{"id":"CVE-2017-12616","aliases":["CLSA-2026-1789677164","DEBIAN-CVE-2017-12616","DLA-1108-1","DLA-1400-1","EUVD-2022-3217","GHSA-8qq4-8jvq-mfw4","MGASA-2017-0352","RHSA-2018:0466","SUSE-SU-2017:3059-1","UBUNTU-CVE-2017-12616","USN-3665-1","USN-7282-1"],"status":"published","title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","description":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.70118,"percentile":0.99384,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-09-19T00:00:00Z","modified":"2026-10-24T10:31:01Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["7.0.81"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:7","package":"tomcat7","fixed_in":["7.0.28-4+deb7u15"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","fixed_in":["7.0.52-1ubuntu0.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","fixed_in":["7.0.68-1ubuntu0.4+esm3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.80"},{"fixed":"7.0.81"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-logging-juli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-logging-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.extras:tomcat-extras-juli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.extras:tomcat-extras-juli-adapters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-annotations-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-ant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-ha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-jmx-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-el-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-i18n-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-i18n-fr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-i18n-ja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jasper-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jsp-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-juli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-servlet-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat7-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"Debian:7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.28-4+deb7u15"}]}],"versions":["7.0.28-4","7.0.28-4+deb7u1","7.0.28-4+deb7u10","7.0.28-4+deb7u11","7.0.28-4+deb7u12","7.0.28-4+deb7u13","7.0.28-4+deb7u14","7.0.28-4+deb7u2","7.0.28-4+deb7u3","7.0.28-4+deb7u4","7.0.28-4+deb7u5","7.0.28-4+deb7u6","7.0.28-4+deb7u7","7.0.28-4+deb7u8","7.0.28-4+deb7u9"]},{"source":"osv","ecosystem":"Debian:8","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.56-3+really7.0.88-1"}]}],"versions":["7.0.56-3","7.0.56-3+deb8u1","7.0.56-3+deb8u10","7.0.56-3+deb8u11","7.0.56-3+deb8u2","7.0.56-3+deb8u3","7.0.56-3+deb8u4","7.0.56-3+deb8u5","7.0.56-3+deb8u6","7.0.56-3+deb8u7","7.0.56-3+deb8u8","7.0.56-3+deb8u9"],"bundled":5},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.81"}]}],"versions":["7.0.0","7.0.11","7.0.12","7.0.14","7.0.16","7.0.19","7.0.2","7.0.20","7.0.21","7.0.22","7.0.23","7.0.25","7.0.26","7.0.27","7.0.28","7.0.29","7.0.30","7.0.32","7.0.33","7.0.34","7.0.35","7.0.37","7.0.39","7.0.4","7.0.40","7.0.41","7.0.42","7.0.47","7.0.5","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57","7.0.59","7.0.6","7.0.61","7.0.62","7.0.63","7.0.64","7.0.65","7.0.67","7.0.68","7.0.69","7.0.70","7.0.72","7.0.73","7.0.75","7.0.76","7.0.77","7.0.78","7.0.79","7.0.8"]},{"source":"osv","ecosystem":"Mageia:5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.81-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.46-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.8-2.Final_redhat_2.1.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"mod_cluster-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.8-2.Final_redhat_2.1.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"mod_cluster-tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.8-2.Final_redhat_2.1.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-11.redhat_11.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-11.redhat_11.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.Final_redhat_1.1.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-vault-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.Final_redhat_1.1.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-vault-tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.Final_redhat_1.1.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-servlet-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.8-2.Final_redhat_2.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"mod_cluster-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.8-2.Final_redhat_2.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"mod_cluster-tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.8-2.Final_redhat_2.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-11.redhat_11.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-11.redhat_11.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.Final_redhat_1.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-vault-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.Final_redhat_1.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-vault-tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.Final_redhat_1.1.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-25.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-servlet-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-29.ep7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.82-7.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.14"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3","7.0.52-1ubuntu0.6","7.0.52-1ubuntu0.7","7.0.52-1ubuntu0.8","7.0.52-1ubuntu0.9","7.0.52-1ubuntu0.10","7.0.52-1ubuntu0.11","7.0.52-1ubuntu0.13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+esm3"}]}],"versions":["7.0.64-1","7.0.68-1","7.0.68-1ubuntu0.1","7.0.68-1ubuntu0.3","7.0.68-1ubuntu0.4","7.0.68-1ubuntu0.4+esm1","7.0.68-1ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.78-1","7.0.78-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.14"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3","7.0.52-1ubuntu0.6","7.0.52-1ubuntu0.7","7.0.52-1ubuntu0.8","7.0.52-1ubuntu0.9","7.0.52-1ubuntu0.10","7.0.52-1ubuntu0.11","7.0.52-1ubuntu0.13"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.6"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4","8.0.32-1ubuntu1.5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.30-1ubuntu1.2"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+esm3"}]}],"versions":["7.0.64-1","7.0.68-1","7.0.68-1ubuntu0.1","7.0.68-1ubuntu0.3","7.0.68-1ubuntu0.4","7.0.68-1ubuntu0.4+esm1","7.0.68-1ubuntu0.4+esm2"],"bundled":2}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"}],"references":[{"url":"http://www.securitytracker.com/id/1039393","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03828en_us","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.synology.com/support/security/Synology_SA_17_54_Tomcat","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://usn.ubuntu.com/3665-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/100897","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20171018-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6%40%3Cannounce.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12616","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6@%3Cannounce.tomcat.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8qq4-8jvq-mfw4"},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20171018-0001","tags":["web"]},{"url":"https://usn.ubuntu.com/3665-1","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2017-0352.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21714","tags":["report"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.79","tags":["web"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81","tags":["web","article","report"]},{"url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.45","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CH5PGYTIBGQHGGUEXRIIGNXJSLBNYYUS/","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2017/09/19/2","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1493220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1493222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1506523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1540824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1548282","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1548289","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0466.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12613","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12613","tags":["advisory"]},{"url":"http://www.apache.org/dist/apr/Announcement1.x.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12615","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12615","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12616","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12616","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12617","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12617","tags":["advisory"]},{"url":"https://tomcat.apache.org/security-7.html","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15698","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15698","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1304","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1304","tags":["advisory"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.85","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.50","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.28","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1305","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1305","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173059-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1042910","tags":["report"]},{"url":"https://bugzilla.suse.com/1053352","tags":["report"]},{"url":"https://bugzilla.suse.com/1059551","tags":["report"]},{"url":"https://bugzilla.suse.com/1059554","tags":["report"]},{"url":"https://bugzilla.suse.com/977410","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7674","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-12616","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3665-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7282-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-12617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-15706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-8014","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-12616","description":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.","status":"published","published":"2017-09-19T13:00:00Z","modified":"2026-10-15T15:52:29.095Z","updated_at":"2026-11-02T14:33:16.916541Z"}],"euvd":[{"id":"EUVD-2022-3217","description":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.","status":"published","published":"2017-09-19T13:00:00Z","modified":"2026-10-15T15:52:29Z","updated_at":"2026-11-02T17:00:12.978606Z"}],"ghsa":[{"id":"GHSA-8qq4-8jvq-mfw4","title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","description":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.","status":"published","published":"2022-05-14T01:10:16Z","modified":"2023-01-27T05:02:12Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:17.04874Z"}],"nvd":[{"id":"CVE-2017-12616","description":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.","status":"published","published":"2017-09-19T13:29:00.487Z","modified":"2026-10-15T16:17:26.987Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:59.716532Z"}],"osv":[{"id":"CVE-2017-12616","description":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.","status":"published","published":"2017-09-19T13:29:00.487Z","modified":"2026-10-24T10:31:01.68334556Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:04.159616Z"},{"id":"GHSA-8qq4-8jvq-mfw4","title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","description":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.","status":"published","published":"2022-05-14T01:10:16Z","modified":"2024-02-20T05:33:03.83309Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"RHSA-2018:0466","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update","status":"published","published":"2024-09-16T00:32:41Z","modified":"2026-09-21T10:01:55Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2017-12616","description":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.","status":"published","published":"2017-09-19T00:00:00Z","modified":"2026-02-04T03:44:45.544445Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"CLSA-2026-1789677164","title":"TuxCare security update for 32 packages (16 CVEs)","description":"TuxCare rebuilt 32 packages to address 16 CVEs. Fixed in 7.0.70-tuxcare.4.","status":"published","published":"2026-09-17T20:32:44Z","modified":"2026-10-15T09:47:44.399297734Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"DLA-1108-1","title":"tomcat7 - security update","status":"published","published":"2017-09-24T00:00:00Z","modified":"2026-03-09T01:01:49.568365Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-1400-1","title":"tomcat7 - security update","status":"published","published":"2018-06-27T00:00:00Z","modified":"2026-03-09T01:01:12.98098Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2017-0352","title":"Updated tomcat packages fix security vulnerability","description":"The CORS Filter did not add an HTTP Vary header indicating that the\nresponse varies depending on Origin. This permitted client and server\nside cache poisoning in some circumstances (CVE-2017-7674).\n\nWhen using a VirtualDirContext it was possible to bypass security\nconstraints and/or view the source code of JSPs for resources served\nby the VirtualDirContext using a specially crafted request\n(CVE-2017-12616).\n\nNote that CVE-2017-12616 only affected tomcat 7 in Mageia 5.\n","status":"published","published":"2017-09-21T13:43:32Z","modified":"2026-04-16T06:23:43.777837131Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2017:3059-1","title":"Security update for tomcat","description":"\n\nApache Tomcat was updated to 7.0.82 adding features, fixing bugs and security issues.\n\nThis is another bugfix release, for full details see:\n\n    https://tomcat.apache.org/tomcat-7.0-doc/changelog.html\n\nFixed security issues:\n\n- CVE-2017-5664: A problem in handling error pages was fixed, to avoid potential file overwrites during error page handling. (bsc#1042910).\n- CVE-2017-7674: A CORS Filter issue could lead to client and server side cache poisoning (bsc#1053352)\n- CVE-2017-12617: A remote code execution possibility via JSP Upload was fixed (bsc#1059554)\n- CVE-2017-12616: An information disclosure when using VirtualDirContext was fixed (bsc#1059551)\n- CVE-2017-12615: A Remote Code Execution via JSP Upload was fixed (bsc#1059554)\n\nNon-security issues fixed:\n\n- Fix tomcat-digest classpath error (bsc#977410) \n","status":"published","published":"2017-11-23T16:16:52Z","modified":"2026-02-04T03:47:33.247676Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-3665-1","title":"tomcat7, tomcat8 vulnerabilities","description":"It was discovered that Tomcat incorrectly handled being configured with\nHTTP PUTs enabled. A remote attacker could use this issue to upload a JSP\nfile to the server and execute arbitrary code. This issue only affected\nUbuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-12616,\nCVE-2017-12617)\n\nIt was discovered that Tomcat contained incorrect documentation regarding\ndescription of the search algorithm used by the CGI Servlet to identify\nwhich script to execute. This issue only affected Ubuntu 17.10.\n(CVE-2017-15706)\n\nIt was discovered that Tomcat incorrectly handled en empty string URL\npattern in security constraint definitions. A remote attacker could\npossibly use this issue to gain access to web application resources,\ncontrary to expectations. This issue only affected Ubuntu 14.04 LTS,\nUbuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-1304)\n\nIt was discovered that Tomcat incorrectly handled applying certain security\nconstraints. A remote attacker could possibly access certain resources,\ncontrary to expectations. This issue only affected Ubuntu 14.04 LTS,\nUbuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-1305)\n\nIt was discovered that the Tomcat CORS filter default settings were\ninsecure and would enable 'supportsCredentials' for all origins, contrary\nto expectations. (CVE-2018-8014)\n","status":"published","published":"2018-05-30T17:47:08Z","modified":"2026-04-27T15:33:05.810105643Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-7282-1","title":"tomcat7 vulnerabilities","description":"It was discovered that Tomcat incorrectly handled being configured with\nHTTP PUTs enabled. A remote attacker could use this issue to upload a JSP\nfile to the server and execute arbitrary code.\n","status":"published","published":"2025-02-21T00:19:44Z","modified":"2026-06-25T13:32:30.101592055Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}