Description
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | tomcat5.5 | 5.5.26-5lenny2 | DSA-2207-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.7.el5_3.2 | RHSA-2009:1164 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_18rh | RHSA-2009:1563 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.16 | RHSA-2009:1562 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_16rh | RHSA-2009:1617, RHSA-2009:1616 |
| Red Hat Network Satellite 5 | tomcat5-jasper +4 | 5.5.23-0jpp_18rh | RHSA-2009:1616 |
| Red Hat JBoss Web Server 1 | tomcat5 +10 | 5.5.23-0jpp.9.6.ep5.el5 | RHSA-2009:1454 |
| Red Hat JBoss Web Server 1 | tomcat6 +9 | 6.0.18-11.3.ep5.el4 | RHSA-2009:1506 |
| Red Hat JBoss EAP 4 | glassfish-jaxb +1 | 2.1.4-1.11.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | hibernate3 +1 | 1:3.2.4-1.SP1_CP08.0jpp.ep1.2.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.3.1-1.10.GA_CP01.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hibernate3-commons-annotations +1 | 3.0.0-1jpp.ep1.5.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hibernate3-entitymanager +1 | 3.3.2-2.4.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hibernate3-validator +1 | 3.0.0-1jpp.ep1.8.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | hsqldb | 1:1.8.0.8-2.patch02.1jpp.ep1.2.el4 | RHSA-2009:1146, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jakarta-slide-webdavclient | 2.1-9.2.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jboss-cache | 1.4.1-6.SP13.1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jboss-messaging | 1.4.0-2.SP3_CP08.1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.3-2.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.13.el5 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jbossas +2 | 4.2.0-4.GA_CP07.5.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jbossas-4.3.0.GA_CP05-bin | 4.3.0-4.GA_CP05.6.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jbossts | 1:4.2.3-1.SP5_CP05.1jpp.ep1.1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-6.CP11.0jpp.ep1.1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | jbossws +1 | 2.0.1-3.SP2_CP06.3.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jbossws-common | 1.0.0-2.GA_CP04.1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jbossws-framework | 2.0.1-1.GA_CP04.2.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jbossws-spi | 1.0.0-1.GA_CP02.1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145 |
| Red Hat JBoss EAP 4 | jgroups | 1:2.4.6-1.ep1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-5.GA_CP07.ep1.1.el4 | RHSA-2009:1146, RHSA-2009:1145, RHSA-2009:1144 |
| Red Hat JBoss EAP 4 | xerces-j2 | 2.7.1-9jpp.ep1.2.el4 | RHSA-2009:1146, RHSA-2009:1144 |
| Red Hat Certificate System 7 | ant | 1.6.5-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | avalon-logkit | 1.2-2jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | axis | 1.2.1-1jpp_3rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-jaf | 1.0-2jpp_6rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-mail | 1.1.1-2jpp_8rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | geronimo-specs +10 | 1.0-0.M4.1jpp_10rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | jakarta-commons-modeler | 2.0-3jpp_2rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | log4j | 1.2.12-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | mx4j | 1:3.0.1-1jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | pcsc-lite +2 | 1.3.3-3.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-20.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-java-tools | 7.3.0-10.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-14.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-manage | 7.3.0-19.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-native-tools | 7.3.0-6.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-tks +1 | 7.3.0-13.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.16 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xerces-j2 | 2.7.1-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xml-commons +1 | 1.3.02-2jpp_1rh | RHSA-2010:0602 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 4.1.0, < 4.1.40 | 4.1.40 | GHSA-9737-qmgc-hfr9 |
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, < 5.5.28 | 5.5.28 | GHSA-9737-qmgc-hfr9 |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.20 | 6.0.20 | GHSA-9737-qmgc-hfr9 |
Advisories 13
- RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1164 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2207-1 tomcat5.5 - several Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:1617 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1616 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1563 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1562 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1506 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1454 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1146 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP05 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1145 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP05 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1144 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP07 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1143 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP07 update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://tomcat.apache.org/security-4.html
- HPSBMA02535 vendor-advisory
- 39317 third-party-advisory
- MDVSA-2009:138 vendor-advisory
- ADV-2009-1535 vdb-entry
- FEDORA-2009-11356 vendor-advisory
- DSA-2207 vendor-advisory
- JVN#63832775 third-party-advisory
- HPSBUX02860 vendor-advisory
- 37460 third-party-advisory
- ADV-2010-3056 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 35788 third-party-advisory
- 20090610 [SECURITY] UPDATED CVE-2008-5515 RequestDispatcher directory traversal vulnerability mailing-list
- APPLE-SA-2010-03-29-1 vendor-advisory
- 35263 vdb-entry
- ADV-2009-1520 vdb-entry
- 44183 third-party-advisory
- ADV-2009-1856 vdb-entry
- 20090608 [SECURITY] CVE-2008-5515 RequestDispatcher directory traversal vulnerability mailing-list
- MDVSA-2010:176 vendor-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- 42368 third-party-advisory
- http://tomcat.apache.org/security-6.html
- 35393 third-party-advisory
- http://support.apple.com/kb/HT4077
- SUSE-SR:2010:008 vendor-advisory
- FEDORA-2009-11374 vendor-advisory
- oval:org.mitre.oval:def:6445 vdb-entry signature
- 35685 third-party-advisory
- FEDORA-2009-11352 vendor-advisory
- http://tomcat.apache.org/security-5.html
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-200902e.html
- SUSE-SR:2009:012 vendor-advisory
- HPSBUX02579 vendor-advisory
- MDVSA-2009:136 vendor-advisory
- 263529 vendor-advisory
- oval:org.mitre.oval:def:10422 vdb-entry signature
- oval:org.mitre.oval:def:19452 vdb-entry signature
- ADV-2009-3316 vdb-entry
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list