Skip to content
OpenAdvisories
High 2 exploited CVEs RHSA-2017:3080 4 CVEs

Red Hat Security Advisory: tomcat6 security update

Published Sep 16, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 36

ReleasePackageFixed in
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-admin-webapps 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-docs-webapp 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-el-2.1-api 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-javadoc 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-jsp-2.1-api 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-lib 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-servlet-2.5-api 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client tomcat6-webapps 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-admin-webapps 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-docs-webapp 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-el-2.1-api 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-javadoc 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-jsp-2.1-api 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-lib 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-servlet-2.5-api 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode tomcat6-webapps 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-admin-webapps 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-docs-webapp 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-el-2.1-api 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-javadoc 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-jsp-2.1-api 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-lib 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-servlet-2.5-api 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server tomcat6-webapps 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-admin-webapps 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-docs-webapp 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-el-2.1-api 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-javadoc 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-jsp-2.1-api 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-lib 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-servlet-2.5-api 0:6.0.24-111.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation tomcat6-webapps 0:6.0.24-111.el6_9

Vulnerabilities 4

  • High 8.1
    CVE-2017-12615 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

    When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could th…

    Apache Software Foundation Apache Tomcat org.apache.tomcat.embed:tomcat-embed-core Maven
    KEV Mar 25, 2022
  • High 8.1
    CVE-2017-12617 Exploited Public exploit Scanner template EPSS 100%

    Unrestricted Upload of File with Dangerous Type Apache Tomcat

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP fil…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
    KEV Mar 25, 2022
  • High 7.5
    CVE-2017-5647 EPSS 17%

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing …

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  • High 7.5
    CVE-2017-5664 EPSS 17%

    Improper Handling of Exceptional Conditions in Apache Tomcat

    The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is prese…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1441205
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1459158
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1461851
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1493220
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1494283
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3080.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-5647
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-5647
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-5647
  • report
    https://access.redhat.com/security/cve/CVE-2017-5664
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-5664
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-5664
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15
  • report
    https://access.redhat.com/security/cve/CVE-2017-12615
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-12615
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-12615
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81
  • article
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • report
    https://access.redhat.com/security/cve/CVE-2017-12617
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-12617
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-12617
  • article
    https://tomcat.apache.org/security-7.html
  • article
    https://tomcat.apache.org/security-8.html