Skip to content
OpenAdvisories
Medium CVE-2013-4590 EUVD-2022-3142GHSA-87w9-x2c3-hrjj

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

Published Feb 26, 2014 · Updated Oct 9, 2026 · Assigned by redhat

Package: org.apache.tomcat:tomcat Ecosystem: Maven

Description

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 7 tomcat6 6.0.45+dfsg-1~deb7u1 DSA-3530-1
Debian 6.0 tomcat6 6.0.41-2+squeeze5 DLA-91-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 6 tomcat6 +8 6.0.24-78.el6_5 RHSA-2014:1038
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat JBoss Web Server 2 antlr-eap6 2.7.7-17.redhat_4.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 apache-commons-collections-eap6 +1 3.2.1-15.redhat_3.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 apache-commons-daemon-eap6 1:1.0.15-5.redhat_1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 apache-commons-daemon-jsvc-eap6 1:1.0.15-6.redhat_2.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 apache-commons-logging-eap6 +1 1.1.1-7.9_redhat_1.ep6.el6 RHSA-2014:1087
Red Hat JBoss Web Server 2 apache-commons-pool-eap6 +1 1.6-7.redhat_6.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 dom4j-eap6 1.6.1-20.redhat_6.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 ecj3 1:3.7.2-9.redhat_3.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 hibernate4-eap6 +5 4.2.14-3.SP1_redhat_1.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 httpd +3 2.2.26-35.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 javassist-eap6 3.18.1-1.GA_redhat_1.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 jboss-logging 3.1.4-1.GA_redhat_1.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 jboss-transaction-api_1.1_spec 1.0.1-12.Final_redhat_2.2.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 mod_cluster +2 1.2.9-1.Final_redhat_1.1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 mod_cluster-native 1.2.9-3.Final_redhat_2.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 mod_jk +2 1.2.40-2.redhat_1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 mod_rt 2.4.1-6.GA.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 mod_snmp 2.4.1-13.GA.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 mod_ssl 1:2.2.26-35.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 storeconfig-tc6 0.0.1-7.Alpha3_redhat_12.3.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 storeconfig-tc7 0.0.1-7.Alpha3_redhat_12.5.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 tomcat-native 1.1.30-2.redhat_1.ep6.el5 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 tomcat6 +9 6.0.41-5_patch_02.ep6.el6 RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2 tomcat7 +9 7.0.54-6_patch_02.ep6.el5 RHSA-2014:1088, RHSA-2014:1087

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat < 6.0.39 6.0.39 GHSA-87w9-x2c3-hrjj
Maven org.apache.tomcat:tomcat >= 7.0.0, < 7.0.50 7.0.50 GHSA-87w9-x2c3-hrjj
Maven org.apache.tomcat:tomcat >= 8.0.0-RC1, < 8.0.0-RC10 8.0.0-RC10 GHSA-87w9-x2c3-hrjj

Advisories 5

References