Description
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | tomcat | 3.3a-4woody.1 | DSA-246 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | < 3.3.1a | 3.3.1a | GHSA-cvx5-7vc7-rg77 |
Advisories 1
- DSA-246 tomcat - information exposure, cross site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-246 vendor-advisory
- http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
- HPSBUX0303-249 vendor-advisory
- N-060 third-party-advisory government-resource
- http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
- 6722 vdb-entry
- tomcat-webxml-read-files(11195) vdb-entry