Description
Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | tomcat4 | 4.0.3-3woody2 | DSA-225 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | < 4.0.6 | 4.0.6 | GHSA-8v5p-2cpv-c2x6 |
Advisories 1
- DSA-225 tomcat4 - source disclosure Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200210-001 vendor-advisory
- http://marc.info/?l=tomcat-dev&m=103417249325526&w=2
- DSA-225 vendor-advisory
- RHSA-2003:075 vendor-advisory
- 6562 vdb-entry
- http://issues.apache.org/bugzilla/show_bug.cgi?id=13365
- RHSA-2003:082 vendor-advisory
- tomcat-invoker-source-code(10376) vdb-entry
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list