VulnerableCode Package Details - pkg:rpm/redhat/tomcat6@6.0.41-17_patch

Search for packages

Vulnerability	Summary	Fixed by
VCID-fyfz-6tr5-2fc7 Aliases: CVE-2017-5664 GHSA-jmvv-524f-hj5j	The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.	There are no reported fixed by versions.
VCID-m1zd-uytj-3bej Aliases: CVE-2017-5647 GHSA-3gv7-3h64-78cm	A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.	There are no reported fixed by versions.
VCID-nsjj-szaq-1kgd Aliases: CVE-2016-6304	Multiple vulnerabilities have been found in OpenSSL, the worst of which allows attackers to conduct a time based side-channel attack.	There are no reported fixed by versions.
VCID-pbjc-7myj-tqas Aliases: CVE-2016-8610	security update	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-fyfz-6tr5-2fc7
Aliases:
CVE-2017-5664
GHSA-jmvv-524f-hj5j

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.

There are no reported fixed by versions.

VCID-m1zd-uytj-3bej
Aliases:
CVE-2017-5647
GHSA-3gv7-3h64-78cm

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.

There are no reported fixed by versions.

VCID-nsjj-szaq-1kgd
Aliases:
CVE-2016-6304

Multiple vulnerabilities have been found in OpenSSL, the worst of which allows attackers to conduct a time based side-channel attack.

There are no reported fixed by versions.

VCID-pbjc-7myj-tqas
Aliases:
CVE-2016-8610

security update

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T14:34:38.958549+00:00	RedHat Importer	Affected by	VCID-nsjj-szaq-1kgd	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-6304.json	38.0.0
2026-04-01T14:33:58.039976+00:00	RedHat Importer	Affected by	VCID-pbjc-7myj-tqas	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-8610.json	38.0.0
2026-04-01T14:31:12.535965+00:00	RedHat Importer	Affected by	VCID-m1zd-uytj-3bej	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-5647.json	38.0.0
2026-04-01T14:30:46.117858+00:00	RedHat Importer	Affected by	VCID-fyfz-6tr5-2fc7	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-5664.json	38.0.0