Skip to content
OpenAdvisories
Critical RHSA-2019:2205 4 CVEs

Red Hat Security Advisory: tomcat security, bug fix, and enhancement update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 40

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client tomcat 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-admin-webapps 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-docs-webapp 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-el-2.2-api 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-javadoc 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsp-2.2-api 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsvc 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-lib 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-servlet-3.0-api 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-webapps 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-admin-webapps 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-docs-webapp 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-el-2.2-api 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-javadoc 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsp-2.2-api 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsvc 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-lib 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-servlet-3.0-api 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-webapps 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-admin-webapps 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-docs-webapp 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-el-2.2-api 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-javadoc 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsp-2.2-api 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsvc 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-lib 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-servlet-3.0-api 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-webapps 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-admin-webapps 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-docs-webapp 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-el-2.2-api 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-javadoc 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsp-2.2-api 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsvc 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-lib 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-servlet-3.0-api 0:7.0.76-9.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-webapps 0:7.0.76-9.el7

Vulnerabilities 4

  • Critical 9.8
    CVE-2018-8014 EPSS 21%

    The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins

    The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.5
    CVE-2018-8034 EPSS 21%

    The host name verification missing in Apache Tomcat

    The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • Medium 6.5
    CVE-2018-1305 Public exploit EPSS 14%

    Apache Tomcat information exposure vulnerability

    Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to th…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • Medium 5.9
    CVE-2018-1304 Public exploit EPSS 17%

    Apache Tomcat unauthorized access vulnerability

    The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1472950
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1548282
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1548289
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1579611
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1588703
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1607580
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2205.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-1304
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-1304
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-1304
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.85
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.50
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.28
  • report
    https://access.redhat.com/security/cve/CVE-2018-1305
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-1305
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-1305
  • report
    https://access.redhat.com/security/cve/CVE-2018-8014
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-8014
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-8014
  • article
    http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.89
  • article
    http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.53
  • article
    http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32
  • article
    http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.9
  • report
    https://access.redhat.com/security/cve/CVE-2018-8034
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-8034
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-8034