Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 9 security update

Fixed packages 52

Vulnerabilities 1

• High 7.0
  CVE-2020-9484 Public exploit Scanner template EPSS 56%

  Potential remote code execution in Apache Tomcat

  When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManage…

  tomcat9 tomcat8 tomcat9 tomcat7 Debian Ubuntu Maven
  May 20, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1838332
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2483.json
• report
  https://access.redhat.com/security/cve/CVE-2020-9484
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-9484
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-9484
• article
  http://mail-archives.apache.org/mod_mbox/tomcat-announce/202005.mbox/%3Ce3a0a517-bf82-ba62-0af6-24b83ea0e4e2%40apache.org%3E
• article
  http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M5
• article
  http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.104
• article
  http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.55
• article
  http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.35