{"id":"CVE-2019-12418","aliases":["CLSA-2025-1748282295","CLSA-2026-1789677164","CLSA-2026-1792575257","CLSA-2026-1792667085","CLSA-2026-1792686134","DEBIAN-CVE-2019-12418","DLA-2077-1","DLA-2155-1","DSA-4596-1","DSA-4680-1","EUVD-2019-0793","GHSA-hh3j-x4mc-g48r","MGASA-2020-0054","RHSA-2020:0861","RHSA-2020:1520","SUSE-SU-2020:0029-1","SUSE-SU-2020:0226-1","SUSE-SU-2020:0632-1","SUSE-SU-2020:14375-1","SUSE-SU-2020:1497-1","SUSE-SU-2020:1498-1","UBUNTU-CVE-2019-12418","USN-4251-1","openSUSE-SU-2020:0038-1","openSUSE-SU-2024:11468-1","openSUSE-SU-2024:13441-1"],"status":"published","title":"Insufficiently Protected Credentials in Apache Tomcat","description":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01221,"percentile":0.68958,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-522"],"published":"2019-12-23T17:12:43Z","modified":"2026-11-02T19:46:30Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["7.0.98","8.5.48","9.0.29","7.0.99","8.5.49"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.31-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.31-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.31-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"tomcat8","fixed_in":["8.0.14-1+deb8u16"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"tomcat8","fixed_in":["8.0.32-1ubuntu1.11"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.98"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.48"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.29"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-logging-juli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-logging-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.extras:tomcat-extras-juli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.extras:tomcat-extras-juli-adapters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-annotations-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-ant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-ha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-jmx-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-el-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-i18n-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-i18n-fr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-i18n-ja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jasper-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jsp-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-juli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-servlet-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat7-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.1"}]}],"versions":["9.0.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.1"}]}],"versions":["9.0.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.1"}]}],"versions":["9.0.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.1"}]}],"versions":["9.0.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.1"}]}],"versions":["9.0.13"],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.56-3+really7.0.99-1"}]}],"versions":["7.0.56-3","7.0.56-3+deb8u1","7.0.56-3+deb8u10","7.0.56-3+deb8u11","7.0.56-3+deb8u2","7.0.56-3+deb8u3","7.0.56-3+deb8u4","7.0.56-3+deb8u5","7.0.56-3+deb8u6","7.0.56-3+deb8u7","7.0.56-3+deb8u8","7.0.56-3+deb8u9","7.0.56-3+really7.0.88-1","7.0.56-3+really7.0.88-2","7.0.56-3+really7.0.90-1","7.0.56-3+really7.0.91-1","7.0.56-3+really7.0.94-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.14-1+deb8u16"}]}],"versions":["8.0.14-1","8.0.14-1+deb8u1","8.0.14-1+deb8u10","8.0.14-1+deb8u11","8.0.14-1+deb8u12","8.0.14-1+deb8u13","8.0.14-1+deb8u14","8.0.14-1+deb8u15","8.0.14-1+deb8u2","8.0.14-1+deb8u3","8.0.14-1+deb8u4","8.0.14-1+deb8u5","8.0.14-1+deb8u6","8.0.14-1+deb8u7","8.0.14-1+deb8u8","8.0.14-1+deb8u9"]},{"source":"osv","ecosystem":"Debian:9","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.50-0+deb9u1"}]}],"versions":["8.5.14-1","8.5.14-1+deb9u1","8.5.14-1+deb9u2","8.5.14-1+deb9u3","8.5.14-2","8.5.15-1","8.5.16-1","8.5.21-1","8.5.23-1","8.5.24-1","8.5.24-2","8.5.24-2~bpo9+1","8.5.28-1","8.5.28-1~bpo9+1","8.5.29-1","8.5.29-1~bpo9+1","8.5.30-1","8.5.31-1","8.5.32-1","8.5.32-2","8.5.33-1","8.5.33-1~bpo9+1","8.5.34-1","8.5.34-1~bpo9+1","8.5.35-1","8.5.35-2","8.5.35-2~bpo9+1","8.5.35-3","8.5.37-1","8.5.37-1~bpo9+1","8.5.37-2","8.5.38-1","8.5.38-1~bpo9+1","8.5.38-2","8.5.38-2~bpo9+1","8.5.39-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u1"}]}],"versions":["9.0.16-4","9.0.16-5","9.0.22-1","9.0.24-1","9.0.27-1","9.0.31-1~bpo10+1"],"bundled":6},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.99"}]}],"versions":["7.0.0","7.0.11","7.0.12","7.0.14","7.0.16","7.0.19","7.0.2","7.0.20","7.0.21","7.0.22","7.0.23","7.0.25","7.0.26","7.0.27","7.0.28","7.0.29","7.0.30","7.0.32","7.0.33","7.0.34","7.0.35","7.0.37","7.0.39","7.0.4","7.0.40","7.0.41","7.0.42","7.0.47","7.0.5","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57","7.0.59","7.0.6","7.0.61","7.0.62","7.0.63","7.0.64","7.0.65","7.0.67","7.0.68","7.0.69","7.0.70","7.0.72","7.0.73","7.0.75","7.0.76","7.0.77","7.0.78","7.0.79","7.0.8","7.0.81","7.0.82","7.0.84","7.0.85","7.0.86","7.0.88","7.0.90","7.0.91","7.0.92","7.0.93","7.0.94","7.0.96"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.49"}]}],"versions":["8.0.1","8.0.11","8.0.12","8.0.14","8.0.15","8.0.17","8.0.18","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.32","8.0.33","8.0.35","8.0.36","8.0.37","8.0.38","8.0.39","8.0.41","8.0.42","8.0.43","8.0.44","8.0.45","8.0.46","8.0.47","8.0.48","8.0.49","8.0.5","8.0.50","8.0.51","8.0.52","8.0.53","8.0.8","8.0.9","8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.5","8.5.6","8.5.8","8.5.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.29"}]}],"versions":["9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8"]},{"source":"osv","ecosystem":"Mageia:7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.30-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-21.redhat_21.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-21.redhat_21.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-servlet-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-21.redhat_21.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-21.redhat_21.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-38.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-servlet-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-42.ep7.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el6jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el6jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el6jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el6jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el6jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el6jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el6jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-4.redhat_4.el6jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-4.redhat_4.el6jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el6jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el6jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el6jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el7jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el7jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el7jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el7jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el7jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el7jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el7jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-4.redhat_4.el7jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-4.redhat_4.el7jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el7jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el7jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el7jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el8jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el8jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el8jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el8jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el8jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el8jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el8jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-4.redhat_4.el8jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-4.redhat_4.el8jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el8jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el8jws"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-3.redhat_4.1.el8jws"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.30-4.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.30-3.34.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-3.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-3.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-3.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-3.25.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.53-0.57.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.53-0.57.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-10.43.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-10.43.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3","7.0.52-1ubuntu0.6","7.0.52-1ubuntu0.7","7.0.52-1ubuntu0.8","7.0.52-1ubuntu0.9","7.0.52-1ubuntu0.10","7.0.52-1ubuntu0.11","7.0.52-1ubuntu0.13","7.0.52-1ubuntu0.14","7.0.52-1ubuntu0.15","7.0.52-1ubuntu0.16","7.0.52-1ubuntu0.16+esm1","7.0.52-1ubuntu0.16+esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.11"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4","8.0.32-1ubuntu1.5","8.0.32-1ubuntu1.6","8.0.32-1ubuntu1.7","8.0.32-1ubuntu1.8","8.0.32-1ubuntu1.9","8.0.32-1ubuntu1.10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.64-1","7.0.68-1","7.0.68-1ubuntu0.1","7.0.68-1ubuntu0.3","7.0.68-1ubuntu0.4","7.0.68-1ubuntu0.4+esm1","7.0.68-1ubuntu0.4+esm2","7.0.68-1ubuntu0.4+esm3","7.0.68-1ubuntu0.4+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2","8.5.39-1ubuntu1~18.04.3","8.5.39-1ubuntu1~18.04.3+esm1","8.5.39-1ubuntu1~18.04.3+esm2","8.5.39-1ubuntu1~18.04.3+esm3","8.5.39-1ubuntu1~18.04.3+esm4","8.5.39-1ubuntu1~18.04.3+esm5","8.5.39-1ubuntu1~18.04.3+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2","9.0.16-3ubuntu0.18.04.2+esm3","9.0.16-3ubuntu0.18.04.2+esm4","9.0.16-3ubuntu0.18.04.2+esm5","9.0.16-3ubuntu0.18.04.2+esm6","9.0.16-3ubuntu0.18.04.2+esm7","9.0.16-3ubuntu0.18.04.2+esm8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.11"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4","8.0.32-1ubuntu1.5","8.0.32-1ubuntu1.6","8.0.32-1ubuntu1.7","8.0.32-1ubuntu1.8","8.0.32-1ubuntu1.9","8.0.32-1ubuntu1.10"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.30-lp151.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-8.4"}]}],"bundled":25},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14-1.1"}]}],"bundled":49}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"oncommand_system_manager"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"workload_manager"}],"references":[{"url":"https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2019/dsa-4596","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Dec/43","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20200107-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.f5.com/csp/article/K10107360?utm_source=f5support\u0026amp%3Butm_medium=RSS","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4251-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202003-43","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/03/msg00029.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.debian.org/security/2020/dsa-4680","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12418","tags":["advisory"]},{"url":"https://support.f5.com/csp/article/K10107360?utm_source=f5support\u0026amp;utm_medium=RSS","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hh3j-x4mc-g48r"},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12418","tags":["advisory"]},{"url":"https://usn.ubuntu.com/4251-1","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20200107-0001","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2020-0054.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25987","tags":["report"]},{"url":"http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.29","tags":["web","article"]},{"url":"http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.30","tags":["web","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QKC3AMZQVWY34PC24RYAAO4N57HWS6QG/","tags":["web"]},{"url":"http://lists.suse.com/pipermail/sle-security-updates/2020-January/006307.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0861","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/3.1/html/3.1.0_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1785699","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1785711","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1806398","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0861.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0221","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0221","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-12418","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12418","tags":["advisory","report"]},{"url":"http://mail-archives.apache.org/mod_mbox/tomcat-users/201912.mbox/%3C3f42d82c-d9e9-8893-9820-df4e420e5c4e@apache.org%3E","tags":["article"]},{"url":"http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.49","tags":["article"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.99","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-17563","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17563","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17563","tags":["advisory"]},{"url":"http://mail-archives.apache.org/mod_mbox/www-announce/201912.mbox/%3C21b7a375-7297-581b-1f8e-06622d36775b@apache.org%3E","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.50","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-1938","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1938","tags":["advisory"]},{"url":"https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/","tags":["article"]},{"url":"https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100","tags":["article"]},{"url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51","tags":["article"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31","tags":["article"]},{"url":"https://www.cnvd.org.cn/webinfo/show/5415","tags":["article"]},{"url":"https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1520","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1806835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1806849","tags":["report"]},{"url":"https://issues.redhat.com/browse/JWS-1419","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-1463","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-1465","tags":["article"]},{"url":"https://issues.redhat.com/browse/JWS-1478","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1520.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-17569","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17569","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-1935","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1935","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200029-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1139924","tags":["report"]},{"url":"https://bugzilla.suse.com/1159723","tags":["report"]},{"url":"https://bugzilla.suse.com/1159729","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17563","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200226-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1161025","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200632-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1164692","tags":["report"]},{"url":"https://bugzilla.suse.com/1164825","tags":["report"]},{"url":"https://bugzilla.suse.com/1164860","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1938","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014375-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1136085","tags":["report"]},{"url":"https://bugzilla.suse.com/1171928","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9484","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201497-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201498-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-12418","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4251-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-17563","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/54BLO3OHVPO6A3AIEQHGLVDNHSXP5KDS/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-12418","description":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.","status":"published","published":"2019-12-23T17:12:43Z","modified":"2026-10-08T21:03:24.914Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-0793","description":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.","status":"published","published":"2019-12-23T17:12:43Z","modified":"2026-10-08T21:03:24Z","updated_at":"2026-11-02T17:27:27.240961Z"}],"ghsa":[{"id":"GHSA-hh3j-x4mc-g48r","title":"Insufficiently Protected Credentials in Apache Tomcat","description":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.","status":"published","published":"2019-12-26T18:22:36Z","modified":"2023-02-01T05:02:37Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:36:30.61364Z"}],"nvd":[{"id":"CVE-2019-12418","description":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.","status":"published","published":"2019-12-23T18:15:10.753Z","modified":"2026-10-08T21:17:12.08Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:40.856496Z"}],"osv":[{"id":"CVE-2019-12418","description":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.","status":"published","published":"2019-12-23T18:15:10.753Z","modified":"2026-10-24T10:30:51.397140386Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-12418","description":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.","status":"published","published":"2019-12-23T18:15:10.753Z","modified":"2026-10-09T09:47:33.412667403Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"GHSA-hh3j-x4mc-g48r","title":"Insufficiently Protected Credentials in Apache Tomcat","description":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.","status":"published","published":"2019-12-26T18:22:36Z","modified":"2026-08-07T08:12:02.933513866Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"RHSA-2020:0861","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 8 security update","status":"published","published":"2024-09-16T03:29:20Z","modified":"2026-08-05T10:06:59Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1520","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.3 release","status":"published","published":"2024-09-16T03:29:36Z","modified":"2026-08-05T10:07:05Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2019-12418","description":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.","status":"published","published":"2019-12-23T18:15:00Z","modified":"2026-07-15T19:45:49.851897874Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"CLSA-2025-1748282295","title":"Fix of 34 CVEs","description":"   * SECURITY UPDATE: Misc vulnerability fixes\n     - CVE-2019-12418, CVE-2019-17563, CVE-2020-1935,\n       CVE-2020-11996, CVE-2020-13934, CVE-2020-13935,\n       CVE-2020-13943, CVE-2020-17527, CVE-2021-24122,\n       CVE-2021-30639, CVE-2021-30640, CVE-2021-33037,\n       CVE-2021-42340, CVE-2021-43980, CVE-2022-25762,\n       CVE-2022-34305, CVE-2022-45143, CVE-2023-24998,\n       CVE-2023-28709, CVE-2023-34981, CVE-2023-42794,\n       CVE-2024-21733\n   * Update to 8.5.100\n     - debian/rules,\n       debian/libtomcat8-java.poms,\n       debian/maven.rules,\n       debian/tomcat8-common.links,\n       debian/patches/0018-fix-manager-webapp.patch,\n       debian/patches/0019-add-distribution-to-error-page.patch,\n       debian/patches/0021-dont-test-unsupported-ciphers.patch,\n       debian/patches/0101-skipping-tests-incompatible-with-firewall.patch:\n       updated\n     - debian/patches/0002-do-not-load-AJP13-connector-by-default.patch,\n       debian/patches/0026-easymock4-compatibility.patch:\n       removed as they were applied in upstream\n     - CVE-2019-0221.patch, CVE-2019-10072-1.patch,\n       CVE-2019-10072-2.patch, CVE-2022-42252.patch,\n       CVE-2020-1938.patch, CVE-2021-25122.patch,\n       CVE-2021-41079.patch, CVE-2022-29885.patch,\n       CVE-2020-9484.patch, CVE-2021-25329-pre1.patch,\n       CVE-2021-25329.patch, CVE-2022-23181.patch,\n       CVE-2023-44487.patch, CVE-2023-46589-pre1.patch,\n       CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch,\n       CVE-2023-46589-pre4.patch, CVE-2023-46589.patch:\n       removed because these CVEs were fixed in upstream\n   * Internal tests\n     - debian/test_certs/*: updated from upstream branch 9.0.x, as the\n       8.0.x certs were expired","status":"published","published":"2025-05-27T13:45:18Z","modified":"2026-06-04T10:03:30.412984079Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2026-1789677164","title":"TuxCare security update for 32 packages (16 CVEs)","description":"TuxCare rebuilt 32 packages to address 16 CVEs. Fixed in 7.0.70-tuxcare.4.","status":"published","published":"2026-09-17T20:32:44Z","modified":"2026-10-15T09:47:44.399297734Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1792575257","title":"TuxCare security update for 8 packages (32 CVEs)","description":"TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.","status":"published","published":"2026-10-21T09:34:17Z","modified":"2026-11-02T19:46:30.353719339Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792667085","title":"TuxCare security update for 7 packages (24 CVEs)","description":"TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.","status":"published","published":"2026-10-22T11:04:45Z","modified":"2026-11-02T19:46:30.557831164Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792686134","title":"TuxCare security update for 5 packages (9 CVEs)","description":"TuxCare rebuilt 5 packages to address 9 CVEs. Fixed in 9.0.13-tuxcare.1.","status":"published","published":"2026-10-22T16:22:14Z","modified":"2026-11-02T19:46:30.80805642Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"DLA-2077-1","title":"tomcat7 - security update","status":"published","published":"2020-01-27T00:00:00Z","modified":"2026-03-09T01:19:16.449174Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-2155-1","title":"tomcat8 - security update","status":"published","published":"2020-03-24T00:00:00Z","modified":"2026-03-09T01:19:41.910384Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4596-1","title":"tomcat8 - security update","status":"published","published":"2019-12-27T00:00:00Z","modified":"2026-03-09T02:10:07.381367Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"DSA-4680-1","title":"tomcat9 - security update","status":"published","published":"2020-05-06T00:00:00Z","modified":"2026-03-09T02:11:09.792157Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0054","title":"Updated tomcat packages fix security vulnerabilities","description":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97\nis configured with the JMX Remote Lifecycle Listener, a local attacker\nwithout access to the Tomcat process or configuration files is able to\nmanipulate the RMI registry to perform a man-in-the-middle attack to\ncapture user names and passwords used to access the JMX interface. The\nattacker can then use these credentials to access the JMX interface and\ngain complete control over the Tomcat instance. (CVE-2019-12418)\n\nWhen using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29,\n8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an\nattacker could perform a session fixation attack. The window was\nconsidered too narrow for an exploit to be practical but, erring on the\nside of caution, this issue has been treated as a security\nvulnerability. (CVE-2019-17563)\n","status":"published","published":"2020-01-28T07:52:40Z","modified":"2026-04-16T04:44:34.596512034Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0038-1","title":"Security update for tomcat","description":"This update for tomcat to version 9.0.30 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-12418: Fixed a local privilege escalation through by manipulating the RMI registry and performing a man-in-the-middle attack (bsc#1159723).\n- CVE-2019-17563: Fixed a session fixation attack when using FORM authentication (bsc#1159729).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-01-13T15:21:17Z","modified":"2026-02-04T03:18:54.157641Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11468-1","title":"tomcat-9.0.36-8.4 on GA media","description":"These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:40.917277Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:13441-1","title":"tomcat10-10.1.14-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:52.718146Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2020:0029-1","title":"Security update for tomcat","description":"This update for tomcat to version 9.0.30 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-12418: Fixed a local privilege escalation through by manipulating the RMI registry and performing a man-in-the-middle attack (bsc#1159723).\n- CVE-2019-17563: Fixed a session fixation attack when using FORM authentication (bsc#1159729).\n","status":"published","published":"2020-01-07T14:44:20Z","modified":"2026-02-04T03:49:16.751567Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0226-1","title":"Security update for tomcat","description":"This update for tomcat to version 9.0.30 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-12418: Fixed a local privilege escalation by manipulating the RMI registry (bsc#1159723).\n- CVE-2019-17563: Fixed a session fixation attack when using FORM authentication (bsc#1159729).\n\nNon-security issue fixed: \n\n- Fixed a problem during startup, related to changes in Java 9+ APIs (bsc#1161025).\n","status":"published","published":"2020-01-24T08:23:25Z","modified":"2026-02-04T03:35:41.357188Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0632-1","title":"Security update for tomcat","description":"This update for tomcat to version 9.0.31 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-10072: Fixed a denial-of-service that could have been caused by clients omitting WINDOW_UPDATE messages in HTTP/2 streams (bsc#1139924).\n- CVE-2019-12418: Fixed a local privilege escalation by manipulating the RMI registry (bsc#1159723).\n- CVE-2019-17563: Fixed a session fixation attack when using FORM authentication (bsc#1159729).\n- CVE-2019-17569: Fixed a regression in the handling of Transfer-Encoding headers that would have allowed HTTP Request Smuggling (bsc#1164825).\n- CVE-2020-1935: Fixed an HTTP Request Smuggling issue (bsc#1164860).\n- CVE-2020-1938: Fixed a file contents disclosure vulnerability (bsc#1164692).\n","status":"published","published":"2020-03-10T12:13:09Z","modified":"2026-02-04T04:35:59.725465Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:14375-1","title":"Security update for tomcat6","description":"This update for tomcat6 fixes the following issues:\n\nCVE-2020-9484 (bsc#1171928)\nApache Tomcat Remote Code Execution via session persistence\n\nIf an attacker was able to control the contents and name of a file on a\nserver configured to use the PersistenceManager, then the attacker could\nhave triggered a remote code execution via deserialization of the file under\ntheir control.\n\nCVE-2019-12418 (bsc#1159723)\nLocal privilege escalation by manipulating the RMI registry and performing a man-in-the-middle attack\n\nWhen Tomcat is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files was able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface.\nThe attacker could then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.\n\nCVE-2019-0221 (bsc#1136085)\nThe SSI printenv command echoed user provided data without escaping, which\nmade it vulnerable to XSS.\n\n","status":"published","published":"2020-05-22T13:01:48Z","modified":"2026-02-04T03:24:17.153109Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1497-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nCVE-2020-9484 (bsc#1171928)\nApache Tomcat Remote Code Execution via session persistence\n\nIf an attacker was able to control the contents and name of a file on a\nserver configured to use the PersistenceManager, then the attacker could\nhave triggered a remote code execution via deserialization of the file under\ntheir control.\n\nCVE-2019-12418 (bsc#1159723)\nLocal privilege escalation by manipulating the RMI registry and performing a man-in-the-middle attack\n\nWhen Tomcat is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files was able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface.\nThe attacker could then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.\n\nCVE-2019-0221 (bsc#1136085)\nThe SSI printenv command echoed user provided data without escaping, which\nmade it vulnerable to XSS.\n\nCVE-2019-17563 (bsc#1159729)\nWhen using FORM authentication there was a narrow window where an attacker could perform a session fixation attack.\n\nCVE-2019-17569 (bsc#1164825)\nInvalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling\nif Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header.\n\n","status":"published","published":"2020-05-28T07:58:11Z","modified":"2026-02-04T03:02:49.119223Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1498-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nCVE-2020-9484 (bsc#1171928)\nApache Tomcat Remote Code Execution via session persistence\n\nIf an attacker was able to control the contents and name of a file on a\nserver configured to use the PersistenceManager, then the attacker could\nhave triggered a remote code execution via deserialization of the file under\ntheir control.\n\nCVE-2019-12418 (bsc#1159723)\nLocal privilege escalation by manipulating the RMI registry and performing a man-in-the-middle attack\n\nWhen Tomcat is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files was able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface.\nThe attacker could then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.\n\nCVE-2019-0221 (bsc#1136085)\nThe SSI printenv command echoed user provided data without escaping, which\nmade it vulnerable to XSS.\n\nCVE-2019-17563 (bsc#1159729)\nWhen using FORM authentication there was a narrow window where an attacker could perform a session fixation attack.\n\nCVE-2019-17569 (bsc#1164825)\nInvalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling\nif Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header.\n\n","status":"published","published":"2020-05-28T08:39:40Z","modified":"2026-02-04T02:54:22.175009Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4251-1","title":"tomcat8 vulnerabilities","description":"It was discovered that Tomcat incorrectly handled the RMI registry when\nconfigured with the JMX Remote Lifecycle Listener. A local attacker could\npossibly use this issue to obtain credentials and gain complete control\nover the Tomcat instance. (CVE-2019-12418)\n\nIt was discovered that Tomcat incorrectly handled FORM authentication. A\nremote attacker could possibly use this issue to perform a session fixation\nattack. (CVE-2019-17563)\n","status":"published","published":"2020-01-27T15:05:49Z","modified":"2026-04-27T15:34:19.717788Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}