Skip to content
OpenAdvisories
Medium RHSA-2020:5020 1 CVE

Red Hat Security Advisory: tomcat security update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 39

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client tomcat 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-admin-webapps 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-docs-webapp 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-el-2.2-api 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-javadoc 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsp-2.2-api 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-jsvc 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-lib 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-servlet-3.0-api 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::client tomcat-webapps 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-admin-webapps 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-docs-webapp 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-el-2.2-api 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-javadoc 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsp-2.2-api 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-jsvc 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-lib 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::computenode tomcat-webapps 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server tomcat 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-admin-webapps 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-docs-webapp 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-el-2.2-api 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-javadoc 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsp-2.2-api 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-jsvc 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-lib 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-servlet-3.0-api 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::server tomcat-webapps 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-admin-webapps 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-docs-webapp 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-el-2.2-api 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-javadoc 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsp-2.2-api 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-jsvc 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-lib 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-servlet-3.0-api 0:7.0.76-16.el7_9
Red Hat · RHEL 7 enterprise_linux:7::workstation tomcat-webapps 0:7.0.76-16.el7_9

Vulnerabilities 1

  • Medium 4.8
    CVE-2020-1935

    Potential HTTP request smuggling in Apache Tomcat

    In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if …

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1806835
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5020.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-1935
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1935
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1935
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51
  • article
    https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31