Apache Tomcat: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 8.1
  CVE-2017-12615 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

  When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could th…

  Apache Software Foundation Apache Tomcat org.apache.tomcat.embed:tomcat-embed-core Maven
  Sep 19, 2017

  KEV Mar 25, 2022
• High 7.5
  CVE-2017-12616 EPSS 70%

  Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

  When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

  Apache Software Foundation Apache Tomcat tomcat7 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  Sep 19, 2017

Revision history

1. 2025-02-20 #15

   Neue Updates von Ubuntu aufgenommen

2. 2021-03-31 #14

   Neue Updates von HPE aufgenommen

3. 2019-08-22 #13

   Neue Updates von Symantec aufgenommen

4. 2018-03-07 #12

   New remediations available

5. 2018-02-05 #11

   New remediations available

6. 2017-12-07 #10

   New remediations available

7. 2017-11-23 #9

   New remediations available

8. 2017-11-02 #8

   New remediations available

9. 2017-10-31 #7

   New remediations available

10. 2017-10-25 #6

    Added references

11. 2017-10-24 #4

    New remediations available

12. 2017-10-24 #5

    Version nicht vorhanden

13. 2017-10-03 #2

    PoC added

14. 2017-10-03 #3

    Version nicht vorhanden

15. 2017-09-19 #1

    Initial Release

References

• National Vulnerability Database vom 2017-09-19
  https://nvd.nist.gov/vuln/detail/CVE-2017-12615
• National Vulnerability Database vom 2017-09-19
  https://nvd.nist.gov/vuln/detail/CVE-2017-12616
• Exploit-DB Advisory 42953 vom 2017-10-03
  https://www.exploit-db.com/exploits/42953
• Oracle Linux Security Advisory ELSA-2017-3081 vom 2017-10-30
  http://linux.oracle.com/errata/ELSA-2017-3081.html
• Oracle Linux Security Advisory ELSA-2017-3080 vom 2017-10-30
  http://linux.oracle.com/errata/ELSA-2017-3080.html
• Red Hat Security Advisory RHSA-2017:3081 vom 2017-10-30
  https://access.redhat.com/errata/RHSA-2017:3081
• Red Hat Security Advisory RHSA-2017:3080 vom 2017-10-30
  https://access.redhat.com/errata/RHSA-2017:3080
• CentOS Security Advisory CESA-2017:3081 vom 2017-10-30
  https://lwn.net/Alerts/737719
• CentOS Security Advisory CESA-2017:3080 vom 2017-10-30
  https://lwn.net/Alerts/737720
• Red Hat Security Advisory RHSA-2017:3114 vom 2017-11-02
  https://access.redhat.com/errata/RHSA-2017:3114
• Red Hat Security Advisory RHSA-2017:3113 vom 2017-11-02
  https://access.redhat.com/errata/RHSA-2017:3113
• SUSE Security Update SUSE-SU-2017:3059-1 vom 2017-11-24
  https://www.suse.com/support/update/announcement/2017/suse-su-20173059-1.html
• McAfee Security Bulletin SB10218
  https://kc.mcafee.com/corporate/index?page=content&id=SB10218
• Red Hat Security Advisory RHSA-2018:0275 vom 2018-02-05
  https://access.redhat.com/errata/RHSA-2018:0275
• Red Hat Security Advisory RHSA-2018:0466 vom 2018-03-07
  https://access.redhat.com/errata/RHSA-2018:0466
• Red Hat Security Advisory RHSA-2018:0465 vom 2018-03-07
  https://access.redhat.com/errata/RHSA-2018:0465
• Symantec Securtity Advisory SYMSA1419
  https://support.symantec.com/us/en/article.SYMSA1419.html
• HPE Security Bulletin HPESBUX04114 vom 2021-03-31
  https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbux04114en_us
• Ubuntu Security Notice USN-7282-1 vom 2025-02-21
  https://ubuntu.com/security/notices/USN-7282-1