Description
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | tomcat7 | 7.0.56-3+deb8u2 | DSA-3552-1 |
| Debian 8 | tomcat8 | 8.0.14-1+deb8u2 | DSA-3609-1 |
| Debian 7 | tomcat6 | 6.0.45+dfsg-1~deb7u1 | DSA-3530-1 |
| Debian 7 | tomcat7 | 7.0.28-4+deb7u4 | DSA-3552-1 |
| Debian 6.0 | tomcat6 | 6.0.45-1~deb6u1 | DLA-435-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | tomcat9 | 9.0.16-3~18.04.1 | — |
| Ubuntu 16.04 LTS | tomcat6 | 6.0.45+dfsg-1 | — |
| Ubuntu 16.04 LTS | tomcat7 | 7.0.68-1ubuntu0.1 | USN-3024-1 |
| Ubuntu 14.04 LTS | tomcat6 | 6.0.39-1ubuntu0.1 | — |
| Ubuntu 14.04 LTS | tomcat7 | 7.0.52-1ubuntu0.6 | USN-3024-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | tomcat +9 | 7.0.69-10.el7 | RHSA-2016:2599 |
| RHEL 6 | tomcat6 +8 | 6.0.24-98.el6_8 | RHSA-2016:2045 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 3 | httpd24 +5 | 2.4.6-61.ep7.el6 | RHSA-2016:1088, RHSA-2016:1087 |
| Red Hat JBoss Web Server 3 | mod_security-jws3 | 2.8.0-7.GA.ep7.el6 | RHSA-2016:1088, RHSA-2016:1087 |
| Red Hat JBoss Web Server 3 | mod_ssl24 +1 | 1:2.4.6-61.ep7.el6 | RHSA-2016:1088, RHSA-2016:1087 |
| Red Hat JBoss Web Server 3 | tomcat7 +9 | 7.0.59-50_patch_01.ep7.el6 | RHSA-2016:1088, RHSA-2016:1087 |
| Red Hat JBoss Web Server 3 | tomcat8 +9 | 8.0.18-61_patch_01.ep7.el6 | RHSA-2016:1088, RHSA-2016:1087 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | tomcat | 8.0.32-3.1 | SUSE-SU-2016:0769-1 |
| SLES 12 | tomcat | 7.0.68-7.6.1 | SUSE-SU-2016:0822-1 |
| SLES 11 SP4 | tomcat6 | 6.0.45-0.50.1 | SUSE-SU-2016:0839-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | tomcat | 8.0.32-3.1 | SUSE-SU-2016:0769-1 |
| SLES for SAP 12 | tomcat | 7.0.68-7.6.1 | SUSE-SU-2016:0822-1 |
| SLES for SAP 11 SP4 | tomcat6 | 6.0.45-0.50.1 | SUSE-SU-2016:0839-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tomcat | 8.0.36-3.3 | openSUSE-SU-2024:10446-1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 | openSUSE-SU-2024:13441-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | tomcat +9 | 7.0.69-10.el7 | ELSA-2016-2599 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 9.0.0.M1, < 9.0.0.M2 | 9.0.0.M2 | GHSA-rh8q-vjgf-gf74 |
| Maven | org.apache.tomcat:tomcat | >= 8.0.0-RC1, < 8.0.30 | 8.0.30 | GHSA-rh8q-vjgf-gf74 |
| Maven | org.apache.tomcat:tomcat | >= 7.0.0, < 7.0.68 | 7.0.68 | GHSA-rh8q-vjgf-gf74 |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.45 | 6.0.45 | GHSA-rh8q-vjgf-gf74 |
Advisories 15
- USN-3024-1 tomcat6, tomcat7 vulnerabilities Ubuntu Security Notices (USN) · Oct 17, 2026
- RHSA-2016:2045 Red Hat Security Advisory: tomcat6 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2016:2599 Red Hat Security Advisory: tomcat security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2016:1088 Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2016:1087 Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- DLA-435-1 tomcat6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3530-1 tomcat6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3552-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3609-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2016:0839-1 Security update for tomcat6 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0822-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10446-1 tomcat-8.0.36-3.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0769-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2016-2599 Moderate: tomcat security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 9, 2016
References
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964
- http://svn.apache.org/viewvc?view=revision&revision=1715216
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- GLSA-201705-09 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10156
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
- openSUSE-SU-2016:0865 vendor-advisory
- http://tomcat.apache.org/security-9.html
- http://svn.apache.org/viewvc?view=revision&revision=1715213
- http://packetstormsecurity.com/files/135892/Apache-Tomcat-Directory-Disclosure.html
- USN-3024-1 vendor-advisory
- SUSE-SU-2016:0769 vendor-advisory
- RHSA-2016:2045 vendor-advisory
- DSA-3530 vendor-advisory
- http://tomcat.apache.org/security-7.html
- http://svn.apache.org/viewvc?view=revision&revision=1715206
- HPSBUX03561 vendor-advisory
- RHSA-2016:1089 vendor-advisory
- http://tomcat.apache.org/security-8.html
- http://www.qcsec.com/blog/CVE-2015-5345-apache-tomcat-vulnerability.html
- RHSA-2016:1087 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1035071 vdb-entry
- https://bto.bluecoat.com/security-advisory/sa118
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442
- RHSA-2016:1088 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1717212
- https://security.netapp.com/advisory/ntap-20180531-0001/
- http://tomcat.apache.org/security-6.html
- 20160222 [SECURITY] CVE-2015-5345 Apache Tomcat Directory disclosure mailing-list
- http://svn.apache.org/viewvc?view=revision&revision=1716894
- SUSE-SU-2016:0822 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1717209
- 83328 vdb-entry
- http://svn.apache.org/viewvc?view=revision&revision=1715207
- RHSA-2016:2599 vendor-advisory
- DSA-3609 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1717216
- SUSE-SU-2016:0839 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626
- DSA-3552 vendor-advisory
- 20160225 [CVE-2015-5345] Information disclosure vulnerability in Apache Tomcat mailing-list
- https://bz.apache.org/bugzilla/show_bug.cgi?id=58765
- http://svn.apache.org/viewvc?view=revision&revision=1716882
- [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ mailing-list