Skip to content
OpenAdvisories
High 2 exploited CVEs RHSA-2017:3081 4 CVEs

Red Hat Security Advisory: tomcat security update

Published Sep 16, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 40

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client tomcat 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-admin-webapps 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-docs-webapp 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-el-2.2-api 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-javadoc 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsp-2.2-api 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsvc 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-lib 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-servlet-3.0-api 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-webapps 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-admin-webapps 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-docs-webapp 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-el-2.2-api 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-javadoc 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsp-2.2-api 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsvc 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-lib 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-servlet-3.0-api 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-webapps 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server tomcat 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-admin-webapps 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-docs-webapp 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-el-2.2-api 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-javadoc 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsp-2.2-api 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsvc 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-lib 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-servlet-3.0-api 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-webapps 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-admin-webapps 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-docs-webapp 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-el-2.2-api 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-javadoc 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsp-2.2-api 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsvc 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-lib 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-servlet-3.0-api 0:7.0.76-3.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-webapps 0:7.0.76-3.el7_4

Vulnerabilities 4

  • High 8.1
    CVE-2017-12615 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

    When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could th…

    Apache Software Foundation Apache Tomcat org.apache.tomcat.embed:tomcat-embed-core Maven
    KEV Mar 25, 2022
  • High 8.1
    CVE-2017-12617 Exploited Public exploit Scanner template EPSS 100%

    Unrestricted Upload of File with Dangerous Type Apache Tomcat

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP fil…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
    KEV Mar 25, 2022
  • High 7.5
    CVE-2017-5647 EPSS 17%

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing …

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  • Medium 4.3
    CVE-2017-7674

    Insufficient Verification of Data Authenticity in Apache Tomcat

    The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1441205
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1480618
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1493220
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1494283
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3081.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-5647
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-5647
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-5647
  • report
    https://access.redhat.com/security/cve/CVE-2017-7674
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-7674
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-7674
  • article
    https://tomcat.apache.org/security-7.html
  • article
    https://tomcat.apache.org/security-8.html
  • report
    https://access.redhat.com/security/cve/CVE-2017-12615
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-12615
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-12615
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81
  • article
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • report
    https://access.redhat.com/security/cve/CVE-2017-12617
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-12617
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-12617