Skip to content
OpenAdvisories
Medium · 5.3 CVE-2017-15706 EUVD-2022-2123GHSA-372q-33vh-8mpc

Inconsistent documentation in Apache Tomcat

Published Jan 31, 2018 · Updated Sep 16, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat Ecosystem: Maven

Description

As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47, 7.0.79 to 7.0.82 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS tomcat8 8.5.30-1ubuntu1.2 USN-3665-1
Ubuntu 16.04 LTS tomcat8 8.0.32-1ubuntu1.6 USN-3665-1
Ubuntu 14.04 LTS tomcat7 7.0.52-1ubuntu0.14 USN-3665-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP3 tomcat 8.0.50-29.8.2 SUSE-SU-2018:0817-1
SLES 12 SP2 tomcat 8.0.50-29.8.2 SUSE-SU-2018:0817-1
SLES 12 SP1 tomcat 8.0.53-10.35.1 SUSE-SU-2018:3388-1
SLES 12 tomcat 7.0.90-7.23.1 SUSE-SU-2018:3261-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP3 tomcat 8.0.50-29.8.2 SUSE-SU-2018:0817-1
SLES for SAP 12 SP2 tomcat 8.0.50-29.8.2 SUSE-SU-2018:0817-1
SLES for SAP 12 SP1 tomcat 8.0.53-10.35.1 SUSE-SU-2018:3388-1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat >= 9.0.0.M22, < 9.0.2 9.0.2 GHSA-372q-33vh-8mpc
Maven org.apache.tomcat:tomcat >= 8.5.16, < 8.5.24 8.5.24 GHSA-372q-33vh-8mpc
Maven org.apache.tomcat:tomcat >= 8.0.45, < 8.0.48 8.0.48 GHSA-372q-33vh-8mpc
Maven org.apache.tomcat:tomcat >= 7.0.79, < 7.0.84 7.0.84 GHSA-372q-33vh-8mpc

Advisories 4

References