Most recent entries from all

bdu:2021-01808

BIT-tomcat-2021-25329 — Incomplete fix for CVE-2020-9484

Affected: Bitnami: tomcat

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0 to 10.0.0, 9.0.0 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

certfr-2021-avi-164 — De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Elles permettent à un attaquant de provoquer une ex…

certfr-2021-avi-164

EUVD-2026-215951

fkie_cve-2021-25329

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

GHSA-jgwr-3qm3-26f3 — Potential remote code execution in Apache Tomcat

Affected: Maven: org.apache.tomcat.embed:tomcat-embed-core

gsd-2021-25329

OESA-2021-1117 — tomcat security update

Affected: openEuler:20.03-LTS-SP1: tomcat

The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project Security Fix(es): The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.(CVE-2021-25329) When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.(CVE-2021-25122)

openSUSE-SU-2021:0496-1 — Security update for tomcat

Security update for tomcat

RHSA-2021:2561 — Red Hat Security Advisory: Red Hat JBoss Web Server 5.5.0 Security release

hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used tomcat: Request mix-up with h2c tomcat: Incomplete fix for CVE-2020-9484 (RCE via session persistence)

SUSE-SU-2021:0988-1 — Security update for tomcat

Security update for tomcat

UBUNTU-CVE-2021-25329

Affected: Ubuntu:Pro:14.04:LTS: tomcat7, Ubuntu:Pro:14.04:LTS: tomcat6, Ubuntu:Pro:16.04:LTS: tomcat7, Ubuntu:Pro:16.04:LTS: tomcat8, Ubuntu:18.04:LTS: tomcat9, Ubuntu:Pro:18.04:LTS: tomcat7, Ubuntu:Pro:18.04:LTS: tomcat8, Ubuntu:20.04:LTS: tomcat9

WID-SEC-W-2022-0607 — Red Hat FUSE: Mehrere Schwachstellen

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, einen Denial of Service Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.