Search for packages
| purl | pkg:rpm/redhat/jws5-tomcat-native@1.2.25-3.redhat_3?arch=el7jws |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-a8gk-n8bq-87cp
Aliases: CVE-2021-24122 GHSA-2rvv-w9r2-rg7m |
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances. | There are no reported fixed by versions. |
|
VCID-ran8-rnqn-tkbc
Aliases: CVE-2020-17527 GHSA-vvw4-rfwf-p6hx |
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests. | There are no reported fixed by versions. |
|
VCID-wgsc-dnn1-ukeq
Aliases: CVE-2020-13943 GHSA-f268-65qc-98vg |
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. | There are no reported fixed by versions. |
|
VCID-yqkw-e99v-jbgt
Aliases: CVE-2020-1971 |
A vulnerability in OpenSSL might allow remote attackers to cause a Denial of Service condition. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T14:04:16.957269+00:00 | RedHat Importer | Affected by | VCID-wgsc-dnn1-ukeq | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-13943.json | 38.0.0 |
| 2026-04-01T14:03:48.581947+00:00 | RedHat Importer | Affected by | VCID-ran8-rnqn-tkbc | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-17527.json | 38.0.0 |
| 2026-04-01T14:03:45.550750+00:00 | RedHat Importer | Affected by | VCID-yqkw-e99v-jbgt | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-1971.json | 38.0.0 |
| 2026-04-01T14:03:30.279442+00:00 | RedHat Importer | Affected by | VCID-a8gk-n8bq-87cp | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-24122.json | 38.0.0 |