Description
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.35 to 7.0.88 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | tomcat8 | 8.5.14-1+deb9u3 | DSA-4281-1 |
| Debian 8 | tomcat7 | 7.0.56-3+really7.0.90-1 | DLA-1453-1 |
| Debian 8 | tomcat8 | 8.0.14-1+deb8u13 | DLA-1491-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | tomcat8 | 8.5.39-1ubuntu1~18.04.1 | — |
| Ubuntu 16.04 LTS | tomcat8 | 8.0.32-1ubuntu1.7 | USN-3723-1 |
| Ubuntu 14.04 LTS | tomcat7 | 7.0.52-1ubuntu0.15 | USN-3723-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | tomcat7 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | apache-commons-collections | 3.2.2-10.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | apache-commons-lang | 2.6-21.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | bea-stax +1 | 1.2.0-16.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | glassfish-jaxb +3 | 2.2.11-11.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | jackson-core +4 | 2.9.8-1.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | javassist +1 | 3.18.1-8.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | pki-servlet-4.0-api +1 | 1:9.0.7-14.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | python-nss +2 | 1.0.1-10.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | relaxngDatatype | 2011.1-7.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | resteasy | 3.0.26-3.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | slf4j +1 | 1.7.25-4.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | stax-ex | 1.7.7-8.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | velocity | 1.7-24.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | xalan-j2 | 2.7.1-38.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | xerces-j2 | 2.11.0-34.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | xml-commons-apis | 1.4.01-25.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | xml-commons-resolver | 1.2-26.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | xmlstreambuffer | 1.5.4-8.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 8 | xsom | 0-19.20110809svn.module+el8.0.0+3248+9d514f3b | RHSA-2019:1529 |
| RHEL 7 | tomcat +9 | 7.0.76-9.el7 | RHSA-2019:2205 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 5 | jws5-ecj | 4.6.1-6.redhat_1.1.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 5 | jws5-javapackages-tools +1 | 3.4.1-5.15.10.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 5 | jws5-jboss-logging | 3.3.1-5.Final_redhat_1.1.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 5 | jws5-mod_cluster +1 | 1.4.0-9.Final_redhat_1.1.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 5 | jws5-tomcat +10 | 9.0.7-17.redhat_16.1.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 5 | jws5-tomcat-native | 1.2.17-26.redhat_26.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 5 | jws5-tomcat-vault +1 | 1.1.7-5.Final_redhat_2.1.el6jws | RHSA-2019:0451 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.17-18.redhat_18.ep7.el6 | RHSA-2019:0131 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-31.ep7.el6 | RHSA-2019:0131 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-35.ep7.el6 | RHSA-2019:0131 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.18-8.SP7_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | dom4j-eap6 | 1.6.1-22.redhat_9.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-28.SP29_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.43-1.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | jboss-as-ee +55 | 7.5.22-1.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | jboss-hal +1 | 2.5.19-1.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | jboss-remote-naming | 1.0.15-1.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | jbossas-core +6 | 7.5.22-2.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.30-1.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
| Red Hat JBoss EAP 6 | resteasy | 2.3.23-1.Final_redhat_1.1.ep6.el5 | RHSA-2019:1161, RHSA-2019:1160, RHSA-2019:1159 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | apache-commons-collections | 3.2.2-10.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | apache-commons-lang | 2.6-21.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | bea-stax-api | 1.2.0-16.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | glassfish-fastinfoset | 1.2.13-9.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | glassfish-jaxb-api | 2.2.12-8.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | glassfish-jaxb-core +2 | 2.2.11-11.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | jakarta-commons-httpclient | 1:3.1-28.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | javassist +1 | 3.18.1-8.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | python3-nss +1 | 1.0.1-10.module_el8.5.0+150+5f0dbea0.alma | ALSA-2019:1529 |
| AlmaLinux 8 | relaxngDatatype | 2011.1-7.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | slf4j | 1.7.25-4.module_el8.5.0+2577+9e95fe00 | ALSA-2019:1529 |
| AlmaLinux 8 | slf4j-jdk14 | 1.7.25-4.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | stax-ex | 1.7.7-8.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | velocity | 1.7-24.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | xalan-j2 | 2.7.1-38.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | xerces-j2 | 2.11.0-34.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | xml-commons-apis | 1.4.01-25.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | xml-commons-resolver | 1.2-26.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | xmlstreambuffer | 1.5.4-8.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
| AlmaLinux 8 | xsom | 0-19.20110809svn.module_el8.5.0+150+5f0dbea0 | ALSA-2019:1529 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | apache-commons-lang | 2.6-21.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | bea-stax | 1.2.0-16.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | glassfish-jaxb | 2.2.11-11.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | javassist | 3.18.1-8.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | python-nss | 1.0.1-10.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | relaxngDatatype | 2011.1-7.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | resteasy | 3.0.26-3.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | slf4j | 1.7.25-4.module+el8.3.0+74+855e3f5d | RLSA-2019:1529 |
| Rocky Linux 8 | stax-ex | 1.7.7-8.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | velocity | 1.7-24.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | xalan-j2 | 2.7.1-38.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | xerces-j2 | 2.11.0-34.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | xml-commons-resolver | 1.2-26.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
| Rocky Linux 8 | xsom | 0-19.20110809svn.module+el8.3.0+53+ea062990 | RLSA-2019:1529 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | tomcat | 9.0.10-3.7.1 | SUSE-SU-2018:3011-1 |
| SLES 12 SP3 | tomcat | 8.0.53-29.13.1 | SUSE-SU-2018:2699-1 |
| SLES 12 SP1 | tomcat | 8.0.53-10.35.1 | SUSE-SU-2018:3388-1 |
| SLES 12 | tomcat | 7.0.90-7.23.1 | SUSE-SU-2018:3261-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP3 | tomcat | 8.0.53-29.13.1 | SUSE-SU-2018:2699-1 |
| SLES for SAP 12 SP1 | tomcat | 8.0.53-10.35.1 | SUSE-SU-2018:3388-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tomcat | 9.0.36-8.4 | openSUSE-SU-2024:11468-1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 | openSUSE-SU-2024:13441-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | tomcat +9 | 7.0.76-10.amzn2.0.1 | ALAS2-2020-1402 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | apache-commons-lang | 2.6-21.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | bea-stax-api | 1.2.0-16.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | glassfish-jaxb-core +2 | 2.2.11-11.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | jackson-core +4 | 2.9.8-1.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | javassist +1 | 3.18.1-8.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | pki-servlet-4.0-api +1 | 1:9.0.7-14.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | python3-nss +1 | 1.0.1-10.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | relaxngDatatype | 2011.1-7.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | resteasy | 3.0.26-3.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | slf4j +1 | 1.7.25-4.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | stax-ex | 1.7.7-8.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | velocity | 1.7-24.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | xalan-j2 | 2.7.1-38.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | xerces-j2 | 2.11.0-34.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | xml-commons-resolver | 1.2-26.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 8 | xsom | 0-19.20110809svn.module+el8.0.0+5231+3e842911 | ELSA-2019-1529 |
| Oracle Linux 7 | tomcat +9 | 7.0.76-9.el7 | ELSA-2019-2205 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 9.0.0, < 9.0.10 | 9.0.10 | GHSA-46j3-r4pj-4835 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 8.5.0, < 8.5.32 | 8.5.32 | GHSA-46j3-r4pj-4835 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 8.0.0, < 8.0.53 | 8.0.53 | GHSA-46j3-r4pj-4835 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 7.0.35, < 7.0.90 | 7.0.90 | GHSA-46j3-r4pj-4835 |
Advisories 25
- ALSA-2019:1529 Important: pki-deps:10.6 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2019:2205 Red Hat Security Advisory: tomcat security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1529 Red Hat Security Advisory: pki-deps:10.6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1160 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.22 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1161 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.22 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1159 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.22 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:0451 Red Hat Security Advisory: Red Hat JBoss Web Server 5.0 Service Pack 2 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:0131 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 6 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2026-2610 Apache Tomcat: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 2, 2026
- USN-3723-1 tomcat7, tomcat8 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4281-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1491-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1453-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2019:1529 Important: pki-deps:10.6 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2018:3261-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3388-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:2699-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3011-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11468-1 tomcat-9.0.36-8.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1682 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2024
- WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- ALAS2-2020-1402 Important: tomcat security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 28, 2021
- ELSA-2019-2205 Moderate: tomcat security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 13, 2019
- ELSA-2019-1529 Important: pki-deps:10.6 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 30, 2019
References
- USN-3723-1 vendor-advisory
- [www-announce] 20180722 [SECURITY] CVE-2018-8034 Apache Tomcat - Security Constraint Bypass mailing-list
- RHSA-2019:0451 vendor-advisory
- [debian-lts-announce] 20180730 [SECURITY] [DLA 1453-1] tomcat7 security update mailing-list
- DSA-4281 vendor-advisory
- 1041374 vdb-entry
- https://security.netapp.com/advisory/ntap-20180817-0001/
- RHSA-2019:0131 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- RHSA-2019:0130 vendor-advisory
- RHSA-2019:0450 vendor-advisory
- [debian-lts-announce] 20180902 [SECURITY] [DLA 1491-1] tomcat8 security update mailing-list
- 104895 vdb-entry
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- RHSA-2019:1160 vendor-advisory
- RHSA-2019:1162 vendor-advisory
- RHSA-2019:1159 vendor-advisory
- RHSA-2019:1161 vendor-advisory
- RHSA-2019:1529 vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- [activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars. mailing-list
- RHSA-2019:2205 vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- RHSA-2019:3892 vendor-advisory
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html