Summary
It was discovered that Tomcat incorrectly handled certain uncommon
PersistenceManager with FileStore configurations. A remote attacker could
possibly use this issue to execute arbitrary code. This issue only affected
tomcat8 for Ubuntu 18.04 LTS (CVE-2020-9484)
It was discovered that Tomcat incorrectly handled certain HTTP/2 connection
requests. A remote attacker could use this issue to obtain wrong responses
possibly containing sensitive information. This issue only affected tomcat8
for Ubuntu 18.04 LTS (CVE-2021-25122)
Thomas Wozenilek discovered that Tomcat incorrectly handled certain TLS
packets. A remote attacker could possibly use this issue to cause a denial
of service. This issue only affected tomcat8 for Ubuntu 18.04 LTS
(CVE-2021-41079)
Trung Pham discovered that a race condition existed in Tomcat when handling
session files with FileStore. A remote attacker could possibly use this
issue to execute arbitrary code. This issue affected tomcat8 for Ubuntu
16.04 LTS and Ubuntu 18.04 LTS, and tomcat9 for Ubuntu 18.04 LTS and Ubuntu
20.04 LTS (CVE-2022-23181)
It was discovered that Tomcat's documentation incorrectly stated that
EncryptInterceptor provided availability protection when running over an
untrusted network. A remote attacker could possibly use this issue to cause
a denial of service even if EncryptInterceptor was being used. This issue
affected tomcat8 for Ubuntu 18.04 LTS, and tomcat9 for Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS (CVE-2022-29885)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | tomcat9 | 9.0.31-1ubuntu0.6 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | tomcat8 | 8.0.32-1ubuntu1.13+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | tomcat8 | 8.5.39-1ubuntu1~18.04.3+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | tomcat9 | 9.0.16-3ubuntu0.18.04.2+esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | tomcat9 | 9.0.58-1ubuntu0.1+esm2 |
Vulnerabilities 5
-
High 7.5CVE-2021-25122 EPSS 18%
Apache Tomcat h2c request mix-up
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could…
-
High 7.5
Apache Tomcat DoS with unexpected TLS packet
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite lo…
-
High 7.5
EncryptInterceptor does not provide complete protection on insecure networks
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While th…
-
High 7.0
Potential remote code execution in Apache Tomcat
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManage…
-
High 7.0
Local privilege escalation with FileStore
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of …