Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:rpm/redhat/jws5-tomcat-native@1.2.25-3.redhat_3?arch=el7jws
purl pkg:rpm/redhat/jws5-tomcat-native@1.2.25-3.redhat_3?arch=el7jws
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 4.0
Vulnerabilities affecting this package (4)
Vulnerability Summary Fixed by
VCID-a8gk-n8bq-87cp
Aliases:
CVE-2021-24122
GHSA-2rvv-w9r2-rg7m
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances. There are no reported fixed by versions.
VCID-ran8-rnqn-tkbc
Aliases:
CVE-2020-17527
GHSA-vvw4-rfwf-p6hx
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests. There are no reported fixed by versions.
VCID-wgsc-dnn1-ukeq
Aliases:
CVE-2020-13943
GHSA-f268-65qc-98vg
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. There are no reported fixed by versions.
VCID-yqkw-e99v-jbgt
Aliases:
CVE-2020-1971
A vulnerability in OpenSSL might allow remote attackers to cause a Denial of Service condition. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T14:04:16.957269+00:00 RedHat Importer Affected by VCID-wgsc-dnn1-ukeq https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-13943.json 38.0.0
2026-04-01T14:03:48.581947+00:00 RedHat Importer Affected by VCID-ran8-rnqn-tkbc https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-17527.json 38.0.0
2026-04-01T14:03:45.550750+00:00 RedHat Importer Affected by VCID-yqkw-e99v-jbgt https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-1971.json 38.0.0
2026-04-01T14:03:30.279442+00:00 RedHat Importer Affected by VCID-a8gk-n8bq-87cp https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-24122.json 38.0.0