{"id":"CVE-2016-0714","aliases":["DLA-435-1","DSA-3530-1","DSA-3552-1","DSA-3609-1","EUVD-2022-4624","GHSA-mv42-px54-87jw","MGASA-2016-0090","RHSA-2016:1087","RHSA-2016:1088","RHSA-2016:2045","RHSA-2016:2599","RHSA-2016:2807","SUSE-SU-2016:0769-1","SUSE-SU-2016:0822-1","SUSE-SU-2016:0839-1","UBUNTU-CVE-2016-0714","USN-3024-1","openSUSE-SU-2024:10446-1","openSUSE-SU-2024:13441-1"],"status":"published","title":"Improper Access Control in Apache Tomcat","description":"The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.13075,"percentile":0.96374,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-264","CWE-284"],"published":"2016-02-24T00:00:00Z","modified":"2026-10-24T10:30:18Z","exploits":[{"source":"pocgithub","id":"dannyEndorTest/java-vulnerable","title":"dannyEndorTest/java-vulnerable","date":"2026-05-21","url":"https://github.com/dannyEndorTest/java-vulnerable"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["9.0.0.M2","8.0.32","7.0.70","6.0.46"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"tomcat6","fixed_in":["6.0.39-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","fixed_in":["7.0.52-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"tomcat6","fixed_in":["6.0.45+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"last_affected":"9.0.0.M1"},{"fixed":"9.0.0.M2"}]}],"versions":["9.0.0.M1"]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0.RC1"},{"fixed":"8.0.32"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.70"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.46"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.45-1~deb6u1"}]}],"versions":["6.0.28-10","6.0.28-9","6.0.28-9+squeeze1","6.0.32-1","6.0.32-2","6.0.32-3","6.0.32-4","6.0.32-5","6.0.32-6","6.0.32-7","6.0.33-1","6.0.35-1","6.0.35-1+squeeze2","6.0.35-1+squeeze3","6.0.35-1+squeeze4","6.0.35-2","6.0.35-3","6.0.35-4","6.0.35-5","6.0.35-5+nmu1","6.0.35-6","6.0.35-7","6.0.37-1","6.0.39-1","6.0.41-1","6.0.41-2","6.0.41-2+squeeze5","6.0.41-2+squeeze6","6.0.41-2+squeeze7","6.0.41-3","6.0.41-4"],"bundled":6},{"source":"osv","ecosystem":"Debian:7","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.45+dfsg-1~deb7u1"}]}],"versions":["6.0.35-6","6.0.35-6+deb7u1","6.0.35-7","6.0.37-1","6.0.39-1","6.0.41-1","6.0.41-2","6.0.41-2+squeeze5","6.0.41-2+squeeze6","6.0.41-2+squeeze7","6.0.41-3","6.0.41-4","6.0.45-1~deb6u1"],"bundled":18},{"source":"osv","ecosystem":"Debian:7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.28-4+deb7u4"}]}],"versions":["7.0.28-4","7.0.28-4+deb7u1","7.0.28-4+deb7u2","7.0.28-4+deb7u3"],"bundled":7},{"source":"osv","ecosystem":"Debian:8","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.56-3+deb8u2"}]}],"versions":["7.0.56-3","7.0.56-3+deb8u1"],"bundled":7},{"source":"osv","ecosystem":"Debian:8","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.14-1+deb8u2"}]}],"versions":["8.0.14-1","8.0.14-1+deb8u1"],"bundled":8},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.0.M2"}]}],"versions":["9.0.0.M1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0.RC1"},{"fixed":"8.0.32"}]}],"versions":["8.0.1","8.0.11","8.0.12","8.0.14","8.0.15","8.0.17","8.0.18","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.5","8.0.8","8.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.70"}]}],"versions":["7.0.35","7.0.37","7.0.39","7.0.40","7.0.41","7.0.42","7.0.47","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57","7.0.59","7.0.61","7.0.62","7.0.63","7.0.64","7.0.65","7.0.67","7.0.68","7.0.69"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.46"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1.mga5"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:5","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.34-1.mga5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"httpd24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"httpd24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"httpd24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"httpd24-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"httpd24-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"mod_ldap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"mod_proxy24_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-61.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"mod_security-jws3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-7.GA.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"mod_security-jws3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-7.GA.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"mod_session24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"mod_ssl24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-61.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat8-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat8-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat8-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat8-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat8-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat8-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat8-servlet-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el6","package":"tomcat8-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"httpd24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"httpd24-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"httpd24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"httpd24-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"httpd24-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"mod_ldap24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"mod_proxy24_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-61.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"mod_security-jws3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-7.GA.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"mod_security-jws3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-7.GA.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"mod_session24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-61.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"mod_ssl24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-61.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.59-50_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat8-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat8-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat8-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat8-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat8-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat8-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat8-servlet-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.0::el7","package":"tomcat8-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.18-61_patch_01.ep7.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-98.el6_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.69-10.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-maven-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-maven-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-23_patch_05.ep6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-7.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-7.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.45-0.50.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.45-0.50.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.39-1ubuntu0.1"}]}],"versions":["6.0.37-1","6.0.39-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.6"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.45+dfsg-1"}]}],"versions":["6.0.41-4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.6"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.1"}]}],"versions":["7.0.64-1","7.0.68-1"],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.36-3.3"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14-1.1"}]}],"bundled":49}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://security.gentoo.org/glsa/201705-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1726196","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://seclists.org/bugtraq/2016/Feb/145","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web","article","report"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00085.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-9.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-3024-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00047.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2045.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1725263","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3530","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1726923","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1727166","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1727034","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1725914","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=145974991225029\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.securitytracker.com/id/1037640","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1089.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://tomcat.apache.org/security-8.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1087","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.securitytracker.com/id/1035069","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://bto.bluecoat.com/security-advisory/sa118","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2807.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1088","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20180531-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2808.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1726203","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00069.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1727182","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/83327","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2599.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.debian.org/security/2016/dsa-3609","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00082.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3552","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0714","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://web.archive.org/web/20170204045529/http://www.securityfocus.com/bid/83327","tags":["web"]},{"url":"https://web.archive.org/web/20170601064840/http://www.securitytracker.com/id/1035069","tags":["web"]},{"url":"https://web.archive.org/web/20170927131230/http://www.securitytracker.com/id/1037640","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/50f1b1da794cd93b70ab5456d3c2c984408e1506","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/79e8ad03404c131009811855f9a30d8d01c0c736","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/f626da75fd59da82b14dee7b8cc46ad51eefdbe5","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/ff1b659dc366a2ad47cd8f7e3544c796a1b15e46","tags":["web"]},{"url":"https://github.com/apache/tomcat80/commit/2e5cc28052e84ba45196949ba602484221bbf33c","tags":["web"]},{"url":"https://github.com/apache/tomcat80/commit/5430f30c79383e4d2d87785468905fcb00bace58","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20180531-0001","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/824eb1d1ad922e7652ecf51adb2b9eebb5bb88b5","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/e1b1002129fea4033329f6f619ba219527bbbd40","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mv42-px54-87jw"},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0090.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17847","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311082","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311087","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311093","tags":["report"]},{"url":"https://issues.redhat.com/browse/JWS-271","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-272","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-276","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-277","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-303","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-304","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-309","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-349","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-350","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1087.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5345","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5345","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Feb/146","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5346","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5346","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Feb/143","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5351","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5351","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Feb/148","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0706","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0706","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0706","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Feb/144","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0714","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0714","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0763","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0763","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0763","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Feb/147","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-310","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1088.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2045","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.45","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1265698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1353809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1357123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1367447","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2045.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5174","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5174","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5174","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Feb/149","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5388","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5388","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6325","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2599","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1133070","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1201409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1208402","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1221896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1229476","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1240279","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1277197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1287928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1311622","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1320853","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1327326","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1347774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1347860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1349468","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2599.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1191200","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0230","tags":["advisory"]},{"url":"http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44","tags":["article"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55","tags":["article"]},{"url":"http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3092","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3092","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3092","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2807","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2807.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160769-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/967812","tags":["report"]},{"url":"https://bugzilla.suse.com/967814","tags":["report"]},{"url":"https://bugzilla.suse.com/967815","tags":["report"]},{"url":"https://bugzilla.suse.com/967964","tags":["report"]},{"url":"https://bugzilla.suse.com/967965","tags":["report"]},{"url":"https://bugzilla.suse.com/967966","tags":["report"]},{"url":"https://bugzilla.suse.com/967967","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0763","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160822-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160839-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/934219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-0714","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3024-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-0706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-0763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3092","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-0714","description":"The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.","status":"published","published":"2016-02-25T01:00:00Z","modified":"2026-10-15T15:18:41.11Z","updated_at":"2026-11-02T14:33:37.446553Z"}],"euvd":[{"id":"EUVD-2022-4624","description":"The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.","status":"published","published":"2016-02-25T01:00:00Z","modified":"2026-10-15T15:18:41Z","updated_at":"2026-11-02T17:00:13.422137Z"}],"ghsa":[{"id":"GHSA-mv42-px54-87jw","title":"Improper Access Control in Apache Tomcat","description":"The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.","status":"published","published":"2022-05-14T01:10:17Z","modified":"2024-02-29T23:35:58Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:38.935144Z"}],"nvd":[{"id":"CVE-2016-0714","description":"The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.","status":"published","published":"2016-02-25T01:59:05.263Z","modified":"2026-10-15T16:17:15.233Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"CVE-2016-0714","description":"The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.","status":"published","published":"2016-02-25T01:59:05.263Z","modified":"2026-10-24T10:30:18.908489864Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"GHSA-mv42-px54-87jw","title":"Improper Access Control in Apache Tomcat","description":"The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.","status":"published","published":"2022-05-14T01:10:17Z","modified":"2024-03-10T05:19:08.120062Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"RHSA-2016:1087","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update","status":"published","published":"2024-09-15T23:05:31Z","modified":"2026-10-15T10:01:23Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:1088","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 update","status":"published","published":"2024-09-15T23:05:36Z","modified":"2026-10-15T10:01:24Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2045","title":"Red Hat Security Advisory: tomcat6 security and bug fix update","status":"published","published":"2024-09-15T23:31:51Z","modified":"2026-10-15T10:01:25Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2599","title":"Red Hat Security Advisory: tomcat security, bug fix, and enhancement update","status":"published","published":"2024-09-22T16:30:07Z","modified":"2026-10-15T10:01:25Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2807","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7","status":"published","published":"2024-09-22T16:29:57Z","modified":"2026-10-08T10:01:21Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-0714","description":"The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.","status":"published","published":"2016-02-24T00:00:00Z","modified":"2026-02-04T02:47:58.35111Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"DLA-435-1","title":"tomcat6 - security update","status":"published","published":"2016-02-27T00:00:00Z","modified":"2026-03-09T02:10:09.003522Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-3530-1","title":"tomcat6 - security update","status":"published","published":"2016-03-25T00:00:00Z","modified":"2026-03-09T01:22:25.978219Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3552-1","title":"tomcat7 - security update","status":"published","published":"2016-04-17T00:00:00Z","modified":"2026-03-09T01:21:14.006097Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"DSA-3609-1","title":"tomcat8 - security update","status":"published","published":"2016-06-29T00:00:00Z","modified":"2026-03-09T01:21:13.633598Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0090","title":"Updated tomcat packages fix security vulnerabilities","description":"Updated tomcat packages fix security vulnerabilities:\n\nDirectory traversal vulnerability in RequestUtil.java in Apache Tomcat 7.x\nbefore 7.0.65 allows remote authenticated users to bypass intended\nSecurityManager restrictions and list a parent directory via a /.. (slash dot\ndot) in a pathname used by a web application in a getResource,\ngetResourceAsStream, or getResourcePaths call, as demonstrated by the\n$CATALINA_BASE/webapps directory (CVE-2015-5174).\n\nThe Mapper component in 7.x before 7.0.67 processes redirects before\nconsidering security constraints and Filters, which allows remote attackers\nto determine the existence of a directory via a URL that lacks a trailing /\n(slash) character (CVE-2015-5345).\n\nSession fixation vulnerability in Apache Tomcat 7.x before 7.0.66, when\ndifferent session settings are used for deployments of multiple versions of\nthe same web application, might allow remote attackers to hijack web sessions\nby leveraging use of a requestedSessionSSL field for an unintended request,\nrelated to CoyoteAdapter.java and Request.java (CVE-2015-5346).\n\nThe Manager and Host Manager applications in Apache Tomcat 7.x before 7.0.68\nestablish sessions and send CSRF tokens for arbitrary new requests, which\nallows remote attackers to bypass a CSRF protection mechanism by using a\ntoken (CVE-2015-5351).\n\nApache Tomcat 7.x before 7.0.68 does not place\norg.apache.catalina.manager.StatusManagerServlet on the\norg/apache/catalina/core/RestrictedServlets.properties list, which allows\nremote authenticated users to bypass intended SecurityManager restrictions\nand read arbitrary HTTP requests, and consequently discover session ID\nvalues, via a crafted web application (CVE-2016-0706).\n\nThe session-persistence implementation in Apache Tomcat 7.x before 7.0.68\nmishandles session attributes, which allows remote authenticated users to\nbypass intended SecurityManager restrictions and execute arbitrary code in a\nprivileged context via a web application that places a crafted object in a\nsession (CVE-2016-0714).\n\nThe setGlobalContext method in\norg/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x\nbefore 7.0.68 does not consider whether ResourceLinkFactory.setGlobalContext\ncallers are authorized, which allows remote authenticated users to bypass\nintended SecurityManager restrictions and read or write to arbitrary\napplication data, or cause a denial of service (application disruption), via\na web application that sets a crafted global context (CVE-2016-0763).\n\nThe tomcat package has been updated to version 7.0.68 to fix these issues.\nThe tomcat-native package has also been updated to version 1.1.34 for\ncompatibility with the updated tomcat.\n","status":"published","published":"2016-03-02T18:28:46Z","modified":"2026-04-16T06:26:27.268569259Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10446-1","title":"tomcat-8.0.36-3.3 on GA media","description":"These are all security issues fixed in the tomcat-8.0.36-3.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:19:08.859786Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:13441-1","title":"tomcat10-10.1.14-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:52.718146Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2016:0769-1","title":"Security update for tomcat","description":"\nThis update for tomcat fixes the following issues:\n\nTomcat 8 was updated from 8.0.23 to 8.0.32, to fix bugs and security issues.\n\nFixed security issues:\n\n* CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java\n  in Apache Tomcat allowed remote authenticated users to bypass intended\n  SecurityManager restrictions and list a parent directory via a /.. (slash\n  dot dot) in a pathname used by a web application in a getResource,\n  getResourceAsStream, or getResourcePaths call, as demonstrated by the\n  $CATALINA_BASE/webapps directory.  (bsc#967967)\n* CVE-2015-5346: Session fixation vulnerability in Apache Tomcat when\n  different session settings are used for deployments of multiple versions\n  of the same web application, might have allowed remote attackers\n  to hijack web sessions by leveraging use of a requestedSessionSSL\n  field for an unintended request, related to CoyoteAdapter.java and\n  Request.java. (bsc#967814)\n* CVE-2015-5345: The Mapper component in Apache Tomcat processes redirects\n  before considering security constraints and Filters, which allowed remote\n  attackers to determine the existence of a directory via a URL that lacks\n  a trailing / (slash) character. (bsc#967965)\n* CVE-2015-5351: The (1) Manager and (2) Host Manager applications in\n  Apache Tomcat established sessions and send CSRF tokens for arbitrary\n  new requests, which allowed remote attackers to bypass a CSRF protection\n  mechanism by using a token. (bsc#967812)\n* CVE-2016-0706: Apache Tomcat did not place\n  org.apache.catalina.manager.StatusManagerServlet on the\n  org/apache/catalina/core/RestrictedServlets.properties list, which\n  allowed remote authenticated users to bypass intended SecurityManager\n  restrictions and read arbitrary HTTP requests, and consequently discover\n  session ID values, via a crafted web application.  (bsc#967815)\n* CVE-2016-0714: The session-persistence implementation in Apache Tomcat\n  mishandled session attributes, which allowed remote authenticated users\n  to bypass intended SecurityManager restrictions and execute arbitrary\n  code in a privileged context via a web application that places a crafted\n  object in a session. (bsc#967964)\n* CVE-2016-0763: The setGlobalContext method in\n  org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat did\n  not consider whether ResourceLinkFactory.setGlobalContext callers are\n  authorized, which allowed remote authenticated users to bypass intended\n  SecurityManager restrictions and read or write to arbitrary application\n  data, or cause a denial of service (application disruption), via a web\n  application that sets a crafted global context.  (bsc#967966)\n\nThe full changes can be read on:\n    http://tomcat.apache.org/tomcat-8.0-doc/changelog.html\n","status":"published","published":"2016-03-15T10:19:01Z","modified":"2026-02-04T02:23:14.894661Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0822-1","title":"Security update for tomcat","description":"\nThis update for tomcat fixes the following security issues.\n\nTomcat has been updated from 7.0.55 to 7.0.68.\n\n* CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java\n  in Apache Tomcat allowed remote authenticated users to bypass intended\n  SecurityManager restrictions and list a parent directory via a /.. (slash\n  dot dot) in a pathname used by a web application in a getResource,\n  getResourceAsStream, or getResourcePaths call, as demonstrated by the\n  $CATALINA_BASE/webapps directory.  (bsc#967967)\n* CVE-2015-5346: Session fixation vulnerability in Apache Tomcat when\n  different session settings are used for deployments of multiple versions\n  of the same web application, might have allowed remote attackers\n  to hijack web sessions by leveraging use of a requestedSessionSSL\n  field for an unintended request, related to CoyoteAdapter.java and\n  Request.java. (bsc#967814)\n* CVE-2015-5345: The Mapper component in Apache Tomcat processes redirects\n  before considering security constraints and Filters, which allowed remote\n  attackers to determine the existence of a directory via a URL that lacks\n  a trailing / (slash) character. (bsc#967965)\n* CVE-2015-5351: The (1) Manager and (2) Host Manager applications in\n  Apache Tomcat established sessions and send CSRF tokens for arbitrary\n  new requests, which allowed remote attackers to bypass a CSRF protection\n  mechanism by using a token. (bsc#967812)\n* CVE-2016-0706: Apache Tomcat did not place\n  org.apache.catalina.manager.StatusManagerServlet on the\n  org/apache/catalina/core/RestrictedServlets.properties list, which\n  allowed remote authenticated users to bypass intended SecurityManager\n  restrictions and read arbitrary HTTP requests, and consequently discover\n  session ID values, via a crafted web application.  (bsc#967815)\n* CVE-2016-0714: The session-persistence implementation in Apache Tomcat\n  mishandled session attributes, which allowed remote authenticated users\n  to bypass intended SecurityManager restrictions and execute arbitrary\n  code in a privileged context via a web application that places a crafted\n  object in a session. (bsc#967964)\n* CVE-2016-0763: The setGlobalContext method in\n  org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat did\n  not consider whether ResourceLinkFactory.setGlobalContext callers are\n  authorized, which allowed remote authenticated users to bypass intended\n  SecurityManager restrictions and read or write to arbitrary application\n  data, or cause a denial of service (application disruption), via a web\n  application that sets a crafted global context.  (bsc#967966)\n\nSee https://tomcat.apache.org/tomcat-7.0-doc/changelog.html\n  for other fixes since 7.0.55\n","status":"published","published":"2016-03-18T14:14:17Z","modified":"2026-02-04T03:45:05.119483Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0839-1","title":"Security update for tomcat6","description":"\nThis update for tomcat6 fixes the following issues:\n\nThe version was updated from 6.0.41 to 6.0.45.\n\nSecurity issues fixed:\n\n* CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java\n  in Apache Tomcat allowed remote authenticated users to bypass intended\n  SecurityManager restrictions and list a parent directory via a /.. (slash\n  dot dot) in a pathname used by a web application in a getResource,\n  getResourceAsStream, or getResourcePaths call, as demonstrated by the\n  $CATALINA_BASE/webapps directory.  (bsc#967967)\n* CVE-2015-5345: The Mapper component in Apache Tomcat processes redirects\n  before considering security constraints and Filters, which allowed remote\n  attackers to determine the existence of a directory via a URL that lacks\n  a trailing / (slash) character. (bsc#967965)\n* CVE-2016-0706: Apache Tomcat did not place\n  org.apache.catalina.manager.StatusManagerServlet on the\n  org/apache/catalina/core/RestrictedServlets.properties list, which\n  allowed remote authenticated users to bypass intended SecurityManager\n  restrictions and read arbitrary HTTP requests, and consequently discover\n  session ID values, via a crafted web application.  (bsc#967815)\n* CVE-2016-0714: The session-persistence implementation in Apache Tomcat\n  mishandled session attributes, which allowed remote authenticated users\n  to bypass intended SecurityManager restrictions and execute arbitrary\n  code in a privileged context via a web application that places a crafted\n  object in a session. (bsc#967964)\n","status":"published","published":"2016-03-21T09:27:05Z","modified":"2026-02-04T03:53:56.521369Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"USN-3024-1","title":"tomcat6, tomcat7 vulnerabilities","description":"It was discovered that Tomcat incorrectly handled pathnames used by web\napplications in a getResource, getResourceAsStream, or getResourcePaths\ncall. A remote attacker could use this issue to possibly list a parent\ndirectory . This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and\nUbuntu 15.10. (CVE-2015-5174)\n\nIt was discovered that the Tomcat mapper component incorrectly handled\nredirects. A remote attacker could use this issue to determine the\nexistence of a directory. This issue only affected Ubuntu 12.04 LTS,\nUbuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-5345)\n\nIt was discovered that Tomcat incorrectly handled different session\nsettings when multiple versions of the same web application was deployed. A\nremote attacker could possibly use this issue to hijack web sessions. This\nissue only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-5346)\n\nIt was discovered that the Tomcat Manager and Host Manager applications\nincorrectly handled new requests. A remote attacker could possibly use this\nissue to bypass CSRF protection mechanisms. This issue only affected Ubuntu\n14.04 LTS and Ubuntu 15.10. (CVE-2015-5351)\n\nIt was discovered that Tomcat did not place StatusManagerServlet on the\nRestrictedServlets list. A remote attacker could possibly use this issue to\nread arbitrary HTTP requests, including session ID values. This issue only\naffected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.10.\n(CVE-2016-0706)\n\nIt was discovered that the Tomcat session-persistence implementation\nincorrectly handled session attributes. A remote attacker could possibly\nuse this issue to execute arbitrary code in a privileged context. This\nissue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.10.\n(CVE-2016-0714)\n\nIt was discovered that the Tomcat setGlobalContext method incorrectly\nchecked if callers were authorized. A remote attacker could possibly use\nthis issue to read or wite to arbitrary application data, or cause a denial\nof service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and\nUbuntu 15.10. (CVE-2016-0763)\n\nIt was discovered that the Tomcat Fileupload library incorrectly handled\ncertain upload requests. A remote attacker could possibly use this issue to\ncause a denial of service. (CVE-2016-3092)\n","status":"published","published":"2016-07-05T16:55:53Z","modified":"2026-10-17T12:52:48.145860781Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}