Description
The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | tomcat5.5 | 5.5.20-2etch1 | DSA-1447-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.3.0.3.el5_1 | RHSA-2008:0042 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_11rh | RHSA-2008:0195 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.9 | RHSA-2008:0862 |
| Red Hat JBoss EAP 4 | glassfish-jaf | 1.1.0-0jpp.ep1.12.el5.1 | RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | glassfish-javamail | 1.4.0-0jpp.ep1.10.el4 | RHSA-2008:0833, RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | glassfish-jaxb +1 | 2.1.4-1jpp.ep1.2.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | glassfish-jaxws | 2.1.1-1jpp.ep1.3.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | glassfish-jstl | 1.2.0-0jpp.ep1.10.el5 | RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | hibernate3 +1 | 1:3.2.4-1.SP1_CP04.0jpp.ep1.3.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.2.1-4.GA_CP02.1jpp.ep1.7.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | hibernate3-commons-annotations | 0.0.0-1.1jpp.ep1.1.el5 | RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | hibernate3-entitymanager +1 | 3.2.1-2.GA_CP03.1jpp.ep1.9.el5 | RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | hibernate3-validator | 0.0.0-1.1jpp.ep1.1.el4 | RHSA-2008:0833, RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | javassist | 3.8.0-1.ep1.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | jboss-aop | 1.5.5-2.CP02.0jpp.ep1.2.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jboss-jaxr | 1.2.0-SP1.0jpp.ep1.4.el5 | RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jboss-messaging | 1.4.0-1.SP3_CP03.0jpp.ep1.3.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.2-3.SP9.0jpp.ep1.1.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.9.el5 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jbossas | 4.2.0-3.GA_CP04.ep1.8.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jbossts | 1:4.2.3-1.SP5_CP02.1jpp.ep1.1.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-4.CP06.0jpp.ep1.1.el4 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | jbossws | 2.0.1-2.SP2_CP03.0jpp.ep1.1.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | jbossws-common | 1.0.0-1.GA_CP01.0jpp.ep1.3.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | jbossws-framework | 2.0.1-0jpp.ep1.11.el4 | RHSA-2008:0832, RHSA-2008:0831 |
| Red Hat JBoss EAP 4 | jbossxb | 1.0.0-2.SP3.0jpp.ep1.3.el5.1 | RHSA-2008:0832 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-4.GA_CP04.ep1.3.el5 | RHSA-2008:0834, RHSA-2008:0833, RHSA-2008:0832 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat-juli | >= 5.5.9, <= 5.5.25 | — | GHSA-w65j-cmqc-37p2 |
| Maven | org.apache.tomcat:tomcat-juli | >= 6.0.0, <= 6.0.15 | — | GHSA-w65j-cmqc-37p2 |
Advisories 8
- RHSA-2008:0042 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1447-1 tomcat5.5 several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2008:0862 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0834 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP04 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0833 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0CP04 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0831 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0CP02 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0832 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0CP02 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0195 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 30676 third-party-advisory
- RHSA-2008:0862 vendor-advisory
- 28915 third-party-advisory
- ADV-2008-2823 vdb-entry
- oval:org.mitre.oval:def:10417 vdb-entry signature
- 37460 third-party-advisory
- 29313 third-party-advisory
- 31681 vdb-entry
- 32120 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- RHSA-2008:0042 vendor-advisory
- 28274 third-party-advisory
- MDVSA-2008:188 vendor-advisory
- 28317 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm
- 3485 third-party-advisory
- 20071223 [CVE-2007-5342] Apache Tomcat's default security policy is too open mailing-list
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- SUSE-SR:2009:004 vendor-advisory
- http://tomcat.apache.org/security-6.html
- RHSA-2008:0832 vendor-advisory
- 57126 third-party-advisory
- 32222 third-party-advisory
- RHSA-2008:0195 vendor-advisory
- FEDORA-2008-1467 vendor-advisory
- GLSA-200804-10 vendor-advisory
- apache-juli-logging-weak-security(39201) vdb-entry
- http://svn.apache.org/viewvc?view=rev&revision=606594
- RHSA-2008:0833 vendor-advisory
- FEDORA-2008-1603 vendor-advisory
- ADV-2008-1856 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2008-0010.html
- http://tomcat.apache.org/security-5.html
- 39833 vdb-entry
- ADV-2008-0013 vdb-entry
- ADV-2008-2780 vdb-entry
- RHSA-2008:0831 vendor-advisory
- 27006 vdb-entry
- RHSA-2008:0834 vendor-advisory
- DSA-1447 vendor-advisory
- HPSBST02955 vendor-advisory
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- 29711 third-party-advisory
- ADV-2009-3316 vdb-entry
- 32266 third-party-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list