-2014-0186
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0186
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0186