This update for tomcat to 8.0.53 fixes the following issues :

Security issue fixed :

  - CVE-2018-1336: An improper handing of overflow in the     UTF-8 decoder with supplementary characters could have     lead to an infinite loop in the decoder causing a Denial     of Service (bsc#1102400).

  - CVE-2018-8034: The host name verification when using TLS     with the WebSocket client was missing. It is now enabled     by default (bsc#1102379).

  - CVE-2018-8037: If an async request was completed by the     application at the same time as the container triggered     the async timeout, a race condition existed that could     have resulted in a user seeing a response intended for a     different user. An additional issue was present in the     NIO and NIO2 connectors that did not correctly track the     closure of the connection when an async request was     completed by the application and timed out by the     container at the same time. This could also have     resulted in a user seeing a response intended for     another user (bsc#1102410).

  - CVE-2018-8014: Fix insecure default CORS filter settings     (bsc#1093697).

Bug fixes :

  - bsc#1067720: Avoid overwriting of customer's     configuration during update.

  - bsc#1095472: Add Obsoletes for tomcat6 packages.

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for tomcat to version 9.0.10 fixes the following issues :

Security issues fixed :

  - CVE-2018-1336: An improper handing of overflow in the     UTF-8 decoder with supplementary characters could have     lead to an infinite loop in the decoder causing a Denial     of Service (bsc#1102400).

  - CVE-2018-8014: Fix insecure default CORS filter settings     (bsc#1093697).

  - CVE-2018-8034: The host name verification when using TLS     with the WebSocket client was missing. It is now enabled     by default (bsc#1102379).

  - CVE-2018-8037: If an async request was completed by the     application at the same time as the container triggered     the async timeout, a race condition existed that could     have resulted in a user seeing a response intended for a     different user. An additional issue was present in the     NIO and NIO2 connectors that did not correctly track the     closure of the connection when an async request was     completed by the application and timed out by the     container at the same time. This could also have     resulted in a user seeing a response intended for     another user (bsc#1102410).

Bug fixes :

  - Avoid overwriting of customer's configuration during     update (bsc#1067720)

  - Disable adding OSGi metadata to JAR files

  - See changelog at     http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#T     omcat_9.0.10_(markt)

This update was imported from the SUSE:SLE-15:Update update project.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0500 advisory.

    This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 9.2. It addresses 29 CVEs:
    CVE-2016-5425, CVE-2018-1304, CVE-2025-24813, CVE-2016-3092, CVE-2018-8034, and 24 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The URL pattern of '' (the empty string) which exactly     maps to the context root was not correctly handled in     Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27,     8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as     part of a security constraint definition. This caused     the constraint to be ignored. It was, therefore,     possible for unauthorised users to gain access to web     application resources that should have been protected.
    Only security constraints with a URL pattern of the     empty string were affected.(CVE-2018-1304)

  - Security constraints defined by annotations of Servlets     in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27,     8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only     applied once a Servlet had been loaded. Because     security constraints defined in this way apply to the     URL pattern and any URLs below that point, it was     possible - depending on the order Servlets were loaded
    - for some security constraints not to be applied. This     could have exposed resources to users who were not     authorised to access them.(CVE-2018-1305)

  - The SSI printenv command in Apache Tomcat 9.0.0.M1 to     9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes     user provided data without escaping and is, therefore,     vulnerable to XSS. SSI is disabled by default. The     printenv command is intended for debugging and is     unlikely to be present in a production     website.(CVE-2019-0221)

  - The host name verification when using TLS with the     WebSocket client was missing. It is now enabled by     default. Versions Affected: Apache Tomcat 9.0.0.M1 to     9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35     to 7.0.88.(CVE-2018-8034)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.(CVE-2018-8014)

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 8.5.0 to 8.5.30. (CVE-2018-1336)

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 8.5.0 to 8.5.31.(CVE-2018-8034)

A bug in the tracking of connection closures can lead to reuse of user sessions in a new connection. Versions Affected: Apache Tomcat 8.5.5 to 8.5.31.(CVE-2018-8037)

This update includes a rebase from 8.5.30 up to 8.5.32 which resolves two CVEs along with various other bugs/features :

  - rhbz#1579612 CVE-2018-8014 tomcat: Insecure defaults in     CORS filter enable 'supportsCredentials' for all origins

  - rhbz#1607586 CVE-2018-8034 tomcat: host name     verification missing in WebSocket client

  - rhbz#1607584 CVE-2018-8037 tomcat: Due to a mishandling     of close in NIO/NIO2 connectors user sessions can get     mixed up

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) installation running on the remote web server is 8.4 prior to 8.4.15.10, 15.x prior to 15.2.18.4, 16.x prior to 16.2.17.2, 17.x prior to 17.12.12.0, or 18.x prior to 18.8.8.0. It is, therefore, affected by multiple vulnerabilities:

  - A deserialization vulnerability in Apache Commons     FileUpload allows for remote code execution.
    (CVE-2016-1000031)

  - A denial of service vulnerability in the bundled     third-party component OpenSSL library's DSA signature     algorithm that renders it vulnerable to a timing side     channel attack. An attacker could leverage this     vulnerability to recover the private key.
    (CVE-2018-0734)

  - A deserialization vulnerability in jackson-databind, a     fast and powerful JSON library for Java, allows an     unauthenticated user to perform code execution. The     issue was resolved by extending the blacklist and     blocking more classes from polymorphic deserialization.
    (CVE-2018-19362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2205 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure     of resources (CVE-2018-1304)

    * tomcat: Late application of security constraints can lead to resource exposure for unauthorised users     (CVE-2018-1305)

    * tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)

    * tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)

* tomcat: Late application of security constraints can lead to resource exposure for unauthorised users (CVE-2018-1305)

* tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)

* tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
117526	openSUSE Security Update : tomcat (openSUSE-2018-1019)	Nessus	SuSE Local Security Checks	2018/9/17	2024/8/7	critical
117983	openSUSE Security Update : tomcat (openSUSE-2018-1129)	Nessus	SuSE Local Security Checks	2018/10/9	2024/7/31	critical
355265	Rocky Linux 9.2 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ciqsa-2026_0500)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
131853	EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2019-2361)	Nessus	Huawei Local Security Checks	2019/12/10	2024/4/5	high
111611	Amazon Linux AMI : tomcat8 (ALAS-2018-1056)	Nessus	Amazon Linux Local Security Checks	2018/8/10	2024/8/23	critical
120717	Fedora 28 : 1:tomcat (2018-b1832101b8)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/1	critical
124169	Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) Multiple Vulnerabilities (Apr 2019 CPU)	Nessus	CGI abuses	2019/4/19	2024/5/31	critical
127697	RHEL 7 : tomcat (RHSA-2019:2205)	Nessus	Red Hat Local Security Checks	2019/8/12	2024/11/6	critical
128376	CentOS 7 : tomcat (CESA-2019:2205)	Nessus	CentOS Local Security Checks	2019/8/30	2019/12/31	critical

検出

プラグインの検索

critical

critical

critical

high

critical

critical

critical

critical

critical