Description
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache | Apache Tomcat | Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, 7.0.0 to 7.0.99 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tomcat9 | 9.0.31-1 | — |
| Debian 13 | tomcat9 | 9.0.31-1 | — |
| Debian 12 | tomcat9 | 9.0.31-1 | — |
| Debian 10 | tomcat9 | 9.0.31-1~deb10u1 | DSA-4680-1 |
| Debian 9 | tomcat8 | 8.5.54-0+deb9u1 | DSA-4673-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | tomcat7 | 7.0.56-3+really7.0.100-1 | DLA-2133-1 |
| Debian 8 | tomcat8 | 8.0.14-1+deb8u17 | DLA-2209-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | tomcat7 +2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | tomcat7 +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | tomcat7 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | apache-commons-collections | 3.2.2-10.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | apache-commons-lang | 2.6-21.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | apache-commons-net | 3.6-3.module+el8.3.0+6805+72837426 | RHSA-2020:4847 |
| RHEL 8 | bea-stax +1 | 1.2.0-16.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | glassfish-jaxb +3 | 2.2.11-11.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | jackson-core +2 | 2.10.0-1.module+el8.2.0+5059+3eb3af25 | RHSA-2020:4847 |
| RHEL 8 | jackson-jaxrs-providers +1 | 2.9.9-1.module+el8.1.0+3832+9784644d | RHSA-2020:4847 |
| RHEL 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | javassist +1 | 3.18.1-8.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | jss +1 | 4.7.3-1.module+el8.3.0+8058+d5cd4219 | RHSA-2020:4847 |
| RHEL 8 | ldapjdk +1 | 4.22.0-1.module+el8.3.0+6784+6e1e4c62 | RHSA-2020:4847 |
| RHEL 8 | pki-ca +8 | 10.9.4-1.module+el8.3.0+8058+d5cd4219 | RHSA-2020:4847 |
| RHEL 8 | pki-servlet-engine +1 | 1:9.0.30-1.module+el8.3.0+6730+8f9c6254 | RHSA-2020:4847 |
| RHEL 8 | python-nss +2 | 1.0.1-10.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | relaxngDatatype | 2011.1-7.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | resteasy | 3.0.26-3.module+el8.2.0+5723+4574fbff | RHSA-2020:4847 |
| RHEL 8 | slf4j +1 | 1.7.25-4.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | stax-ex | 1.7.7-8.module+el8.2.0+5723+4574fbff | RHSA-2020:4847 |
| RHEL 8 | tomcatjss | 7.5.0-1.module+el8.3.0+7355+c59bcbd9 | RHSA-2020:4847 |
| RHEL 8 | velocity | 1.7-24.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xalan-j2 | 2.7.1-38.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xerces-j2 | 2.11.0-34.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xml-commons-apis | 1.4.01-25.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xml-commons-resolver | 1.2-26.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 8 | xmlstreambuffer | 1.5.4-8.module+el8.2.0+5723+4574fbff | RHSA-2020:4847 |
| RHEL 8 | xsom | 0-19.20110809svn.module+el8.1.0+3366+6dfb954c | RHSA-2020:4847 |
| RHEL 7 | tomcat +9 | 7.0.76-11.el7_7 | RHSA-2020:0855 |
| RHEL 6 | tomcat6 +8 | 6.0.24-114.el6_10 | RHSA-2020:0912 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.6 EUS | tomcat +9 | 7.0.76-10.el7_6 | RHSA-2020:2840 |
| Red Hat JBoss Web Server 5 | jws5-tomcat +9 | 9.0.30-3.redhat_4.1.el6jws | RHSA-2020:1520 |
| Red Hat JBoss Web Server 5 | jws5-tomcat-native | 1.2.23-4.redhat_4.el6jws | RHSA-2020:1520 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.23-21.redhat_21.ep7.el6 | RHSA-2020:0861 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-38.ep7.el6 | RHSA-2020:0861 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-42.ep7.el6 | RHSA-2020:0861 |
| Red Hat JBoss EAP 6 | glassfish-jsf12-eap6 | 1.2.15-11.b01_SP2_redhat_2.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-29.SP31_redhat_00001.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.44-1.Final_redhat_00001.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jbosgi-repository | 2.1.0-3.Final_redhat_3.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jboss-as-ee +54 | 7.5.23-3.Final_redhat_00002.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jboss-remoting3-jmx | 1.1.4-2.Final_redhat_00001.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jbossas-core +6 | 7.5.23-4.Final_redhat_00002.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.23-2.Final_redhat_00002.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.30-2.Final_redhat_2.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.34-2.Final_redhat_2.1.ep6.el5 | RHSA-2020:2781, RHSA-2020:2780, RHSA-2020:2779 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | apache-commons-lang | 2.6-21.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | apache-commons-net | 3.6-3.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | bea-stax | 1.2.0-16.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | glassfish-jaxb | 2.2.11-11.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jackson-core +2 | 2.10.0-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jackson-jaxrs-providers | 2.9.9-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | javassist | 3.18.1-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | ldapjdk | 4.22.0-1.module+el8.4.0+418+b7ae1d4a | RLSA-2020:4847 |
| Rocky Linux 8 | pki-servlet-engine | 1:9.0.30-1.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | python-nss | 1.0.1-10.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | relaxngDatatype | 2011.1-7.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | resteasy | 3.0.26-3.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | slf4j | 1.7.25-4.module+el8.3.0+74+855e3f5d | RLSA-2020:4847 |
| Rocky Linux 8 | stax-ex | 1.7.7-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | velocity | 1.7-24.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xalan-j2 | 2.7.1-38.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xerces-j2 | 2.11.0-34.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xml-commons-resolver | 1.2-26.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
| Rocky Linux 8 | xsom | 0-19.20110809svn.module+el8.3.0+53+ea062990 | RLSA-2020:4847 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | apache2 | 2.4.33-3.30.1 | SUSE-SU-2020:1126-1 |
| SLES 15 SP1 | tomcat | 9.0.31-4.22.1 | SUSE-SU-2020:0631-1 |
| SLES 15 | apache2 | 2.4.33-3.30.1 | SUSE-SU-2020:1126-1 |
| SLES 15 | tomcat | 9.0.31-3.42.2 | SUSE-SU-2020:0598-1 |
| SLES 12 SP5 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SLES 12 SP5 | tomcat | 9.0.31-3.25.1 | SUSE-SU-2020:0632-1 |
| SLES 12 SP4 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SLES 12 SP4 | tomcat | 9.0.31-3.25.1 | SUSE-SU-2020:0632-1 |
| SLES 12 SP3 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SLES 12 SP3 | tomcat | 8.0.53-29.22.1 | SUSE-SU-2020:0725-1 |
Show 16 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SLES 12 SP2 | tomcat | 8.0.53-29.22.1 | SUSE-SU-2020:0725-1 |
| SLES 12 SP1 | apache2 | 2.4.16-20.29.1 | SUSE-SU-2020:1111-1 |
| SLES 12 SP1 | tomcat | 8.0.53-10.38.1 | SUSE-SU-2020:0806-1 |
| SLES 11 SP4 | apache2 | 2.2.34-70.27.1 | SUSE-SU-2020:14342-1 |
| SLES 11 SP4 | tomcat6 | 6.0.53-0.57.13.1 | SUSE-SU-2020:14334-1 |
| SLES for SAP 15 | apache2 | 2.4.33-3.30.1 | SUSE-SU-2020:1126-1 |
| SLES for SAP 15 | tomcat | 9.0.31-3.42.2 | SUSE-SU-2020:0598-1 |
| SLES for SAP 12 SP5 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SLES for SAP 12 SP5 | tomcat | 9.0.31-3.25.1 | SUSE-SU-2020:0632-1 |
| SLES for SAP 12 SP4 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SLES for SAP 12 SP4 | tomcat | 9.0.31-3.25.1 | SUSE-SU-2020:0632-1 |
| SLES for SAP 12 SP3 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SLES for SAP 12 SP3 | tomcat | 8.0.53-29.22.1 | SUSE-SU-2020:0725-1 |
| SLES for SAP 12 SP2 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SLES for SAP 12 SP2 | tomcat | 8.0.53-29.22.1 | SUSE-SU-2020:0725-1 |
| SLES for SAP 12 SP1 | apache2 | 2.4.16-20.29.1 | SUSE-SU-2020:1111-1 |
| SLES for SAP 12 SP1 | tomcat | 8.0.53-10.38.1 | SUSE-SU-2020:0806-1 |
| SLE HPC 15 | apache2 | 2.4.33-3.30.1 | SUSE-SU-2020:1126-1 |
| SLE HPC 15 | tomcat | 9.0.31-3.42.2 | SUSE-SU-2020:0598-1 |
| SUSE OpenStack Cloud Crowbar 8 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SUSE OpenStack Cloud Crowbar 8 | tomcat | 8.0.53-29.22.1 | SUSE-SU-2020:0725-1 |
| SUSE OpenStack Cloud 8 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SUSE OpenStack Cloud 8 | tomcat | 8.0.53-29.22.1 | SUSE-SU-2020:0725-1 |
| SUSE OpenStack Cloud 7 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SUSE OpenStack Cloud 7 | tomcat | 8.0.53-29.22.1 | SUSE-SU-2020:0725-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | apache2 | 2.2.34-70.27.1 | SUSE-SU-2020:14342-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | tomcat6 | 6.0.53-0.57.13.1 | SUSE-SU-2020:14334-1 |
| SUSE HPE Helion OpenStack 8 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SUSE HPE Helion OpenStack 8 | tomcat | 8.0.53-29.22.1 | SUSE-SU-2020:0725-1 |
| SUSE Enterprise Storage 5 | apache2 | 2.4.23-29.54.1 | SUSE-SU-2020:1272-1 |
| SUSE Enterprise Storage 5 | tomcat | 8.0.53-29.22.1 | SUSE-SU-2020:0725-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tomcat | 9.0.36-8.4 | openSUSE-SU-2024:11468-1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 | openSUSE-SU-2024:13441-1 |
| openSUSE Leap 15.1 | apache2 | 2.4.33-lp151.8.12.1 | openSUSE-SU-2020:0597-1 |
| openSUSE Leap 15.1 | tomcat | 9.0.31-lp151.3.12.1 | openSUSE-SU-2020:0345-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | tomcat +9 | 7.0.76-10.amzn2.0.1 | ALAS2-2020-1402 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | tomcat +9 | 7.0.76-11.el7_7 | ELSA-2020-0855 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Apache Tomcat AJP File Read
auxiliary/admin/http/tomcat_ghostcat
Exploit-DB 2
- Apache Tomcat - AJP 'Ghostcat' File Read/Inclusion (Metasploit) EDB-49039 · webapps · Nov 13, 2020 · verified
- Apache Tomcat - AJP 'Ghostcat File Read/Inclusion EDB-48143 · webapps · Feb 20, 2020
GitHub 40 repositories · most starred shown
-
00theway/Ghostcat-CNVD-2020-10487 ★ 423 · Feb 22, 2020
Ghostcat read file/code execute,CNVD-2020-10487(CVE-2020-1938)
-
lizhianyuguangming/TomcatScanPro ★ 300 · Aug 29, 2024
tomcat自动化漏洞扫描利用工具，支持批量弱口令检测、后台部署war包getshell、CVE-2017-12615 文件上传、CVE-2020-1938/CNVD-2020-10487 文件包含
-
bkfish/CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner ★ 294 · Feb 20, 2020
Cnvd-2020-10487 / cve-2020-1938, scanner tool
-
tpt11fb/AttackTomcat ★ 259 · Nov 13, 2022
Tomcat常见漏洞GUI利用工具。CVE-2017-12615 PUT文件上传漏洞、tomcat-pass-getshell 弱认证部署war包、弱口令爆破、CVE-2020-1938 Tomcat AJP文件读取/包含
-
sv3nbeast/CVE-2020-1938-Tomact-file_include-file_read ★ 57 · Feb 21, 2020
Tomcat的文件包含及文件读取漏洞利用POC
-
xindongzhuaizhuai/CVE-2020-1938 ★ 45 · Feb 20, 2020
-
laolisafe/CVE-2020-1938 ★ 38 · Feb 21, 2020
CVE-2020-1938漏洞复现
-
Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat ★ 24 · Mar 28, 2021
-
woaiqiukui/CVE-2020-1938TomcatAjpScanner ★ 15 · Feb 21, 2020
批量扫描TomcatAJP漏洞
-
fairyming/CVE-2020-1938 ★ 11 · Feb 21, 2020
在一定条件下可执行命令
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability network/cves/2020/CVE-2020-1938.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 9.0.0, < 9.0.31 | 9.0.31 | GHSA-c9hw-wf7x-jp9j |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 8.0.0, < 8.5.51 | 8.5.51 | GHSA-c9hw-wf7x-jp9j |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 7.0.0, < 7.0.100 | 7.0.100 | GHSA-c9hw-wf7x-jp9j |
Advisories 35
- RHSA-2020:4847 Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2020:2840 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:2781 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.23 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:2780 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.23 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:2779 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.23 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:1478 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:1520 Red Hat Security Advisory: Red Hat JBoss Web Server 5.3 release Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:0861 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 8 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:0912 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2020:0855 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-4673-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4680-1 tomcat9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2133-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2209-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2020:4847 Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2020:0632-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0725-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0806-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1111-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1126-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:14334-1 Security update for tomcat6 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11468-1 tomcat-9.0.36-8.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0598-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1272-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0345-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:14342-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0597-1 Security update for apache2 SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2020:0631-1 Security update for tomcat SUSE / openSUSE Security Updates · May 2, 2025
- NCSC-2025-0123 Kwetsbaarheden verholpen in Oracle Database Producten NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- WID-SEC-2023-2480 Apache Tomcat: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Sep 27, 2023
- ICSMA-21-187-01 Philips Vue PACS (Update B) CISA ICS & IT advisories · Apr 5, 2022
- ALAS2-2020-1402 Important: tomcat security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 28, 2021
- ELSA-2020-0855 Important: tomcat security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 22, 2020
References
- [tomcat-announce] 20200224 [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution mailing-list
- [ofbiz-notifications] 20200225 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) mailing-list
- [ofbiz-notifications] 20200225 [jira] [Updated] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) mailing-list
- [ofbiz-commits] 20200227 [ofbiz-plugins] branch release17.12 updated: Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) (OFBIZ-11407) mailing-list
- [ofbiz-notifications] 20200227 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) mailing-list
- [ofbiz-notifications] 20200228 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) mailing-list
- [ofbiz-notifications] 20200228 [jira] [Comment Edited] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) mailing-list
- [tomcat-users] 20200301 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution mailing-list
- [tomcat-users] 20200302 Re: AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution mailing-list
- [tomcat-users] 20200302 AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution mailing-list
- [tomcat-users] 20200302 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution mailing-list
- [tomcat-users] 20200304 Re: Fix for CVE-2020-1938 mailing-list
- [tomcat-dev] 20200304 Re: Tagging 10.0.x, 9.0.x, 8.5.x mailing-list
- [debian-lts-announce] 20200304 [SECURITY] [DLA 2133-1] tomcat7 security update mailing-list
- [tomcat-users] 20200305 Aw: Re: Fix for CVE-2020-1938 mailing-list
- [tomcat-users] 20200305 Re: Aw: Re: Fix for CVE-2020-1938 mailing-list
- [tomcat-dev] 20200309 [Bug 64206] Answer file not being used mailing-list
- [tomcat-users] 20200309 Re: Apache Tomcat AJP File Inclusion Vulnerability (unauthenticated check) mailing-list
- [tomcat-users] 20200310 Aw: Re: Re: Fix for CVE-2020-1938 mailing-list
- [tomcat-users] 20200310 Re: Re: Re: Fix for CVE-2020-1938 mailing-list
- [tomee-dev] 20200311 CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1 mailing-list
- [tomee-dev] 20200311 Re: CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1 mailing-list
- openSUSE-SU-2020:0345 vendor-advisory
- [tomee-dev] 20200316 RE: CVE-2020-8840 on TomEE 8.0.1 mailing-list
- [httpd-bugs] 20200319 [Bug 53098] mod_proxy_ajp: patch to set worker secret passed to tomcat mailing-list
- GLSA-202003-43 vendor-advisory
- [tomee-commits] 20200320 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability. mailing-list
- [tomee-commits] 20200320 [jira] [Created] (TOMEE-2789) TomEE plus is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability. mailing-list
- [tomee-commits] 20200323 [jira] [Commented] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability. mailing-list
- FEDORA-2020-0e42878ba7 vendor-advisory
- FEDORA-2020-c870aa8378 vendor-advisory
- FEDORA-2020-04ac174fa9 vendor-advisory
- [tomcat-users] 20200413 RE: Alternatives for AJP mailing-list
- openSUSE-SU-2020:0597 vendor-advisory
- DSA-4673 vendor-advisory
- DSA-4680 vendor-advisory
- [debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update mailing-list
- [tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml mailing-list
- [ofbiz-notifications] 20200628 [jira] [Updated] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996) mailing-list
- [ofbiz-notifications] 20200628 [jira] [Created] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996) mailing-list
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.netapp.com/advisory/ntap-20200226-0002/
- http://support.blackberry.com/kb/articleDetail?articleNumber=000062739
- [tomee-users] 20200723 Re: TomEE on Docker mailing-list
- [geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- [tomee-commits] 20201127 [jira] [Resolved] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability. mailing-list
- [tomee-commits] 20201127 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability. mailing-list
- https://www.oracle.com/security-alerts/cpujan2021.html
- [announce] 20210125 Apache Software Foundation Security Report: 2020 mailing-list
- [announce] 20210223 Re: Apache Software Foundation Security Report: 2020 mailing-list