{"id":"CVE-2017-5647","aliases":["CLSA-2026-1789677164","DLA-924-1","DSA-3842-1","DSA-3843-1","EUVD-2022-2183","GHSA-3gv7-3h64-78cm","MGASA-2017-0117","RHSA-2017:1801","RHSA-2017:2493","RHSA-2017:3080","RHSA-2017:3081","SUSE-SU-2017:1229-1","SUSE-SU-2017:1382-1","SUSE-SU-2017:1632-1","SUSE-SU-2017:1660-1","UBUNTU-CVE-2017-5647","USN-3519-1","openSUSE-SU-2024:11468-1","openSUSE-SU-2024:13441-1"],"status":"published","title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","description":"A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.1684,"percentile":0.97063,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-04-17T00:00:00Z","modified":"2026-11-04T02:31:03Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["9.0.0.M19","8.5.13","7.0.77","6.0.53","8.0.43"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","fixed_in":["7.0.52-1ubuntu0.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"tomcat8","fixed_in":["8.0.32-1ubuntu1.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"last_affected":"9.0.0.M18"},{"fixed":"9.0.0.M19"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.12"},{"fixed":"8.5.13"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.76"},{"fixed":"7.0.77"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"last_affected":"6.0.52"},{"fixed":"6.0.53"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.0.42"},{"fixed":"8.0.43"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-logging-juli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-logging-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.extras:tomcat-extras-juli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.extras:tomcat-extras-juli-adapters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-annotations-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-ant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-ha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-jmx-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-el-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-i18n-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-i18n-fr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-i18n-ja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jasper-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jsp-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-juli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-servlet-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat7-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"Debian:7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.28-4+deb7u12"}]}],"versions":["7.0.28-4","7.0.28-4+deb7u1","7.0.28-4+deb7u10","7.0.28-4+deb7u11","7.0.28-4+deb7u2","7.0.28-4+deb7u3","7.0.28-4+deb7u4","7.0.28-4+deb7u5","7.0.28-4+deb7u6","7.0.28-4+deb7u7","7.0.28-4+deb7u8","7.0.28-4+deb7u9"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.56-3+deb8u10"}]}],"versions":["7.0.56-3","7.0.56-3+deb8u1","7.0.56-3+deb8u2","7.0.56-3+deb8u3","7.0.56-3+deb8u4","7.0.56-3+deb8u5","7.0.56-3+deb8u6","7.0.56-3+deb8u7","7.0.56-3+deb8u8","7.0.56-3+deb8u9"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.14-1+deb8u9"}]}],"versions":["8.0.14-1","8.0.14-1+deb8u1","8.0.14-1+deb8u2","8.0.14-1+deb8u3","8.0.14-1+deb8u4","8.0.14-1+deb8u5","8.0.14-1+deb8u6","8.0.14-1+deb8u7","8.0.14-1+deb8u8"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.0.M19"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.13"}]}],"versions":["8.5.0","8.5.11","8.5.12","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.8","8.5.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.43"}]}],"versions":["8.0.1","8.0.11","8.0.12","8.0.14","8.0.15","8.0.17","8.0.18","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.32","8.0.33","8.0.35","8.0.36","8.0.37","8.0.38","8.0.39","8.0.41","8.0.42","8.0.5","8.0.8","8.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.77"}]}],"versions":["7.0.35","7.0.37","7.0.39","7.0.40","7.0.41","7.0.42","7.0.47","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57","7.0.59","7.0.61","7.0.62","7.0.63","7.0.64","7.0.65","7.0.67","7.0.68","7.0.69","7.0.70","7.0.72","7.0.73","7.0.75","7.0.76"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.53"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.77-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"log4j-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.16-12.redhat_3.1.ep6.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-10.redhat_10.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-10.redhat_10.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-servlet-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el6"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"log4j-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.16-12.redhat_3.1.ep6.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-10.redhat_10.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.8-10.redhat_10.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-22.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-servlet-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-24.ep7.el7"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-maven-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-maven-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2h-13.jbcs.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-maven-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.41-17_patch_04.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-maven-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el7","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.54-25_patch_05.ep6.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-111.el6_9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-3.el7_4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.43-23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.43-23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.43-23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.43-10.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.43-10.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.53-0.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.53-0.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.53-0.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.53-0.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.53-0.56.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.78-7.13.4"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.78-7.13.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.13"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3","7.0.52-1ubuntu0.6","7.0.52-1ubuntu0.7","7.0.52-1ubuntu0.8","7.0.52-1ubuntu0.9","7.0.52-1ubuntu0.10","7.0.52-1ubuntu0.11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.37-1","6.0.39-1","6.0.39-1ubuntu0.1","6.0.39-1ubuntu0.1+esm1","6.0.39-1ubuntu0.1+esm2","6.0.39-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.5"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.64-1","7.0.68-1","7.0.68-1ubuntu0.1","7.0.68-1ubuntu0.3","7.0.68-1ubuntu0.4","7.0.68-1ubuntu0.4+esm1","7.0.68-1ubuntu0.4+esm2","7.0.68-1ubuntu0.4+esm3","7.0.68-1ubuntu0.4+esm4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.13"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3","7.0.52-1ubuntu0.6","7.0.52-1ubuntu0.7","7.0.52-1ubuntu0.8","7.0.52-1ubuntu0.9","7.0.52-1ubuntu0.10","7.0.52-1ubuntu0.11"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.5"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-8.4"}]}],"bundled":25},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14-1.1"}]}],"bundled":49}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"}],"references":[{"url":"https://security.gentoo.org/glsa/201705-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20180614-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3080","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1801","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.debian.org/security/2017/dsa-3843","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://www.arubanetworks.com/assets/alert/HPESBHF03730.txt","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2494","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://lists.apache.org/thread.html/5796678c5a773c6f3ff57c178ac247d85ceca0dee9190ba48171451a%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1038218","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.debian.org/security/2017/dsa-3842","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03730en_us","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1802","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2493","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3081","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5647","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/5796678c5a773c6f3ff57c178ac247d85ceca0dee9190ba48171451a@%3Cusers.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://web.archive.org/web/20170420114447/http://www.securitytracker.com/id/1038218","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/864aa1199ad2cccc9a7e7c6b977f7d7f812c9910","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/a4efd3ca1ccbdfc398136d76c0d8b7ad5a1e4905","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/f5e06b8c743b1daa9eb5e817863958b6b320e044","tags":["web"]},{"url":"https://github.com/apache/tomcat80/commit/ec10b8c785d1db91fe58946436f854dde04410fd","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20180614-0001","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3gv7-3h64-78cm"},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2017-0117.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20655","tags":["report"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.77","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1441205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1441223","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1443635","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459158","tags":["report"]},{"url":"https://issues.redhat.com/browse/JWS-657","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-667","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-695","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-709","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-716","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-717","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-725","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-741","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-760","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1801.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377600","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6304","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20160922.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1412120","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7056","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7056","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8610","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1384743","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8610","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8610","tags":["advisory"]},{"url":"http://security.360.cn/cve/CVE-2016-8610","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5645","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5645","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5645","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5647","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5647","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5648","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5664","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5664","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5664","tags":["advisory"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7674","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480618","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7674","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7674","tags":["advisory"]},{"url":"https://tomcat.apache.org/security-7.html","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-17571","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1785616","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17571","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17571","tags":["advisory"]},{"url":"https://access.redhat.com/articles/3155411","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2493.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461851","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1493220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494283","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3080.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12615","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12615","tags":["advisory"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12617","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12617","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3081.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171229-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1015119","tags":["report"]},{"url":"https://bugzilla.suse.com/1033447","tags":["report"]},{"url":"https://bugzilla.suse.com/1033448","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5648","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171382-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171632-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1007853","tags":["report"]},{"url":"https://bugzilla.suse.com/1007854","tags":["report"]},{"url":"https://bugzilla.suse.com/1007855","tags":["report"]},{"url":"https://bugzilla.suse.com/1007857","tags":["report"]},{"url":"https://bugzilla.suse.com/1007858","tags":["report"]},{"url":"https://bugzilla.suse.com/1011805","tags":["report"]},{"url":"https://bugzilla.suse.com/1011812","tags":["report"]},{"url":"https://bugzilla.suse.com/1036642","tags":["report"]},{"url":"https://bugzilla.suse.com/988489","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8735","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171660-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/986359","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3092","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-5647","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/04/10/24","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3519-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-5648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7674","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-5647","description":"A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.","status":"published","published":"2017-04-17T16:00:00Z","modified":"2026-11-02T17:27:36.591Z","updated_at":"2026-11-02T19:02:29.283836Z"}],"euvd":[{"id":"EUVD-2022-2183","description":"A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.","status":"published","published":"2017-04-17T16:00:00Z","modified":"2026-11-02T17:27:36Z","updated_at":"2026-11-03T05:08:39.764975Z"}],"ghsa":[{"id":"GHSA-3gv7-3h64-78cm","title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","description":"A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.","status":"published","published":"2022-05-14T01:10:16Z","modified":"2024-03-19T13:56:26Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:41.821668Z"}],"nvd":[{"id":"CVE-2017-5647","description":"A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.","status":"published","published":"2017-04-17T16:59:00.32Z","modified":"2026-11-02T18:18:19.767Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T20:51:29.040079Z"}],"osv":[{"id":"CVE-2017-5647","description":"A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.","status":"published","published":"2017-04-17T16:59:00.32Z","modified":"2026-11-04T02:31:03.860835626Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-04T02:54:44.889498Z"},{"id":"GHSA-3gv7-3h64-78cm","title":"Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat","description":"A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.","status":"published","published":"2022-05-14T01:10:16Z","modified":"2024-03-19T14:11:25.246843Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"RHSA-2017:1801","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update","status":"published","published":"2024-09-20T13:49:59Z","modified":"2026-09-21T10:01:43Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:2493","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2 security update","status":"published","published":"2024-09-16T00:20:31Z","modified":"2026-09-21T10:01:45Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:3080","title":"Red Hat Security Advisory: tomcat6 security update","status":"published","published":"2024-09-16T00:25:15Z","modified":"2026-08-05T10:04:53Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2017:3081","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2024-09-16T00:25:22Z","modified":"2026-08-05T10:04:54Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2017-5647","description":"A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.","status":"published","published":"2017-04-17T00:00:00Z","modified":"2026-06-04T12:45:11.185260793Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"CLSA-2026-1789677164","title":"TuxCare security update for 32 packages (16 CVEs)","description":"TuxCare rebuilt 32 packages to address 16 CVEs. Fixed in 7.0.70-tuxcare.4.","status":"published","published":"2026-09-17T20:32:44Z","modified":"2026-10-15T09:47:44.399297734Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"DLA-924-1","title":"tomcat7 - security update","status":"published","published":"2017-04-28T00:00:00Z","modified":"2026-03-09T02:09:57.697702Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-3842-1","title":"tomcat7 - security update","status":"published","published":"2017-05-03T00:00:00Z","modified":"2026-03-09T01:18:40.675374Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"DSA-3843-1","title":"tomcat8 - security update","status":"published","published":"2017-05-03T00:00:00Z","modified":"2026-03-09T01:20:11.139508Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0117","title":"Updated tomcat packages fix security vulnerability","description":"A bug in the handling of the pipelined requests when send file was used\nresulted in the pipelined request being lost when send file processing of\nthe previous request completed. This could result in responses appearing\nto be sent for the wrong request. For example, a user agent that sent\nrequests A, B and C could see the correct response for request A, the\nresponse for request C for request B and no response for request C\n(CVE-2017-5647).\n\nWhile investigating bug 60718, it was noticed that some calls to\napplication listeners did not use the appropriate facade object. When\nrunning an untrusted application under a SecurityManager, it was therefore\npossible for that untrusted application to retain a reference to the\nrequest or response object and thereby access and/or modify information\nassociated with another web application (CVE-2017-5648).\n","status":"published","published":"2017-04-27T22:21:29Z","modified":"2026-04-16T06:24:14.418618151Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11468-1","title":"tomcat-9.0.36-8.4 on GA media","description":"These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:40.917277Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:13441-1","title":"tomcat10-10.1.14-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:52.718146Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2017:1229-1","title":"Security update for tomcat","description":"\nThis update for tomcat fixes the following issues:\n\n   - CVE-2017-5647 Pipelined requests could lead to information disclosure (bsc#1033448)\n   - CVE-2017-5648 Untrusted application could retain listener leading to information disclosure (bsc#1033447)\n   - CVE-2016-8745 shared Processor on Connector code could lead to information disclosure (bsc#1015119)\n","status":"published","published":"2017-05-10T12:37:48Z","modified":"2026-02-04T04:08:58.336394Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1382-1","title":"Security update for tomcat","description":"\nThis update for tomcat fixes the following issues:\n\n - CVE-2017-5647 Pipelined requests could lead to information disclosure (bsc#1033448)\n - CVE-2017-5648 Untrusted application could retain listener leading to information disclosure (bsc#1033447)\n - CVE-2016-8745 shared Processor on Connector code could lead to information disclosure (bsc#1015119)\n\n","status":"published","published":"2017-05-23T13:38:30Z","modified":"2026-02-04T03:06:06.426453Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1632-1","title":"Security update for tomcat6","description":"This update for tomcat6 fixes the following issues:\n\nTomcat was updated to version 6.0.53:\n\nThe full changelog is:\n  http://tomcat.apache.org/tomcat-6.0-doc/changelog.html\n\nSecurity issues fixed:\n\n- CVE-2017-5647: A bug in the handling of pipelined requests could lead to information disclosure (bsc#1036642)\n- CVE-2016-8745: Regression in the error handling methods could lead to information disclosure (bsc#1015119) \n- CVE-2016-8735: Remote code execution vulnerability in JmxRemoteLifecycleListener (bsc#1011805)\n- CVE-2016-6816: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests (bsc#1011812)\n- CVE-2016-6797: Unrestricted Access to Global Resources (bsc#1007853)\n- CVE-2016-6796: Manager Bypass (bsc#1007858)\n- CVE-2016-6794: System Property Disclosure (bsc#1007857)\n- CVE-2016-5018: Security Manager Bypass (bsc#1007855)\n- CVE-2016-0762: Realm Timing Attack (bsc#1007854)\n- CVE-2016-5388: an arbitrary HTTP_PROXY environment variable might allow remote attackers to redirect  outbound HTTP traffic (bsc#988489)\n","status":"published","published":"2017-06-21T06:58:33Z","modified":"2026-02-04T03:50:16.923535Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1660-1","title":"Security update for tomcat","description":"\nTomcat was updated to version 7.0.78, fixing various bugs and security issues.\n\nFor full details see https://tomcat.apache.org/tomcat-7.0-doc/changelog.html\n\nSecurity issues fixed:\n\n- CVE-2016-0762: A realm timing attack in tomcat was fixed which could disclose existence of users (bsc#1007854)\n- CVE-2016-3092: Usage of vulnerable FileUpload package could have resulted in denial of service (bsc#986359) \n- CVE-2016-5018: A security manager bypass via a Tomcat utility method that was accessible to web applications was fixed. (bsc#1007855)\n- CVE-2016-5388: Setting HTTP_PROXY environment variable via Proxy header (bsc#988489)\n- CVE-2016-6794: A tomcat system property disclosure was fixed. (bsc#1007857)\n- CVE-2016-6796: A tomcat security manager bypass via manipulation of the configuration parameters for the JSP Servlet. (bsc#1007858)\n- CVE-2016-6797: A tomcat unrestricted access to global resources via ResourceLinkFactory was fixed. (bsc#1007853)\n- CVE-2016-6816: A HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests was fixed. (bsc#1011812)\n- CVE-2016-8735: A Remote code execution vulnerability in JmxRemoteLifecycleListener was fixed (bsc#1011805)\n- CVE-2016-8745: A Tomcat Information Disclosure in the error handling of send file code for the NIO HTTP connector was fixed. (bsc#1015119)\n- CVE-2017-5647: A tomcat information disclosure in pipelined request processing was fixed. (bsc#1033448)\n- CVE-2017-5648: A tomcat information disclosure due to using incorrect facade objects was fixed (bsc#1033447)\n","status":"published","published":"2017-06-23T09:07:07Z","modified":"2026-02-04T02:46:50.822926Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3519-1","title":"tomcat7, tomcat8 vulnerabilities","description":"It was discovered that Tomcat incorrectly handled certain pipelined\nrequests when sendfile was used. A remote attacker could use this issue to\nobtain wrong responses possibly containing sensitive information.\n(CVE-2017-5647)\n\nIt was discovered that Tomcat incorrectly used the appropriate facade\nobject. A malicious application could possibly use this to bypass Security\nManager restrictions. (CVE-2017-5648)\n\nIt was discovered that Tomcat incorrectly handled error pages. A remote\nattacker could possibly use this issue to replace or remove the custom\nerror page. (CVE-2017-5664)\n\nIt was discovered that Tomcat incorrectly handled the CORS filter. A remote\nattacker could possibly use this issue to perform cache poisoning.\n(CVE-2017-7674)\n","status":"published","published":"2018-01-08T15:38:49Z","modified":"2026-04-27T15:18:24.258706Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}