Description
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | tomcat8 | 8.5.50-0+deb9u1 | DSA-4596-1 |
| Debian 8 | tomcat7 | 7.0.56-3+really7.0.88-1 | DLA-1400-1 |
| Debian 8 | tomcat8 | 8.0.14-1+deb8u15 | DLA-1883-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | tomcat8 | 8.5.30-1ubuntu1.2 | USN-3665-1 |
| Ubuntu 16.04 LTS | tomcat8 | 8.0.32-1ubuntu1.6 | USN-3665-1 |
| Ubuntu 14.04 LTS | tomcat7 | 7.0.52-1ubuntu0.14 | USN-3665-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | tomcat7 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | apache-commons-collections | 3.2.2-10.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | apache-commons-lang | 2.6-21.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | bea-stax +1 | 1.2.0-16.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | glassfish-jaxb +3 | 2.2.11-11.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | jackson-core +4 | 2.9.8-1.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | javassist +1 | 3.18.1-8.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | pki-servlet-4.0-api +1 | 1:9.0.7-14.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | python-nss +2 | 1.0.1-10.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | relaxngDatatype | 2011.1-7.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | resteasy | 3.0.26-3.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | slf4j +1 | 1.7.25-4.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | stax-ex | 1.7.7-8.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | velocity | 1.7-24.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | xalan-j2 | 2.7.1-38.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | xerces-j2 | 2.11.0-34.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | xml-commons-apis | 1.4.01-25.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | xml-commons-resolver | 1.2-26.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | xmlstreambuffer | 1.5.4-8.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | xsom | 0-19.20110809svn.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 7 | tomcat +9 | 7.0.76-9.el7 | RHSA-2019:2205 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 5 | jws5-ecj | 4.6.1-6.redhat_1.1.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 5 | jws5-javapackages-tools +1 | 3.4.1-5.15.10.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 5 | jws5-jboss-logging | 3.3.1-5.Final_redhat_1.1.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 5 | jws5-mod_cluster +1 | 1.4.0-9.Final_redhat_1.1.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 5 | jws5-tomcat +10 | 9.0.7-17.redhat_16.1.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 5 | jws5-tomcat-native | 1.2.17-26.redhat_26.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 5 | jws5-tomcat-vault +1 | 1.1.7-5.Final_redhat_2.1.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.17-17.redhat_17.ep7.el6 | RHSA-2018:2469 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-27.ep7.el6 | RHSA-2018:2469 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-31.ep7.el6 | RHSA-2018:2469 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | apache-commons-collections | 3.2.2-10.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | apache-commons-lang | 2.6-21.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | bea-stax-api | 1.2.0-16.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | glassfish-fastinfoset | 1.2.13-9.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | glassfish-jaxb-api | 2.2.12-8.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | glassfish-jaxb-core +2 | 2.2.11-11.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | jakarta-commons-httpclient | 1:3.1-28.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | javassist +1 | 3.18.1-8.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | python3-nss +1 | 1.0.1-10.module_el8.5.0+150+5f0dbea0.alma | ALSA-2019:1529 |
| AlmaLinux 8 | relaxngDatatype | 2011.1-7.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | slf4j | 1.7.25-4.module_el8.5.0+2577+9e95fe00 | ALSA-2019:1529 |
| AlmaLinux 8 | slf4j-jdk14 | 1.7.25-4.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | stax-ex | 1.7.7-8.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | velocity | 1.7-24.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | xalan-j2 | 2.7.1-38.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | xerces-j2 | 2.11.0-34.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | xml-commons-apis | 1.4.01-25.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | xml-commons-resolver | 1.2-26.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | xmlstreambuffer | 1.5.4-8.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | xsom | 0-19.20110809svn.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | apache-commons-lang | 2.6-21.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | bea-stax | 1.2.0-16.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | glassfish-jaxb | 2.2.11-11.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | javassist | 3.18.1-8.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | python-nss | 1.0.1-10.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | relaxngDatatype | 2011.1-7.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | resteasy | 3.0.26-3.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | slf4j | 1.7.25-4.module+el8.3.0+74+855e3f5d | RLSA-2019:1529 |
| Rocky Linux 8 | stax-ex | 1.7.7-8.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | velocity | 1.7-24.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | xalan-j2 | 2.7.1-38.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | xerces-j2 | 2.11.0-34.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | xml-commons-resolver | 1.2-26.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | xsom | 0-19.20110809svn.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | tomcat | 9.0.10-3.7.1 | SUSE-SU-2018:3011-1 |
| SLES 12 SP3 | tomcat | 8.0.53-29.13.1 | SUSE-SU-2018:2699-1 |
| SLES 12 SP1 | tomcat | 8.0.53-10.35.1 | SUSE-SU-2018:3388-1 |
| SLES 12 | tomcat | 7.0.90-7.23.1 | SUSE-SU-2018:3261-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP3 | tomcat | 8.0.53-29.13.1 | SUSE-SU-2018:2699-1 |
| SLES for SAP 12 SP1 | tomcat | 8.0.53-10.35.1 | SUSE-SU-2018:3388-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tomcat | 9.0.36-8.4 | openSUSE-SU-2024:11468-1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 | openSUSE-SU-2024:13441-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | tomcat +9 | 7.0.76-10.amzn2.0.1 | ALAS2-2020-1402 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | apache-commons-lang | 2.6-21.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | bea-stax-api | 1.2.0-16.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | glassfish-jaxb-core +2 | 2.2.11-11.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | jackson-core +4 | 2.9.8-1.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | javassist +1 | 3.18.1-8.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | pki-servlet-4.0-api +1 | 1:9.0.7-14.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | python3-nss +1 | 1.0.1-10.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | relaxngDatatype | 2011.1-7.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | resteasy | 3.0.26-3.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | slf4j +1 | 1.7.25-4.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | stax-ex | 1.7.7-8.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | velocity | 1.7-24.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | xalan-j2 | 2.7.1-38.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | xerces-j2 | 2.11.0-34.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | xml-commons-resolver | 1.2-26.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | xsom | 0-19.20110809svn.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 7 | tomcat +9 | 7.0.76-9.el7 | ELSA-2019-2205 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 9.0.0.M1, < 9.0.9 | 9.0.9 | GHSA-r4x2-3cq5-hqvp |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 8.5.0, < 8.5.32 | 8.5.32 | GHSA-r4x2-3cq5-hqvp |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 8.0.0RC1, < 8.0.53 | 8.0.53 | GHSA-r4x2-3cq5-hqvp |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 7.0.41, < 7.0.88 | 7.0.88 | GHSA-r4x2-3cq5-hqvp |
Advisories 22
- ALSA-2019:1529 Important: pki-deps:10.6 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2019:2205 Red Hat Security Advisory: tomcat security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1529 Red Hat Security Advisory: pki-deps:10.6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:0451 Red Hat Security Advisory: Red Hat JBoss Web Server 5.0 Service Pack 2 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2026-2609 Apache Tomcat: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Aug 2, 2026
- RHSA-2018:2469 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 4 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-3665-1 tomcat7, tomcat8 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4596-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1883-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1400-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2019:1529 Important: pki-deps:10.6 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2018:3261-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3388-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2699-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3011-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11468-1 tomcat-9.0.36-8.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- ICSMA-21-187-01 Philips Vue PACS (Update B) CISA ICS & IT advisories · Apr 5, 2022
- ALAS2-2020-1402 Important: tomcat security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 28, 2021
- ELSA-2019-2205 Moderate: tomcat security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 13, 2019
- ELSA-2019-1529 Important: pki-deps:10.6 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 30, 2019
References
- http://tomcat.apache.org/security-9.html
- RHSA-2019:0451 vendor-advisory
- http://tomcat.apache.org/security-7.html
- RHSA-2018:2469 vendor-advisory
- 1041888 vdb-entry
- USN-3665-1 vendor-advisory
- http://tomcat.apache.org/security-8.html
- RHSA-2018:2470 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://security.netapp.com/advisory/ntap-20181018-0002/
- RHSA-2019:0450 vendor-advisory
- https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update mailing-list
- 104203 vdb-entry
- 1040998 vdb-entry
- RHSA-2018:3768 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- RHSA-2019:1529 vendor-advisory
- [activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars. mailing-list
- RHSA-2019:2205 vendor-advisory
- [debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update mailing-list
- DSA-4596 vendor-advisory
- 20191229 [SECURITY] [DSA 4596-1] tomcat8 security update mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html