Skip to content
OpenAdvisories
Critical 1 exploited CVE RHSA-2020:0855 1 CVE

Red Hat Security Advisory: tomcat security update

Published Sep 16, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 40

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client tomcat 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-admin-webapps 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-docs-webapp 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-el-2.2-api 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-javadoc 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsp-2.2-api 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsvc 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-lib 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-servlet-3.0-api 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-webapps 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-admin-webapps 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-docs-webapp 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-el-2.2-api 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-javadoc 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsp-2.2-api 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsvc 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-lib 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-servlet-3.0-api 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-webapps 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-admin-webapps 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-docs-webapp 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-el-2.2-api 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-javadoc 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsp-2.2-api 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsvc 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-lib 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-servlet-3.0-api 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-webapps 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-admin-webapps 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-docs-webapp 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-el-2.2-api 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-javadoc 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsp-2.2-api 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsvc 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-lib 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-servlet-3.0-api 0:7.0.76-11.el7_7
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-webapps 0:7.0.76-11.el7_7

Vulnerabilities 1

  • Critical 9.8
    CVE-2020-1938 Exploited Public exploit Scanner template EPSS 99%

    Improper Privilege Management in Tomcat

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…

    Apache Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
    KEV Mar 3, 2022

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1806398
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0855.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-1938
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1938
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1938
  • article
    https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51
  • article
    https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31
  • article
    https://www.cnvd.org.cn/webinfo/show/5415
  • article
    https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487
  • article
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog