Skip to content
OpenAdvisories
High USN-4128-2 2 CVEs

tomcat9 vulnerabilities

Published Sep 18, 2019 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the Tomcat 9 SSI printenv command echoed user
provided data without escaping it. An attacker could possibly use this
issue to perform an XSS attack. (CVE-2019-0221)

It was discovered that Tomcat 9 did not address HTTP/2 connection window
exhaustion on write while addressing CVE-2019-0199. An attacker could
possibly use this issue to cause a denial of service. (CVE-2019-10072)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS tomcat9 9.0.16-3ubuntu0.18.04.1

Vulnerabilities 2

  • High 7.5
    CVE-2019-10072 EPSS 73%

    Improper Locking in Apache Tomcat

    The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients wer…

    tomcat8 tomcat9 tomcat9 org.apache.tomcat.embed:tomcat-embed-core Debian Ubuntu Maven
  • Medium 6.1
    CVE-2019-0221 Public exploit Scanner template EPSS 58%

    Cross-site scripting in Apache Tomcat

    The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and…

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2019-0221
  • report
    https://ubuntu.com/security/CVE-2019-10072