Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 | jbossweb | 0:7.5.30-2.Final_redhat_2.1.ep6.el5 |
| Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 | jbossweb | 0:7.5.30-2.Final_redhat_2.1.ep6.el6 |
| Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el7 | jbossweb | 0:7.5.30-2.Final_redhat_2.1.ep6.el7 |
Vulnerabilities 1
-
Critical 9.8
Improper Privilege Management in Tomcat
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…
KEV Mar 3, 2022
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
article
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/6.4/
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1806398
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1478.json
-
report
https://access.redhat.com/security/cve/CVE-2020-1938
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-1938
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-1938
-
article
https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/
-
article
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100
-
article
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51
-
article
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31
-
article
https://www.cnvd.org.cn/webinfo/show/5415
-
article
https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487
-
article
https://www.cisa.gov/known-exploited-vulnerabilities-catalog