Skip to content
OpenAdvisories
Critical RHSA-2017:1809 2 CVEs

Red Hat Security Advisory: tomcat security update

Published Sep 16, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 40

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client tomcat 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-admin-webapps 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-docs-webapp 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-el-2.2-api 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-javadoc 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsp-2.2-api 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsvc 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-lib 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-servlet-3.0-api 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-webapps 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-admin-webapps 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-docs-webapp 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-el-2.2-api 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-javadoc 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsp-2.2-api 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsvc 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-lib 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-servlet-3.0-api 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-webapps 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-admin-webapps 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-docs-webapp 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-el-2.2-api 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-javadoc 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsp-2.2-api 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsvc 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-lib 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-servlet-3.0-api 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-webapps 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-admin-webapps 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-docs-webapp 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-el-2.2-api 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-javadoc 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsp-2.2-api 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsvc 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-lib 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-servlet-3.0-api 0:7.0.69-12.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-webapps 0:7.0.69-12.el7_3

Vulnerabilities 2

  • Critical 9.1
    CVE-2017-5648 EPSS 13%

    Exposure of Resource to Wrong Sphere in Apache Tomcat

    While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted appli…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.5
    CVE-2017-5664 EPSS 17%

    Improper Handling of Exceptional Conditions in Apache Tomcat

    The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is prese…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1441223
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1459158
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1809.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-5648
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-5648
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-5648
  • report
    https://access.redhat.com/security/cve/CVE-2017-5664
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-5664
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-5664
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15