CVE-2019-12418 — Insufficiently Protected Credentials in Apache Tomcat

Description

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Tomcat	9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 to 7.0.97	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	tomcat9	9.0.31-1	—
Debian 13	tomcat9	9.0.31-1	—
Debian 12	tomcat9	9.0.31-1	—
Debian 10	tomcat9	9.0.31-1~deb10u1	DSA-4680-1
Debian 9	tomcat8	8.5.50-0+deb9u1	DSA-4596-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Debian 8	tomcat7	7.0.56-3+really7.0.99-1	DLA-2077-1
Debian 8	tomcat8	8.0.14-1+deb8u16	DLA-2155-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	tomcat8	8.0.32-1ubuntu1.11	USN-4251-1

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	tomcat8 +1	No fix yet	—
Ubuntu Pro 16.04 LTS	tomcat7	No fix yet	—
Ubuntu Pro 14.04 LTS	tomcat7	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 5	jws5-tomcat +9	9.0.30-3.redhat_4.1.el6jws	RHSA-2020:1520
Red Hat JBoss Web Server 5	jws5-tomcat-native	1.2.23-4.redhat_4.el6jws	RHSA-2020:1520
Red Hat JBoss Web Server 3	tomcat-native	1.2.23-21.redhat_21.ep7.el6	RHSA-2020:0861
Red Hat JBoss Web Server 3	tomcat7 +11	7.0.70-38.ep7.el6	RHSA-2020:0861
Red Hat JBoss Web Server 3	tomcat8 +11	8.0.36-42.ep7.el6	RHSA-2020:0861

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP1	tomcat	9.0.30-4.10.1	SUSE-SU-2020:0029-1
SLES 15	tomcat	9.0.30-3.34.1	SUSE-SU-2020:0226-1
SLES 12 SP5	tomcat	9.0.31-3.25.1	SUSE-SU-2020:0632-1
SLES 12 SP4	tomcat	9.0.31-3.25.1	SUSE-SU-2020:0632-1
SLES 12 SP3	tomcat	8.0.53-29.27.1	SUSE-SU-2020:1498-1

Show 14 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 12 SP2	tomcat	8.0.53-29.27.1	SUSE-SU-2020:1498-1
SLES 12 SP1	tomcat	8.0.53-10.43.1	SUSE-SU-2020:1497-1
SLES 11 SP4	tomcat6	6.0.53-0.57.16.1	SUSE-SU-2020:14375-1
SLES for SAP 12 SP5	tomcat	9.0.31-3.25.1	SUSE-SU-2020:0632-1
SLES for SAP 12 SP4	tomcat	9.0.31-3.25.1	SUSE-SU-2020:0632-1
SLES for SAP 12 SP3	tomcat	8.0.53-29.27.1	SUSE-SU-2020:1498-1
SLES for SAP 12 SP2	tomcat	8.0.53-29.27.1	SUSE-SU-2020:1498-1
SLES for SAP 12 SP1	tomcat	8.0.53-10.43.1	SUSE-SU-2020:1497-1
SUSE OpenStack Cloud Crowbar 8	tomcat	8.0.53-29.27.1	SUSE-SU-2020:1498-1
SUSE OpenStack Cloud 8	tomcat	8.0.53-29.27.1	SUSE-SU-2020:1498-1
SUSE OpenStack Cloud 7	tomcat	8.0.53-29.27.1	SUSE-SU-2020:1498-1
SUSE Linux Enterprise Point of Sale 11 SP3	tomcat6	6.0.53-0.57.16.1	SUSE-SU-2020:14375-1
SUSE HPE Helion OpenStack 8	tomcat	8.0.53-29.27.1	SUSE-SU-2020:1498-1
SUSE Enterprise Storage 5	tomcat	8.0.53-29.27.1	SUSE-SU-2020:1498-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	tomcat	9.0.36-8.4	openSUSE-SU-2024:11468-1
openSUSE Tumbleweed	tomcat10	10.1.14-1.1	openSUSE-SU-2024:13441-1
openSUSE Leap 15.1	tomcat	9.0.30-lp151.3.6.1	openSUSE-SU-2020:0038-1

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2	tomcat +9	7.0.76-10.amzn2.0.4	ALAS2-2023-2047

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat.embed:tomcat-embed-core	< 7.0.99	7.0.99	GHSA-hh3j-x4mc-g48r
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 8.0.0, < 8.5.49	8.5.49	GHSA-hh3j-x4mc-g48r
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 9.0.0, < 9.0.29	9.0.29	GHSA-hh3j-x4mc-g48r

Advisories 19

RHSA-2020:1520 Red Hat Security Advisory: Red Hat JBoss Web Server 5.3 release Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2020:0861 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 8 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
USN-4251-1 tomcat8 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DSA-4680-1 tomcat9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DSA-4596-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-2155-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-2077-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2020:0632-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:0029-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:0226-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:14375-1 Security update for tomcat6 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:11468-1 tomcat-9.0.36-8.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2020:0038-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:1497-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2020:1498-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
WID-SEC-2023-1229 Apache Tomcat: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 27, 2023
ALAS2-2023-2047 Important: tomcat security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 16, 2023

References

https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E
DSA-4596 vendor-advisory
20191229 [SECURITY] [DSA 4596-1] tomcat8 security update mailing-list
https://security.netapp.com/advisory/ntap-20200107-0001/
https://support.f5.com/csp/article/K10107360?utm_source=f5support&amp%3Butm_medium=RSS
openSUSE-SU-2020:0038 vendor-advisory
[debian-lts-announce] 20200127 [SECURITY] [DLA 2077-1] tomcat7 security update mailing-list
USN-4251-1 vendor-advisory
[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
GLSA-202003-43 vendor-advisory
[debian-lts-announce] 20200324 [SECURITY] [DLA 2155-1] tomcat8 security update mailing-list
https://www.oracle.com/security-alerts/cpuapr2020.html
DSA-4680 vendor-advisory