Description
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M8, Apache Tomcat 10.0 10.0.0-M5 to 10.0.14, Apache Tomcat 9 9.0.35 to 9.0.56, Apache Tomcat 8 8.5.55 to 8.5.73 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tomcat9 | 9.0.58-1 | — |
| Debian 13 | tomcat9 | 9.0.58-1 | — |
| Debian 12 | tomcat9 | 9.0.58-1 | — |
| Debian 11 | tomcat9 | 9.0.43-2~deb11u4 | DSA-5265-1 |
| Debian 10 | tomcat9 | 9.0.31-1~deb10u7 | DLA-3160-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | tomcat9 | 9.0.31-1ubuntu0.6 | USN-6943-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | tomcat9 | 9.0.58-1ubuntu0.1+esm2 | USN-6943-1 |
| Ubuntu Pro 18.04 LTS | tomcat8 | 8.5.39-1ubuntu1~18.04.3+esm2 | USN-6943-1 |
| Ubuntu Pro 18.04 LTS | tomcat9 | 9.0.16-3ubuntu0.18.04.2+esm2 | USN-6943-1 |
| Ubuntu Pro 16.04 LTS | tomcat8 | 8.0.32-1ubuntu1.13+esm1 | USN-6943-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 5 | jws5 +1 | 1-8.el9jws | RHSA-2022:7272 |
| Red Hat JBoss Web Server 5 | jws5-ecj | 4.20.0-1.redhat_00002.1.el7jws | RHSA-2022:7272 |
| Red Hat JBoss Web Server 5 | jws5-javapackages-tools +1 | 3.4.1-5.15.11.el9jws | RHSA-2022:7272 |
| Red Hat JBoss Web Server 5 | jws5-jboss-logging | 3.4.1-1.Final_redhat_00001.1.el9jws | RHSA-2022:7272 |
| Red Hat JBoss Web Server 5 | jws5-mod_cluster +1 | 1.4.3-2.Final_redhat_00002.1.el9jws | RHSA-2022:7272 |
| Red Hat JBoss Web Server 5 | jws5-tomcat +11 | 9.0.62-9.redhat_00005.1.el7jws | RHSA-2022:7272 |
| Red Hat JBoss Web Server 5 | jws5-tomcat-native | 1.2.31-10.redhat_10.el7jws | RHSA-2022:7272 |
| Red Hat JBoss Web Server 5 | jws5-tomcat-vault +1 | 1.1.8-4.Final_redhat_00004.1.el9jws | RHSA-2022:7272 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | tomcat | 9.0.36-19.1 | SUSE-SU-2022:0818-1 |
| SLES 15 SP2 | tomcat | 9.0.36-19.1 | SUSE-SU-2022:0818-1 |
| SLES 15 SP1 | tomcat | 9.0.36-4.70.1 | SUSE-SU-2022:0695-1 |
| SLES 15 | tomcat | 9.0.36-3.90.1 | SUSE-SU-2022:0694-1 |
| SLES 12 SP5 | javapackages-tools | 5.3.1-14.5.1 | SUSE-SU-2022:0784-1 |
| SLES 12 SP5 | tomcat | 9.0.36-3.84.1 | SUSE-SU-2026:1058-1, SUSE-SU-2022:0784-1 |
Show 19 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | javapackages-tools | 5.3.1-14.5.1 | SUSE-SU-2022:0784-1 |
| SLES 12 SP4 | tomcat | 9.0.36-3.84.1 | SUSE-SU-2022:0784-1 |
| SLES for SAP 15 SP2 | tomcat | 9.0.36-19.1 | SUSE-SU-2022:0818-1 |
| SLES for SAP 15 SP1 | tomcat | 9.0.36-4.70.1 | SUSE-SU-2022:0695-1 |
| SLES for SAP 15 | tomcat | 9.0.36-3.90.1 | SUSE-SU-2022:0694-1 |
| SLES for SAP 12 SP5 | javapackages-tools | 5.3.1-14.5.1 | SUSE-SU-2022:0784-1 |
| SLES for SAP 12 SP5 | tomcat | 9.0.36-3.84.1 | SUSE-SU-2022:0784-1 |
| SLES for SAP 12 SP4 | javapackages-tools | 5.3.1-14.5.1 | SUSE-SU-2022:0784-1 |
| SLES for SAP 12 SP4 | tomcat | 9.0.36-3.84.1 | SUSE-SU-2022:0784-1 |
| SLE HPC 15 SP2 | tomcat | 9.0.36-19.1 | SUSE-SU-2022:0818-1 |
| SLE HPC 15 SP1 | tomcat | 9.0.36-4.70.1 | SUSE-SU-2022:0695-1 |
| SLE HPC 15 | tomcat | 9.0.36-3.90.1 | SUSE-SU-2022:0694-1 |
| SUSE OpenStack Cloud Crowbar 9 | javapackages-tools | 5.3.1-14.5.1 | SUSE-SU-2022:0784-1 |
| SUSE OpenStack Cloud Crowbar 9 | tomcat | 9.0.36-3.84.1 | SUSE-SU-2022:0784-1 |
| SUSE OpenStack Cloud Crowbar 8 | javapackages-tools | 5.3.1-14.5.1 | SUSE-SU-2022:0784-1 |
| SUSE OpenStack Cloud 9 | javapackages-tools | 5.3.1-14.5.1 | SUSE-SU-2022:0784-1 |
| SUSE OpenStack Cloud 9 | tomcat | 9.0.36-3.84.1 | SUSE-SU-2022:0784-1 |
| SUSE OpenStack Cloud 8 | javapackages-tools | 5.3.1-14.5.1 | SUSE-SU-2022:0784-1 |
| SUSE Manager Server 4.1 | tomcat | 9.0.36-19.1 | SUSE-SU-2022:0818-1 |
| SUSE Manager Retail Branch Server 4.1 | tomcat | 9.0.36-19.1 | SUSE-SU-2022:0818-1 |
| SUSE Manager Proxy 4.1 | tomcat | 9.0.36-19.1 | SUSE-SU-2022:0818-1 |
| SUSE HPE Helion OpenStack 8 | javapackages-tools | 5.3.1-14.5.1 | SUSE-SU-2022:0784-1 |
| SUSE Enterprise Storage 7 | tomcat | 9.0.36-19.1 | SUSE-SU-2022:0818-1 |
| SUSE Enterprise Storage 6 | tomcat | 9.0.36-4.70.1 | SUSE-SU-2022:0695-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tomcat | 9.0.43-5.1 | openSUSE-SU-2024:11864-1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 | openSUSE-SU-2024:13441-1 |
| openSUSE Leap 15.3 | tomcat | 9.0.36-19.1 | openSUSE-SU-2022:0818-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | tomcat9 +7 | 1:9.0.64-1.amzn2023.0.2 | ALAS2023-2023-059 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 10.0.0, < 10.0.16 | 10.0.16 | GHSA-9f3j-pm6f-9fm5 |
| Maven | org.apache.tomcat:tomcat | >= 9.0.0, < 9.0.58 | 9.0.58 | GHSA-9f3j-pm6f-9fm5 |
| Maven | org.apache.tomcat:tomcat | < 8.5.75 | 8.5.75 | GHSA-9f3j-pm6f-9fm5 |
Advisories 20
- WID-SEC-2022-0432 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2022-0302 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Oct 11, 2026
- RHSA-2022:7272 Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.0 release and security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- WID-SEC-2022-0607 Red Hat FUSE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
- USN-6943-1 tomcat8, tomcat9 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- SUSE-SU-2026:1058-1 Security update for tomcat SUSE / openSUSE Security Updates · Mar 27, 2026
- WID-SEC-2022-1868 Apache Tomcat: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Mar 26, 2026
- DSA-5265-1 tomcat9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3160-1 tomcat9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11864-1 tomcat-9.0.43-5.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0818-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13441-1 tomcat10-10.1.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0695-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0818-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0784-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0169 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- SUSE-SU-2022:0694-1 Security update for tomcat SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-1238 HPE HP-UX: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 27, 2024
- ALAS2023-2023-059 Moderate: tomcat9 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 15, 2024
- WID-SEC-2023-1031 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
References
- https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220217-0010/
- https://www.oracle.com/security-alerts/cpujul2022.html
- [debian-lts-announce] 20221026 [SECURITY] [DLA 3160-1] tomcat9 security update mailing-list
- DSA-5265 vendor-advisory