{"id":"CVE-2020-9484","aliases":["BIT-tomcat-2020-9484","CLSA-2022-1655757814","CLSA-2023-1691083477","CLSA-2024-1724260496","CLSA-2025-1748282295","CLSA-2026-1788873744","CLSA-2026-1792575257","CLSA-2026-1792686134","DEBIAN-CVE-2020-9484","DLA-2209-1","DLA-2217-1","DLA-2279-1","DSA-4727-1","EUVD-2020-0404","GHSA-344f-f5vg-2jfj","MGASA-2020-0277","RHSA-2020:2483","RHSA-2020:2506","RHSA-2020:2529","RHSA-2020:2530","SUSE-SU-2020:1363-1","SUSE-SU-2020:1364-1","SUSE-SU-2020:1365-1","SUSE-SU-2020:14375-1","SUSE-SU-2020:1497-1","SUSE-SU-2020:1498-1","UBUNTU-CVE-2020-9484","USN-4448-1","USN-4596-1","USN-5360-1","USN-6908-1","USN-6943-1","openSUSE-SU-2020:0711-1","openSUSE-SU-2024:11468-1","openSUSE-SU-2024:13441-1"],"status":"published","title":"Potential remote code execution in Apache Tomcat","description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.5552,"percentile":0.99042,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2020-05-11T00:00:00Z","modified":"2026-11-02T19:46:30Z","exploits":[{"source":"pocgithub","id":"threedr3am/tomcat-cluster-session-sync-exp","title":"threedr3am/tomcat-cluster-session-sync-exp","date":"2020-05-19","url":"https://github.com/threedr3am/tomcat-cluster-session-sync-exp"},{"source":"pocgithub","id":"IdealDreamLast/CVE-2020-9484","title":"IdealDreamLast/CVE-2020-9484","date":"2020-05-21","url":"https://github.com/IdealDreamLast/CVE-2020-9484"},{"source":"pocgithub","id":"masahiro331/CVE-2020-9484","title":"masahiro331/CVE-2020-9484","date":"2020-05-21","url":"https://github.com/masahiro331/CVE-2020-9484"},{"source":"pocgithub","id":"seanachao/CVE-2020-9484","title":"seanachao/CVE-2020-9484","date":"2020-05-21","url":"https://github.com/seanachao/CVE-2020-9484"},{"source":"pocgithub","id":"qerogram/CVE-2020-9484","title":"qerogram/CVE-2020-9484","date":"2020-06-04","url":"https://github.com/qerogram/CVE-2020-9484"},{"source":"pocgithub","id":"anjai94/CVE-2020-9484-exploit","title":"anjai94/CVE-2020-9484-exploit","date":"2020-09-05","url":"https://github.com/anjai94/CVE-2020-9484-exploit"},{"source":"pocgithub","id":"PenTestical/CVE-2020-9484","title":"PenTestical/CVE-2020-9484","date":"2020-12-31","url":"https://github.com/PenTestical/CVE-2020-9484"},{"source":"pocgithub","id":"DanQMoo/CVE-2020-9484-Scanner","title":"DanQMoo/CVE-2020-9484-Scanner","date":"2021-01-12","url":"https://github.com/DanQMoo/CVE-2020-9484-Scanner"},{"source":"pocgithub","id":"AssassinUKG/CVE-2020-9484","title":"AssassinUKG/CVE-2020-9484","date":"2021-01-26","url":"https://github.com/AssassinUKG/CVE-2020-9484"},{"source":"pocgithub","id":"VICXOR/CVE-2020-9484","title":"VICXOR/CVE-2020-9484","date":"2021-02-10","url":"https://github.com/VICXOR/CVE-2020-9484"},{"source":"pocgithub","id":"DXY0411/CVE-2020-9484","title":"DXY0411/CVE-2020-9484","date":"2021-03-01","url":"https://github.com/DXY0411/CVE-2020-9484"},{"source":"pocgithub","id":"RepublicR0K/CVE-2020-9484","title":"RepublicR0K/CVE-2020-9484","date":"2021-05-18","url":"https://github.com/RepublicR0K/CVE-2020-9484"},{"source":"pocgithub","id":"ColdFusionX/CVE-2020-9484","title":"ColdFusionX/CVE-2020-9484","date":"2022-02-11","url":"https://github.com/ColdFusionX/CVE-2020-9484"},{"source":"pocgithub","id":"d3fudd/CVE-2020-9484_Exploit","title":"d3fudd/CVE-2020-9484_Exploit","date":"2022-11-14","url":"https://github.com/d3fudd/CVE-2020-9484_Exploit"},{"source":"pocgithub","id":"0dayCTF/CVE-2020-9484","title":"0dayCTF/CVE-2020-9484","date":"2024-09-16","url":"https://github.com/0dayCTF/CVE-2020-9484"},{"source":"pocgithub","id":"Disturbante/CVE-2020-9484","title":"Disturbante/CVE-2020-9484","date":"2024-09-25","url":"https://github.com/Disturbante/CVE-2020-9484"},{"source":"pocgithub","id":"savsch/PoC_CVE-2020-9484","title":"savsch/PoC_CVE-2020-9484","date":"2024-10-06","url":"https://github.com/savsch/PoC_CVE-2020-9484"},{"source":"nuclei","id":"CVE-2020-9484","title":"Apache Tomcat Remote Command Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9484.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["10.0.0-M5","9.0.35","8.5.55","7.0.104"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["10.0.0-M5","9.0.35","8.5.55","7.0.104"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"tomcat","fixed_in":["7.0.108","8.5.63","9.0.43"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.35-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.35-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.35-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"tomcat7","fixed_in":["7.0.56-3+really7.0.100-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"tomcat","fixed_in":["9.0.35-1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-native","fixed_in":["0:1.2.23-22.redhat_22.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-native-debuginfo","fixed_in":["0:1.2.23-22.redhat_22.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7","fixed_in":["0:7.0.70-40.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-admin-webapps","fixed_in":["0:7.0.70-40.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-docs-webapp","fixed_in":["0:7.0.70-40.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-el-2.2-api","fixed_in":["0:7.0.70-40.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-javadoc","fixed_in":["0:7.0.70-40.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-jsp-2.2-api","fixed_in":["0:7.0.70-40.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-jsvc","fixed_in":["0:7.0.70-40.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-lib","fixed_in":["0:7.0.70-40.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-log4j","fixed_in":["0:7.0.70-40.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-selinux","fixed_in":["0:7.0.70-40.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-servlet-3.0-api","fixed_in":["0:7.0.70-40.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-webapps","fixed_in":["0:7.0.70-40.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8","fixed_in":["0:8.0.36-44.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-admin-webapps","fixed_in":["0:8.0.36-44.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-docs-webapp","fixed_in":["0:8.0.36-44.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-el-2.2-api","fixed_in":["0:8.0.36-44.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-javadoc","fixed_in":["0:8.0.36-44.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-jsp-2.3-api","fixed_in":["0:8.0.36-44.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-jsvc","fixed_in":["0:8.0.36-44.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-lib","fixed_in":["0:8.0.36-44.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-log4j","fixed_in":["0:8.0.36-44.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-selinux","fixed_in":["0:8.0.36-44.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-servlet-3.1-api","fixed_in":["0:8.0.36-44.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-webapps","fixed_in":["0:8.0.36-44.ep7.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-native","fixed_in":["0:1.2.23-22.redhat_22.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-native-debuginfo","fixed_in":["0:1.2.23-22.redhat_22.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7","fixed_in":["0:7.0.70-40.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-admin-webapps","fixed_in":["0:7.0.70-40.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-docs-webapp","fixed_in":["0:7.0.70-40.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-el-2.2-api","fixed_in":["0:7.0.70-40.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-javadoc","fixed_in":["0:7.0.70-40.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-jsp-2.2-api","fixed_in":["0:7.0.70-40.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-jsvc","fixed_in":["0:7.0.70-40.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-lib","fixed_in":["0:7.0.70-40.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-log4j","fixed_in":["0:7.0.70-40.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-selinux","fixed_in":["0:7.0.70-40.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-servlet-3.0-api","fixed_in":["0:7.0.70-40.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-webapps","fixed_in":["0:7.0.70-40.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8","fixed_in":["0:8.0.36-44.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-admin-webapps","fixed_in":["0:8.0.36-44.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-docs-webapp","fixed_in":["0:8.0.36-44.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-el-2.2-api","fixed_in":["0:8.0.36-44.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-javadoc","fixed_in":["0:8.0.36-44.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-jsp-2.3-api","fixed_in":["0:8.0.36-44.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-jsvc","fixed_in":["0:8.0.36-44.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-lib","fixed_in":["0:8.0.36-44.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-log4j","fixed_in":["0:8.0.36-44.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-selinux","fixed_in":["0:8.0.36-44.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-servlet-3.1-api","fixed_in":["0:8.0.36-44.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-webapps","fixed_in":["0:8.0.36-44.ep7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat","fixed_in":["0:9.0.30-4.redhat_5.1.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-admin-webapps","fixed_in":["0:9.0.30-4.redhat_5.1.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-docs-webapp","fixed_in":["0:9.0.30-4.redhat_5.1.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-el-3.0-api","fixed_in":["0:9.0.30-4.redhat_5.1.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-javadoc","fixed_in":["0:9.0.30-4.redhat_5.1.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-jsp-2.3-api","fixed_in":["0:9.0.30-4.redhat_5.1.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-lib","fixed_in":["0:9.0.30-4.redhat_5.1.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-native","fixed_in":["0:1.2.23-5.redhat_5.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-native-debuginfo","fixed_in":["0:1.2.23-5.redhat_5.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-selinux","fixed_in":["0:9.0.30-4.redhat_5.1.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-servlet-4.0-api","fixed_in":["0:9.0.30-4.redhat_5.1.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-webapps","fixed_in":["0:9.0.30-4.redhat_5.1.el6jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat","fixed_in":["0:9.0.30-4.redhat_5.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-admin-webapps","fixed_in":["0:9.0.30-4.redhat_5.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-docs-webapp","fixed_in":["0:9.0.30-4.redhat_5.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-el-3.0-api","fixed_in":["0:9.0.30-4.redhat_5.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-javadoc","fixed_in":["0:9.0.30-4.redhat_5.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-jsp-2.3-api","fixed_in":["0:9.0.30-4.redhat_5.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-lib","fixed_in":["0:9.0.30-4.redhat_5.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-native","fixed_in":["0:1.2.23-5.redhat_5.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-native-debuginfo","fixed_in":["0:1.2.23-5.redhat_5.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-selinux","fixed_in":["0:9.0.30-4.redhat_5.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-servlet-4.0-api","fixed_in":["0:9.0.30-4.redhat_5.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-webapps","fixed_in":["0:9.0.30-4.redhat_5.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat","fixed_in":["0:9.0.30-4.redhat_5.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-admin-webapps","fixed_in":["0:9.0.30-4.redhat_5.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-docs-webapp","fixed_in":["0:9.0.30-4.redhat_5.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-el-3.0-api","fixed_in":["0:9.0.30-4.redhat_5.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-javadoc","fixed_in":["0:9.0.30-4.redhat_5.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-jsp-2.3-api","fixed_in":["0:9.0.30-4.redhat_5.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-lib","fixed_in":["0:9.0.30-4.redhat_5.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-native","fixed_in":["0:1.2.23-5.redhat_5.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-native-debuginfo","fixed_in":["0:1.2.23-5.redhat_5.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-selinux","fixed_in":["0:9.0.30-4.redhat_5.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-servlet-4.0-api","fixed_in":["0:9.0.30-4.redhat_5.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-webapps","fixed_in":["0:9.0.30-4.redhat_5.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-admin-webapps","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-docs-webapp","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-el-2.1-api","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-javadoc","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-jsp-2.1-api","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-lib","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-servlet-2.5-api","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-webapps","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-admin-webapps","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-docs-webapp","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-el-2.1-api","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-javadoc","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-jsp-2.1-api","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-lib","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-servlet-2.5-api","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-webapps","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-el-2.1-api","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-jsp-2.1-api","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-lib","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-servlet-2.5-api","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-admin-webapps","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-docs-webapp","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-javadoc","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-webapps","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-el-2.1-api","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-jsp-2.1-api","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-lib","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-servlet-2.5-api","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-admin-webapps","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-docs-webapp","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-javadoc","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-webapps","fixed_in":["0:6.0.24-115.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-servlet-3.0-api","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-admin-webapps","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-docs-webapp","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-el-2.2-api","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-javadoc","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsp-2.2-api","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsvc","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-lib","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-webapps","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-servlet-3.0-api","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-admin-webapps","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-docs-webapp","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-el-2.2-api","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-javadoc","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsp-2.2-api","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsvc","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-lib","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-webapps","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-admin-webapps","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-el-2.2-api","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsp-2.2-api","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-lib","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-servlet-3.0-api","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-webapps","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-docs-webapp","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-javadoc","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsvc","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-admin-webapps","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-el-2.2-api","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsp-2.2-api","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-lib","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-servlet-3.0-api","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-webapps","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-docs-webapp","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-javadoc","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsvc","fixed_in":["0:7.0.76-12.el7_8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"tomcat","fixed_in":["9.0.35-4.30.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"tomcat","fixed_in":["9.0.35-3.52.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"tomcat","fixed_in":["9.0.35-3.52.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"tomcat","fixed_in":["9.0.35-3.52.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"tomcat","fixed_in":["9.0.35-3.52.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"tomcat","fixed_in":["9.0.35-3.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tomcat","fixed_in":["9.0.35-3.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","fixed_in":["9.0.35-3.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","fixed_in":["9.0.35-3.32.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat7","fixed_in":["7.0.52-1ubuntu0.16+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"tomcat8","fixed_in":["8.0.32-1ubuntu1.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","fixed_in":["7.0.68-1ubuntu0.4+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"tomcat9","fixed_in":["9.0.16-3ubuntu0.18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat7","fixed_in":["7.0.78-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","fixed_in":["8.5.39-1ubuntu1~18.04.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"tomcat9","fixed_in":["9.0.31-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"tomcat","fixed_in":["9.0.35-lp151.3.18.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"last_affected":"10.0.0-M4"},{"fixed":"10.0.0-M5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.35"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.55"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.104"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"last_affected":"10.0.0-M4"},{"fixed":"10.0.0-M5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.35"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.55"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.104"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.0.108"},{"introduced":"8.5.0"},{"fixed":"8.5.63"},{"introduced":"9.0.1"},{"fixed":"9.0.43"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libservlet3.0-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libservlet3.0-java-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libtomcat7-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libservlet3.1-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libservlet3.1-java-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.3"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.3"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.3"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.3"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-jmx-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.3"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.3"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.3"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.1"}]}],"versions":["9.0.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.1"}]}],"versions":["9.0.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.1"}]}],"versions":["9.0.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.1"}]}],"versions":["9.0.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.1"}]}],"versions":["9.0.13"],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.14-1+deb8u17"}]}],"versions":["8.0.14-1","8.0.14-1+deb8u1","8.0.14-1+deb8u10","8.0.14-1+deb8u11","8.0.14-1+deb8u12","8.0.14-1+deb8u13","8.0.14-1+deb8u14","8.0.14-1+deb8u15","8.0.14-1+deb8u16","8.0.14-1+deb8u2","8.0.14-1+deb8u3","8.0.14-1+deb8u4","8.0.14-1+deb8u5","8.0.14-1+deb8u6","8.0.14-1+deb8u7","8.0.14-1+deb8u8","8.0.14-1+deb8u9"],"bundled":4},{"source":"osv","ecosystem":"Debian:8","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.56-3+really7.0.100-1+deb8u1"}]}],"versions":["7.0.56-3","7.0.56-3+deb8u1","7.0.56-3+deb8u10","7.0.56-3+deb8u11","7.0.56-3+deb8u2","7.0.56-3+deb8u3","7.0.56-3+deb8u4","7.0.56-3+deb8u5","7.0.56-3+deb8u6","7.0.56-3+deb8u7","7.0.56-3+deb8u8","7.0.56-3+deb8u9","7.0.56-3+really7.0.100-1","7.0.56-3+really7.0.88-1","7.0.56-3+really7.0.88-2","7.0.56-3+really7.0.90-1","7.0.56-3+really7.0.91-1","7.0.56-3+really7.0.94-1","7.0.56-3+really7.0.99-1"]},{"source":"osv","ecosystem":"Debian:9","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.54-0+deb9u2"}]}],"versions":["8.5.14-1","8.5.14-1+deb9u1","8.5.14-1+deb9u2","8.5.14-1+deb9u3","8.5.14-2","8.5.15-1","8.5.16-1","8.5.21-1","8.5.23-1","8.5.24-1","8.5.24-2","8.5.24-2~bpo9+1","8.5.28-1","8.5.28-1~bpo9+1","8.5.29-1","8.5.29-1~bpo9+1","8.5.30-1","8.5.31-1","8.5.32-1","8.5.32-2","8.5.33-1","8.5.33-1~bpo9+1","8.5.34-1","8.5.34-1~bpo9+1","8.5.35-1","8.5.35-2","8.5.35-2~bpo9+1","8.5.35-3","8.5.37-1","8.5.37-1~bpo9+1","8.5.37-2","8.5.38-1","8.5.38-1~bpo9+1","8.5.38-2","8.5.38-2~bpo9+1","8.5.39-1","8.5.50-0+deb9u1","8.5.54-0+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u2"}]}],"versions":["9.0.16-4","9.0.16-5","9.0.22-1","9.0.24-1","9.0.27-1","9.0.31-1~bpo10+1","9.0.31-1~deb10u1"],"bundled":4},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"fixed":"10.0.0-M5"}]}],"versions":["10.0.0-M1","10.0.0-M3","10.0.0-M4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.35"}]}],"versions":["9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.55"}]}],"versions":["8.0.1","8.0.11","8.0.12","8.0.14","8.0.15","8.0.17","8.0.18","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.32","8.0.33","8.0.35","8.0.36","8.0.37","8.0.38","8.0.39","8.0.41","8.0.42","8.0.43","8.0.44","8.0.45","8.0.46","8.0.47","8.0.48","8.0.49","8.0.5","8.0.50","8.0.51","8.0.52","8.0.53","8.0.8","8.0.9","8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.6","8.5.8","8.5.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.104"}]}],"versions":["7.0.0","7.0.100","7.0.103","7.0.11","7.0.12","7.0.14","7.0.16","7.0.19","7.0.2","7.0.20","7.0.21","7.0.22","7.0.23","7.0.25","7.0.26","7.0.27","7.0.28","7.0.29","7.0.30","7.0.32","7.0.33","7.0.34","7.0.35","7.0.37","7.0.39","7.0.4","7.0.40","7.0.41","7.0.42","7.0.47","7.0.5","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57","7.0.59","7.0.6","7.0.61","7.0.62","7.0.63","7.0.64","7.0.65","7.0.67","7.0.68","7.0.69","7.0.70","7.0.72","7.0.73","7.0.75","7.0.76","7.0.77","7.0.78","7.0.79","7.0.8","7.0.81","7.0.82","7.0.84","7.0.85","7.0.86","7.0.88","7.0.90","7.0.91","7.0.92","7.0.93","7.0.94","7.0.96","7.0.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-M1"},{"fixed":"10.0.0-M5"}]}],"versions":["10.0.0-M1","10.0.0-M3","10.0.0-M4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.35"}]}],"versions":["9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.5.55"}]}],"versions":["8.0.1","8.0.11","8.0.12","8.0.14","8.0.15","8.0.17","8.0.18","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.32","8.0.33","8.0.35","8.0.36","8.0.37","8.0.38","8.0.39","8.0.41","8.0.42","8.0.43","8.0.44","8.0.45","8.0.46","8.0.47","8.0.48","8.0.49","8.0.5","8.0.50","8.0.51","8.0.52","8.0.53","8.0.8","8.0.9","8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.6","8.5.8","8.5.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.104"}]}],"versions":["7.0.0","7.0.100","7.0.103","7.0.11","7.0.12","7.0.14","7.0.16","7.0.19","7.0.2","7.0.20","7.0.21","7.0.22","7.0.23","7.0.25","7.0.26","7.0.27","7.0.28","7.0.29","7.0.30","7.0.32","7.0.33","7.0.34","7.0.35","7.0.37","7.0.39","7.0.4","7.0.40","7.0.41","7.0.42","7.0.47","7.0.5","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57","7.0.59","7.0.6","7.0.61","7.0.62","7.0.63","7.0.64","7.0.65","7.0.67","7.0.68","7.0.69","7.0.70","7.0.72","7.0.73","7.0.75","7.0.76","7.0.77","7.0.78","7.0.79","7.0.8","7.0.81","7.0.82","7.0.84","7.0.85","7.0.86","7.0.88","7.0.90","7.0.91","7.0.92","7.0.93","7.0.94","7.0.96","7.0.99"]},{"source":"osv","ecosystem":"Mageia:7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-22.redhat_22.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-22.redhat_22.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-servlet-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el6","package":"tomcat8-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-22.redhat_22.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-22.redhat_22.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.70-40.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-servlet-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:3.1::el7","package":"tomcat8-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.36-44.ep7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-5.redhat_5.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-5.redhat_5.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el6","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el6jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-5.redhat_5.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-5.redhat_5.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-5.redhat_5.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.23-5.redhat_5.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.3::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.30-4.redhat_5.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.24-115.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.76-12.el7_8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-4.30.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-3.52.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-3.52.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-3.52.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-3.52.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-3.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.53-0.57.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.53-0.57.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-10.43.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-10.43.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.16+esm1"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3","7.0.52-1ubuntu0.6","7.0.52-1ubuntu0.7","7.0.52-1ubuntu0.8","7.0.52-1ubuntu0.9","7.0.52-1ubuntu0.10","7.0.52-1ubuntu0.11","7.0.52-1ubuntu0.13","7.0.52-1ubuntu0.14","7.0.52-1ubuntu0.15","7.0.52-1ubuntu0.16"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4","8.0.32-1ubuntu1.5","8.0.32-1ubuntu1.6","8.0.32-1ubuntu1.7","8.0.32-1ubuntu1.8","8.0.32-1ubuntu1.9","8.0.32-1ubuntu1.10","8.0.32-1ubuntu1.11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+esm2"}]}],"versions":["7.0.64-1","7.0.68-1","7.0.68-1ubuntu0.1","7.0.68-1ubuntu0.3","7.0.68-1ubuntu0.4","7.0.68-1ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.78-1ubuntu0.1~esm1"}]}],"versions":["7.0.78-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+esm2"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2","8.5.39-1ubuntu1~18.04.3","8.5.39-1ubuntu1~18.04.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.1"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4","8.0.32-1ubuntu1.5","8.0.32-1ubuntu1.6","8.0.32-1ubuntu1.7","8.0.32-1ubuntu1.8","8.0.32-1ubuntu1.9","8.0.32-1ubuntu1.10","8.0.32-1ubuntu1.11"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.1"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.2"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.16+esm1"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3","7.0.52-1ubuntu0.6","7.0.52-1ubuntu0.7","7.0.52-1ubuntu0.8","7.0.52-1ubuntu0.9","7.0.52-1ubuntu0.10","7.0.52-1ubuntu0.11","7.0.52-1ubuntu0.13","7.0.52-1ubuntu0.14","7.0.52-1ubuntu0.15","7.0.52-1ubuntu0.16"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+esm2"}]}],"versions":["7.0.64-1","7.0.68-1","7.0.68-1ubuntu0.1","7.0.68-1ubuntu0.3","7.0.68-1ubuntu0.4","7.0.68-1ubuntu0.4+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.78-1ubuntu0.1~esm1"}]}],"versions":["7.0.78-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+esm1"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4","8.0.32-1ubuntu1.5","8.0.32-1ubuntu1.6","8.0.32-1ubuntu1.7","8.0.32-1ubuntu1.8","8.0.32-1ubuntu1.9","8.0.32-1ubuntu1.10","8.0.32-1ubuntu1.11","8.0.32-1ubuntu1.13"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+esm2"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2","8.5.39-1ubuntu1~18.04.3","8.5.39-1ubuntu1~18.04.3+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+esm2"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.6"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.58-1ubuntu0.1+esm2"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.35-lp151.3.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-8.4"}]}],"bundled":25},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14-1.1"}]}],"bundled":49}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mcafee","product":"epolicy_orchestrator"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"agile_engineering_data_management"},{"vendor":"oracle","product":"agile_product_lifecycle_management"},{"vendor":"oracle","product":"communications_cloud_native_core_binding_support_function"},{"vendor":"oracle","product":"communications_cloud_native_core_policy"},{"vendor":"oracle","product":"communications_diameter_signaling_router"},{"vendor":"oracle","product":"communications_element_manager"},{"vendor":"oracle","product":"communications_instant_messaging_server"},{"vendor":"oracle","product":"communications_session_report_manager"},{"vendor":"oracle","product":"communications_session_route_manager"},{"vendor":"oracle","product":"database"},{"vendor":"oracle","product":"fmw_platform"},{"vendor":"oracle","product":"hospitality_guest_access"},{"vendor":"oracle","product":"instantis_enterprisetrack"},{"vendor":"oracle","product":"managed_file_transfer"},{"vendor":"oracle","product":"mysql_enterprise_monitor"},{"vendor":"oracle","product":"retail_order_broker"},{"vendor":"oracle","product":"siebel_apps_-_marketing"},{"vendor":"oracle","product":"siebel_ui_framework"},{"vendor":"oracle","product":"transportation_management"},{"vendor":"oracle","product":"workload_manager"}],"references":[{"url":"https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00020.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca38f5469%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a93c71ae2%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2020/Jun/6","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202006-21","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Mitigation","Patch","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20200528-0005/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://www.debian.org/security/2020/dsa-4727","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4448-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/r123b3ebe389f46f9d337923f393cdae4d3e9b78d982d706712f0898c%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/raa4123e472175bb052fbba165d37187cea923f755e8f3f30d124cb3f%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc8473b08abdf3c16494ed817bec1717a0ee0c8080315bc27db5f21c3%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf59c72572b9fee674a5d5cc6afeca4ffc3918a02c354a81cc50b7119%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4596-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/01/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r8dd19c514face6dd85fd4eab0271854883f40c7307926c1f7cd5400c%40%3Ccommits.tomee.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77%40%3Cusers.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc1778b38e74b5b6142414d57623bd55b023a72361f422836782fca3c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9484","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926@%3Cusers.tomcat.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca38f5469@%3Cusers.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a93c71ae2@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r123b3ebe389f46f9d337923f393cdae4d3e9b78d982d706712f0898c@%3Ccommits.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/raa4123e472175bb052fbba165d37187cea923f755e8f3f30d124cb3f@%3Ccommits.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rc8473b08abdf3c16494ed817bec1717a0ee0c8080315bc27db5f21c3@%3Ccommits.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rf59c72572b9fee674a5d5cc6afeca4ffc3918a02c354a81cc50b7119@%3Ccommits.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cusers.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8dd19c514face6dd85fd4eab0271854883f40c7307926c1f7cd5400c@%3Ccommits.tomee.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc@%3Cusers.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f@%3Cusers.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77@%3Cusers.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rc1778b38e74b5b6142414d57623bd55b023a72361f422836782fca3c@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b167a2222.patch","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/bb33048e3f9b4f2b70e4da2e6c4e34ca89023b1b","tags":["web","report"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1171928","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/74b105657ffbd1d1de80455f03446c3bbf30d1f5","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/93f0cc403a9210d469afc2bd9cf03ab3251c6f35","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-8.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-7.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-10.html","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20200528-0005","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ","tags":["web"]},{"url":"https://usn.ubuntu.com/4448-1","tags":["web"]},{"url":"https://usn.ubuntu.com/4596-1","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ","tags":["web"]},{"url":"https://github.com/advisories/GHSA-344f-f5vg-2jfj"},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1655757814","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18_04-els/CLSA-2023-1691083477","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1724260496.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-9484","tags":["advisory"]},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0277.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26657","tags":["report"]},{"url":"http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.35","tags":["web","article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2483","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1838332","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2483.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-9484","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9484","tags":["advisory","report"]},{"url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/202005.mbox/%3Ce3a0a517-bf82-ba62-0af6-24b83ea0e4e2%40apache.org%3E","tags":["article"]},{"url":"http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M5","tags":["article"]},{"url":"http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.104","tags":["article"]},{"url":"http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.55","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2506","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2506.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2529","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2529.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2530","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2530.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201363-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171928","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9484","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201364-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201365-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014375-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1136085","tags":["report"]},{"url":"https://bugzilla.suse.com/1159723","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12418","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201497-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159729","tags":["report"]},{"url":"https://bugzilla.suse.com/1164825","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17569","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201498-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-9484","tags":["report"]},{"url":"https://github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b167a2222","tags":["report"]},{"url":"https://github.com/apache/tomcat/commit/ec08af18d0f9ddca3f2d800ef66fe7fd20afef2f","tags":["report"]},{"url":"https://github.com/apache/tomcat/commit/53e30390943c18fca0c9e57dbcc14f1c623cfd06","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4448-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4596-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5360-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6908-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6943-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-1935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-17527","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-30640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41079","tags":["report"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/tomcat9/+bug/1915911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-0221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29885","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KEGFHXFDNNML32KIYPBCJAKPCF3Q6VJ6/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-9484","description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","status":"published","published":"2020-05-20T18:26:41Z","modified":"2026-10-08T21:03:14.884Z","updated_at":"2026-11-02T14:35:49.538427Z"}],"euvd":[{"id":"EUVD-2020-0404","description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","status":"published","published":"2020-05-20T18:26:41Z","modified":"2026-10-08T21:03:14Z","updated_at":"2026-11-02T17:27:27.240961Z"}],"ghsa":[{"id":"GHSA-344f-f5vg-2jfj","title":"Potential remote code execution in Apache Tomcat","description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","status":"published","published":"2020-05-21T18:52:29Z","modified":"2026-08-25T18:32:38Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:41:05.994358Z"}],"nvd":[{"id":"CVE-2020-9484","description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","status":"published","published":"2020-05-20T19:15:09.257Z","modified":"2026-10-08T21:17:32.813Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"CVE-2020-9484","description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","status":"published","published":"2020-05-20T19:15:09.257Z","modified":"2026-10-24T10:30:25.498736191Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-9484","description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","status":"published","published":"2020-05-20T19:15:09.257Z","modified":"2026-10-26T12:02:08.706358002Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-344f-f5vg-2jfj","title":"Potential remote code execution in Apache Tomcat","description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","status":"published","published":"2020-05-21T18:52:29Z","modified":"2026-08-26T01:19:37.725703633Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"RHSA-2020:2483","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 9 security update","status":"published","published":"2024-09-13T22:40:58Z","modified":"2026-10-02T10:01:15Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2506","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.3.1 security update","status":"published","published":"2024-09-13T22:41:12Z","modified":"2026-10-02T10:01:16Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2529","title":"Red Hat Security Advisory: tomcat6 security update","status":"published","published":"2024-09-13T22:41:11Z","modified":"2026-10-02T10:01:16Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2530","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2024-09-13T22:41:21Z","modified":"2026-10-02T10:01:17Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2020-9484","description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","status":"published","published":"2020-05-20T19:15:00Z","modified":"2026-02-04T02:43:03.827669Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"BIT-tomcat-2020-9484","description":"When using Apache Tomcat versions 9.0.0 through 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","status":"published","published":"2024-03-06T11:10:32.165Z","modified":"2026-09-08T08:48:20.600621352Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2022-1655757814","title":"Fix CVE(s): CVE-2020-1938, CVE-2020-9484, CVE-2021-25329","description":"\n   * Fix build process:\n     - debian/keystores/*.pem|*.jks: update expiring certs and keystores\n     - debian/patches/0028-update-expiring-test-certs.patch: update expiring\n       test certs\n     - debian/patches/0029-fix-path-to-valid-keystore.patch: fix path to valid\n       keystore\n     - debian/patches/0030-use-tls12-in-tests.patch: use TLSv1.2 protocol\n       instead of TLSv1 for several tests\n   * SECURITY UPDATE: AJP Request Injection and potential Remote Code Execution\n     - debian/patches/CVE-2020-1938-1.patch: rename requiredSecret to secret\n       and add secretRequired\n     - debian/patches/CVE-2020-1938-2.patch: refactor secret check\n     - debian/patches/CVE-2020-1938-3.patch: add new AJP attribute\n       allowedArbitraryRequestAttributes\n     - debian/patches/CVE-2020-1938-4.patch: change the default bind address\n       for AJP to the loopback address\n     - CVE-2020-1938\n   * SECURITY UPDATE: Remote Code Execution via session persistence\n     - debian/patches/CVE-2020-9484.patch: improve validation of storage\n       location when using FileStore\n     - CVE-2020-9484\n   * SECURITY UPDATE: Fix for CVE-2020-9484 was incomplete\n     - debian/patches/CVE-2021-25329.patch: use consistent approach for\n       sub-directory checking\n     - CVE-2021-25329","status":"published","published":"2022-06-20T20:43:34Z","modified":"2026-06-04T10:03:33.565316Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2023-1691083477","title":"Fix CVE(s): CVE-2021-25329, CVE-2022-23181, CVE-2020-9484","description":"\n   * SECURITY UPDATE: Remote Code Execution via session persistence\n     - debian/patches/CVE-2020-9484.patch: Improve validation of storage\n       location when using FileStore.\n     - CVE-2020-9484\n   * SECURITY UPDATE: Fix for CVE-2020-9484 was incomplete\n     - debian/patches/CVE-2021-25329-pre1.patch: Fix some edge cases where\n       the docBase was not being set using a canonical path which in turn\n       meant resource URLs were not being constructed as expected.\n     - debian/patches/CVE-2021-25329.patch: Use java.nio.file.Path for\n       consistent sub-directory checking.\n     - CVE-2021-25329\n   * SECURITY UPDATE: Local Privilege Escalation\n     - debian/patches/CVE-2022-23181.patch: Make calculation of session\n       storage location more robust.\n     - CVE-2022-23181\n   * Update the expired test certificates:\n     - debian/test_certs/*.pem|*.jks: Take the last test certificates from\n       the upstream branch 8.5.x.\n     - debian/source/include-binaries: Specifying the binary *.jks files\n       to prevent build failures.\n     - debian/rules: Before the testing stage, the old certificates in the\n       source code are replaced with the new ones from debian/test_certs.","status":"published","published":"2023-08-03T17:24:42Z","modified":"2026-06-04T10:03:50.389828724Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2024-1724260496","title":"Fix CVE(s): CVE-2020-9484, CVE-2021-25329, CVE-2022-23181","description":"   * SECURITY UPDATE: still vulnerable to CVE-2020-9484 with a\n     configuration edge case\n     - debian/patches/CVE-2021-25329.patch: use java.nio.file.Path for\n       consistent sub-directory checking\n     - CVE-2021-25329\n   * SECURITY UPDATE: time-of-check to time-of-use vulnerability introduced\n     by the CVE-2020-9484 fix\n     - debian/patches/CVE-2022-23181.patch: make calculation of session\n       storage location more robust\n     - CVE-2022-23181\n   * Internal tests:\n     - debian/rules: fail the build if some of the tests have failed\n     - debian/patches/skipping-tests-incompatible-with-firewall.patch:\n       backport from ubuntu18 els\n     - debian/patches/dont-test-unsupported-ciphers.patch: skip testing of\n       unsupported ciphers\n     - debian/patches/skip-tests-error-and-unstable.patch: skip tests that\n       fail with error and unstable ones","status":"published","published":"2024-08-21T17:14:59Z","modified":"2026-06-04T10:03:44.145569Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2025-1748282295","title":"Fix of 34 CVEs","description":"   * SECURITY UPDATE: Misc vulnerability fixes\n     - CVE-2019-12418, CVE-2019-17563, CVE-2020-1935,\n       CVE-2020-11996, CVE-2020-13934, CVE-2020-13935,\n       CVE-2020-13943, CVE-2020-17527, CVE-2021-24122,\n       CVE-2021-30639, CVE-2021-30640, CVE-2021-33037,\n       CVE-2021-42340, CVE-2021-43980, CVE-2022-25762,\n       CVE-2022-34305, CVE-2022-45143, CVE-2023-24998,\n       CVE-2023-28709, CVE-2023-34981, CVE-2023-42794,\n       CVE-2024-21733\n   * Update to 8.5.100\n     - debian/rules,\n       debian/libtomcat8-java.poms,\n       debian/maven.rules,\n       debian/tomcat8-common.links,\n       debian/patches/0018-fix-manager-webapp.patch,\n       debian/patches/0019-add-distribution-to-error-page.patch,\n       debian/patches/0021-dont-test-unsupported-ciphers.patch,\n       debian/patches/0101-skipping-tests-incompatible-with-firewall.patch:\n       updated\n     - debian/patches/0002-do-not-load-AJP13-connector-by-default.patch,\n       debian/patches/0026-easymock4-compatibility.patch:\n       removed as they were applied in upstream\n     - CVE-2019-0221.patch, CVE-2019-10072-1.patch,\n       CVE-2019-10072-2.patch, CVE-2022-42252.patch,\n       CVE-2020-1938.patch, CVE-2021-25122.patch,\n       CVE-2021-41079.patch, CVE-2022-29885.patch,\n       CVE-2020-9484.patch, CVE-2021-25329-pre1.patch,\n       CVE-2021-25329.patch, CVE-2022-23181.patch,\n       CVE-2023-44487.patch, CVE-2023-46589-pre1.patch,\n       CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch,\n       CVE-2023-46589-pre4.patch, CVE-2023-46589.patch:\n       removed because these CVEs were fixed in upstream\n   * Internal tests\n     - debian/test_certs/*: updated from upstream branch 9.0.x, as the\n       8.0.x certs were expired","status":"published","published":"2025-05-27T13:45:18Z","modified":"2026-06-04T10:03:30.412984079Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2026-1788873744","title":"TuxCare security update for 7 packages (11 CVEs)","description":"TuxCare rebuilt 7 packages to address 11 CVEs. Fixed in 7.0.70-tuxcare.3.","status":"published","published":"2026-09-08T13:22:24Z","modified":"2026-11-02T19:46:10.343724988Z","updated_at":"2026-11-02T20:29:40.716173Z"},{"id":"CLSA-2026-1792575257","title":"TuxCare security update for 8 packages (32 CVEs)","description":"TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.","status":"published","published":"2026-10-21T09:34:17Z","modified":"2026-11-02T19:46:30.353719339Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792686134","title":"TuxCare security update for 5 packages (9 CVEs)","description":"TuxCare rebuilt 5 packages to address 9 CVEs. Fixed in 9.0.13-tuxcare.1.","status":"published","published":"2026-10-22T16:22:14Z","modified":"2026-11-02T19:46:30.80805642Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"DLA-2209-1","title":"tomcat8 - security update","status":"published","published":"2020-05-11T00:00:00Z","modified":"2026-03-09T01:19:26.551087Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-2217-1","title":"tomcat7 - security update","status":"published","published":"2020-05-23T00:00:00Z","modified":"2026-03-09T01:21:07.133382Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-2279-1","title":"tomcat8 - security update","status":"published","published":"2020-07-12T00:00:00Z","modified":"2026-03-09T01:19:29.179002Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4727-1","title":"tomcat9 - security update","status":"published","published":"2020-07-17T00:00:00Z","modified":"2026-03-09T02:08:56.423819Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0277","title":"Updated tomcat packages fix security vulnerability","description":"Updated tomcat packages fix security vulnerability:\n\nWhen using Apache Tomcat versions 9.0.0.M1 to 9.0.34, if a) an attacker\nis able to control the contents and name of a file on the server; and\nb) the server is configured to use the PersistenceManager with a\nFileStore; and c) the PersistenceManager is configured with\nsessionAttributeValueClassNameFilter=\"null\" (the default unless a\nSecurityManager is used) or a sufficiently lax filter to allow the\nattacker provided object to be deserialized; and d) the attacker knows\nthe relative file path from the storage location used by FileStore to the\nfile the attacker has control over; then, using a specifically crafted\nrequest, the attacker will be able to trigger remote code execution via\ndeserialization of the file under their control. Note that all of\nconditions a) to d) must be true for the attack to succeed (CVE-2020-9484).\n","status":"published","published":"2020-07-05T11:26:44Z","modified":"2026-04-16T04:42:47.852462331Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0711-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- Update to Tomcat 9.0.35. See changelog at\n  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)\n\n* CVE-2020-9484 (bsc#1171928)\n  Apache Tomcat Remote Code Execution via session persistence\n\n  If an attacker was able to control the contents and name of a file on a\n  server configured to use the PersistenceManager, then the attacker could\n  have triggered a remote code execution via deserialization of the file under\n  their control.\n\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-05-24T22:12:17Z","modified":"2026-02-04T03:56:27.57821Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11468-1","title":"tomcat-9.0.36-8.4 on GA media","description":"These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:40.917277Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:13441-1","title":"tomcat10-10.1.14-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:52.718146Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2020:1363-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- Update to Tomcat 9.0.35. See changelog at\n  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)\n\n* CVE-2020-9484 (bsc#1171928)\n  Apache Tomcat Remote Code Execution via session persistence\n\n  If an attacker was able to control the contents and name of a file on a\n  server configured to use the PersistenceManager, then the attacker could\n  have triggered a remote code execution via deserialization of the file under\n  their control.\n\n","status":"published","published":"2020-05-21T14:55:21Z","modified":"2026-02-04T04:10:18.463868Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1364-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- Update to Tomcat 9.0.35. See changelog at\n  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)\n\n* CVE-2020-9484 (bsc#1171928)\n  Apache Tomcat Remote Code Execution via session persistence\n\n  If an attacker was able to control the contents and name of a file on a\n  server configured to use the PersistenceManager, then the attacker could\n  have triggered a remote code execution via deserialization of the file under\n  their control.\n\n","status":"published","published":"2020-05-21T14:55:47Z","modified":"2026-02-04T03:44:57.936785Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1365-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- Update to Tomcat 9.0.35. See changelog at\n  http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.35_(markt)\n\n* CVE-2020-9484 (bsc#1171928)\n  Apache Tomcat Remote Code Execution via session persistence\n\n  If an attacker was able to control the contents and name of a file on a\n  server configured to use the PersistenceManager, then the attacker could\n  have triggered a remote code execution via deserialization of the file under\n  their control.\n\n\n","status":"published","published":"2020-05-21T14:56:07Z","modified":"2026-02-04T04:40:42.625867Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:14375-1","title":"Security update for tomcat6","description":"This update for tomcat6 fixes the following issues:\n\nCVE-2020-9484 (bsc#1171928)\nApache Tomcat Remote Code Execution via session persistence\n\nIf an attacker was able to control the contents and name of a file on a\nserver configured to use the PersistenceManager, then the attacker could\nhave triggered a remote code execution via deserialization of the file under\ntheir control.\n\nCVE-2019-12418 (bsc#1159723)\nLocal privilege escalation by manipulating the RMI registry and performing a man-in-the-middle attack\n\nWhen Tomcat is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files was able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface.\nThe attacker could then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.\n\nCVE-2019-0221 (bsc#1136085)\nThe SSI printenv command echoed user provided data without escaping, which\nmade it vulnerable to XSS.\n\n","status":"published","published":"2020-05-22T13:01:48Z","modified":"2026-02-04T03:24:17.153109Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1497-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nCVE-2020-9484 (bsc#1171928)\nApache Tomcat Remote Code Execution via session persistence\n\nIf an attacker was able to control the contents and name of a file on a\nserver configured to use the PersistenceManager, then the attacker could\nhave triggered a remote code execution via deserialization of the file under\ntheir control.\n\nCVE-2019-12418 (bsc#1159723)\nLocal privilege escalation by manipulating the RMI registry and performing a man-in-the-middle attack\n\nWhen Tomcat is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files was able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface.\nThe attacker could then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.\n\nCVE-2019-0221 (bsc#1136085)\nThe SSI printenv command echoed user provided data without escaping, which\nmade it vulnerable to XSS.\n\nCVE-2019-17563 (bsc#1159729)\nWhen using FORM authentication there was a narrow window where an attacker could perform a session fixation attack.\n\nCVE-2019-17569 (bsc#1164825)\nInvalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling\nif Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header.\n\n","status":"published","published":"2020-05-28T07:58:11Z","modified":"2026-02-04T03:02:49.119223Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1498-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nCVE-2020-9484 (bsc#1171928)\nApache Tomcat Remote Code Execution via session persistence\n\nIf an attacker was able to control the contents and name of a file on a\nserver configured to use the PersistenceManager, then the attacker could\nhave triggered a remote code execution via deserialization of the file under\ntheir control.\n\nCVE-2019-12418 (bsc#1159723)\nLocal privilege escalation by manipulating the RMI registry and performing a man-in-the-middle attack\n\nWhen Tomcat is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files was able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface.\nThe attacker could then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.\n\nCVE-2019-0221 (bsc#1136085)\nThe SSI printenv command echoed user provided data without escaping, which\nmade it vulnerable to XSS.\n\nCVE-2019-17563 (bsc#1159729)\nWhen using FORM authentication there was a narrow window where an attacker could perform a session fixation attack.\n\nCVE-2019-17569 (bsc#1164825)\nInvalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling\nif Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header.\n\n","status":"published","published":"2020-05-28T08:39:40Z","modified":"2026-02-04T02:54:22.175009Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4448-1","title":"tomcat8 vulnerabilities","description":"It was discovered that Tomcat incorrectly validated the payload length in\na WebSocket frame. A remote attacker could possibly use this issue to cause\nTomcat to hang, resulting in a denial of service. (CVE-2020-13935)\n\nIt was discovered that Tomcat incorrectly handled HTTP header parsing. In\ncertain environments where Tomcat is located behind a reverse proxy, a\nremote attacker could possibly use this issue to perform HTTP Reqest\nSmuggling. (CVE-2020-1935)\n\nIt was discovered that Tomcat incorrectly handled certain uncommon\nPersistenceManager with FileStore configurations. A remote attacker could\npossibly use this issue to execute arbitrary code. (CVE-2020-9484)\n","status":"published","published":"2020-08-04T16:56:27Z","modified":"2026-04-27T15:48:45.707556511Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4596-1","title":"tomcat9 vulnerabilities","description":"It was discovered that Tomcat did not properly manage HTTP/2 streams. An \nattacker could possibly use this to cause Tomcat to consume resources, \nresulting in a denial of service. (CVE-2020-11996)\n\nIt was discovered that Tomcat did not properly release the HTTP/1.1 \nprocessor after the upgrade to HTTP/2. An attacker could possibly use this\nto generate an OutOfMemoryException, resulting in a denial of service. \n(CVE-2020-13934)\n\nIt was discovered that Tomcat did not properly validate the payload length\nin a WebSocket frame. An attacker could possibly use this to trigger an\ninfinite loop, resulting in a denial of service. (CVE-2020-13935)\n\nIt was discovered that Tomcat did not properly deserialize untrusted data.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-9484)\n","status":"published","published":"2020-10-21T13:55:35Z","modified":"2026-04-27T15:48:48.204382856Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-5360-1","title":"tomcat9 vulnerabilities","description":"It was discovered that Tomcat incorrectly performed input verification.\nA remote attacker could possibly use this issue to intercept sensitive\ninformation. (CVE-2020-13943, CVE-2020-17527, CVE-2021-25122, CVE-2021-30640)\n\nIt was discovered that Tomcat did not properly deserialize untrusted data.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-9484, CVE-2021-33037)\n\nIt was discovered that Tomcat did not properly validate the input length. An\nattacker could possibly use this to trigger an infinite loop, resulting in a\ndenial of service. (CVE-2021-25329, CVE-2021-41079)\n","status":"published","published":"2022-03-31T18:51:57Z","modified":"2026-04-27T16:19:03.780060309Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-6908-1","title":"tomcat vulnerabilities","description":"It was discovered that the Tomcat SSI printenv command echoed user\nprovided data without escaping it. An attacker could possibly use this\nissue to perform an XSS attack. (CVE-2019-0221)\n\nIt was discovered that Tomcat incorrectly handled certain uncommon\nPersistenceManager with FileStore configurations. A remote attacker could\npossibly use this issue to execute arbitrary code.\n(CVE-2020-9484, CVE-2021-25329)\n","status":"published","published":"2024-07-23T14:03:15Z","modified":"2026-06-29T13:51:14.12226282Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6943-1","title":"tomcat8, tomcat9 vulnerabilities","description":"It was discovered that Tomcat incorrectly handled certain uncommon\nPersistenceManager with FileStore configurations. A remote attacker could\npossibly use this issue to execute arbitrary code. This issue only affected\ntomcat8 for Ubuntu 18.04 LTS (CVE-2020-9484)\n\nIt was discovered that Tomcat incorrectly handled certain HTTP/2 connection\nrequests. A remote attacker could use this issue to obtain wrong responses\npossibly containing sensitive information. This issue only affected tomcat8\nfor Ubuntu 18.04 LTS (CVE-2021-25122)\n\nThomas Wozenilek discovered that Tomcat incorrectly handled certain TLS\npackets. A remote attacker could possibly use this issue to cause a denial\nof service. This issue only affected tomcat8 for Ubuntu 18.04 LTS\n(CVE-2021-41079)\n\nTrung Pham discovered that a race condition existed in Tomcat when handling\nsession files with FileStore. A remote attacker could possibly use this\nissue to execute arbitrary code. This issue affected tomcat8 for Ubuntu\n16.04 LTS and Ubuntu 18.04 LTS, and tomcat9 for Ubuntu 18.04 LTS and Ubuntu\n20.04 LTS (CVE-2022-23181)\n\nIt was discovered that Tomcat's documentation incorrectly stated that\nEncryptInterceptor provided availability protection when running over an\nuntrusted network. A remote attacker could possibly use this issue to cause\na denial of service even if EncryptInterceptor was being used. This issue\naffected tomcat8 for Ubuntu 18.04 LTS, and tomcat9 for Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS (CVE-2022-29885)\n","status":"published","published":"2024-08-01T20:25:09Z","modified":"2026-06-25T13:32:28.896823535Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}