VulnerableCode Package Details - pkg:rpm/redhat/tomcat8@8.0.36-24.ep7?arch=el7

Search for packages

Vulnerability	Summary	Fixed by
VCID-74dr-6hxt-tbgu Aliases: CVE-2017-5645 GHSA-fxph-q3j8-mv87	In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.	There are no reported fixed by versions.
VCID-enaj-f97c-jbh7 Aliases: CVE-2017-7674 GHSA-73rx-3f9r-x949	The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.	There are no reported fixed by versions.
VCID-fyfz-6tr5-2fc7 Aliases: CVE-2017-5664 GHSA-jmvv-524f-hj5j	The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.	There are no reported fixed by versions.
VCID-hmbm-5ysw-77bu Aliases: CVE-2017-5648 GHSA-3vx3-xf6q-r5xp	While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.	There are no reported fixed by versions.
VCID-m1zd-uytj-3bej Aliases: CVE-2017-5647 GHSA-3gv7-3h64-78cm	A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.	There are no reported fixed by versions.
VCID-nsjj-szaq-1kgd Aliases: CVE-2016-6304	Multiple vulnerabilities have been found in OpenSSL, the worst of which allows attackers to conduct a time based side-channel attack.	There are no reported fixed by versions.
VCID-pbjc-7myj-tqas Aliases: CVE-2016-8610	security update	There are no reported fixed by versions.
VCID-zbwq-f71w-jqhy Aliases: CVE-2019-17571 GHSA-2qrg-x229-3v8q	Deserialization of Untrusted Data in Log4j Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up to 1.2.17. Users are advised to migrate to `org.apache.logging.log4j:log4j-core`.	There are no reported fixed by versions.
VCID-zypm-ffez-dqbz Aliases: CVE-2016-7056	security update	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-74dr-6hxt-tbgu
Aliases:
CVE-2017-5645
GHSA-fxph-q3j8-mv87

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.