Skip to content
OpenAdvisories
High RHSA-2021:0882 2 CVEs

Red Hat Security Advisory: tomcat security update

Published Sep 16, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::computenode tomcat 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::computenode tomcat-admin-webapps 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::computenode tomcat-docs-webapp 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::computenode tomcat-el-2.2-api 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::computenode tomcat-javadoc 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::computenode tomcat-jsp-2.2-api 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::computenode tomcat-jsvc 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::computenode tomcat-lib 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::computenode tomcat-servlet-3.0-api 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::computenode tomcat-webapps 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::server tomcat 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::server tomcat-admin-webapps 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::server tomcat-docs-webapp 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::server tomcat-el-2.2-api 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::server tomcat-javadoc 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::server tomcat-jsp-2.2-api 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::server tomcat-jsvc 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::server tomcat-lib 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::server tomcat-servlet-3.0-api 0:7.0.76-11.el7_6
Red Hat · RHEL 7.6 EUS rhel_eus:7.6::server tomcat-webapps 0:7.0.76-11.el7_6

Vulnerabilities 2

  • High 7.5
    CVE-2019-17563 EPSS 11%

    In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack

    When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • Medium 4.8
    CVE-2020-1935

    Potential HTTP request smuggling in Apache Tomcat

    In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if …

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1785711
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1806835
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0882.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-17563
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-17563
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-17563
  • article
    http://mail-archives.apache.org/mod_mbox/www-announce/201912.mbox/%3C21b7a375-7297-581b-1f8e-06622d36775b@apache.org%3E
  • article
    http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.30
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.99
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.50
  • report
    https://access.redhat.com/security/cve/CVE-2020-1935
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1935
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1935
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51
  • article
    https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31