Skip to content
OpenAdvisories
High RHSA-2017:0935 2 CVEs

Red Hat Security Advisory: tomcat security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 40

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client tomcat 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-admin-webapps 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-docs-webapp 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-el-2.2-api 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-javadoc 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsp-2.2-api 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsvc 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-lib 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-servlet-3.0-api 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-webapps 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-admin-webapps 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-docs-webapp 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-el-2.2-api 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-javadoc 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsp-2.2-api 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsvc 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-lib 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-servlet-3.0-api 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-webapps 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-admin-webapps 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-docs-webapp 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-el-2.2-api 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-javadoc 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsp-2.2-api 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsvc 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-lib 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-servlet-3.0-api 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-webapps 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-admin-webapps 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-docs-webapp 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-el-2.2-api 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-javadoc 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsp-2.2-api 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsvc 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-lib 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-servlet-3.0-api 0:7.0.69-11.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-webapps 0:7.0.69-11.el7_3

Vulnerabilities 2

  • High 7.5
    CVE-2016-8745 EPSS 16%

    Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat

    A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processo…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.1
    CVE-2016-6816 Public exploit EPSS 40%

    Improper Input Validation in Apache Tomcat

    The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1397484
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1403824
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0935.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-6816
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-6816
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-6816
  • article
    https://access.redhat.com/articles/2991951
  • article
    https://access.redhat.com/solutions/2891171
  • article
    https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8
  • report
    https://access.redhat.com/security/cve/CVE-2016-8745
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-8745
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-8745
  • article
    https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.9