{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: denial of service via crafted WebSocket frame with\n a 64-bit payload length whose most significant bit is set. The\n extended payload length read in WsFrameBase.processRemainingHeader()\n was assembled into a Java long without validation. With bit 63 set\n the value became negative, which the consumer then used as a loop\n bound, causing an infinite loop and exhausting CPU on the server\n thread. Affects Apache Tomcat 7.0.0 to 7.0.104, 8.5.0 to 8.5.56,\n 9.0.0.M1 to 9.0.36, and 10.0.0-M1 to 10.0.0-M6.\n - debian/patches/CVE-2020-13935.patch: validate the 64-bit payload\n length in processRemainingHeader() and reject frames with a\n negative value by throwing a WsIOException carrying a\n PROTOCOL_ERROR close reason; add the wsFrame.payloadMsbInvalid\n message to LocalStrings.properties. Also fold the companion fix\n 4c04982870 to apply the same validation to the legacy\n org/apache/catalina/websocket/WsFrame parser (still packaged in\n catalina.jar via WebSocketServlet), and the regression follow-up\n 34d19fbe24 in WsFrameBase.byteArrayToLong() (0xFF -> 0xFFL) that\n prevents silent corruption of payload lengths >= 4 bytes from\n int-shift promotion. Additionally fold b517002093 to apply the\n same 0xFF -> 0xFFL fix to the parallel helper\n Conversions.byteArrayToLong() in\n java/org/apache/catalina/util/Conversions.java, which is the\n helper used by the legacy WsFrame parser; without it the new\n < 0 check in the legacy parser would falsely reject legitimate\n large frames. Backport of upstream commits f9f75c14, 34d19fbe24,\n 4c04982870 and b517002093\n (https://github.com/apache/tomcat/commit/f9f75c14\n https://github.com/apache/tomcat/commit/34d19fbe24\n https://github.com/apache/tomcat/commit/4c04982870\n https://github.com/apache/tomcat/commit/b517002093)\n - CVE-2020-13935", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1777446601", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1777446601" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/ubuntu16.04els/advisories/2026/clsa-2026_1777446601.json" } ], "tracking": { "current_release_date": "2026-04-29T07:10:57Z", "generator": { "date": "2026-04-29T07:10:57Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1777446601", "initial_release_date": "2026-04-29T07:10:57Z", "revision_history": [ { "date": "2026-04-29T07:10:57Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix CVE(s): CVE-2020-13935" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Ubuntu 16.04", "product": { "name": "Ubuntu 16.04", "product_id": "Ubuntu-16", "product_identification_helper": { "cpe": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*" } } } ], "category": "product_family", "name": "Ubuntu" } ], "category": "vendor", "name": "Canonical Ltd." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product": { "name": "tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_id": "tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/tomcat7-user@7.0.68-1ubuntu0.4%2Btuxcare.els7?arch=all" } } }, { "category": "product_version", "name": "libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product": { "name": "libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_id": "libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libservlet3.0-java-doc@7.0.68-1ubuntu0.4%2Btuxcare.els7?arch=all" } } }, { "category": "product_version", "name": "libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product": { "name": "libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_id": "libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libtomcat7-java@7.0.68-1ubuntu0.4%2Btuxcare.els7?arch=all" } } }, { "category": "product_version", "name": "tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product": { "name": "tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_id": "tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/tomcat7-examples@7.0.68-1ubuntu0.4%2Btuxcare.els7?arch=all" } } }, { "category": "product_version", "name": "tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product": { "name": "tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_id": "tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/tomcat7@7.0.68-1ubuntu0.4%2Btuxcare.els7?arch=all" } } }, { "category": "product_version", "name": "tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product": { "name": "tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_id": "tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/tomcat7-admin@7.0.68-1ubuntu0.4%2Btuxcare.els7?arch=all" } } }, { "category": "product_version", "name": "tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product": { "name": "tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_id": "tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/tomcat7-docs@7.0.68-1ubuntu0.4%2Btuxcare.els7?arch=all" } } }, { "category": "product_version", "name": "libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product": { "name": "libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_id": "libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libservlet3.0-java@7.0.68-1ubuntu0.4%2Btuxcare.els7?arch=all" } } }, { "category": "product_version", "name": "tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product": { "name": "tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_id": "tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/tomcat7-common@7.0.68-1ubuntu0.4%2Btuxcare.els7?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all as a component of Ubuntu 16.04", "product_id": "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" }, "product_reference": "tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "relates_to_product_reference": "Ubuntu-16" }, { "category": "default_component_of", "full_product_name": { "name": "libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all as a component of Ubuntu 16.04", "product_id": "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" }, "product_reference": "libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "relates_to_product_reference": "Ubuntu-16" }, { "category": "default_component_of", "full_product_name": { "name": "libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all as a component of Ubuntu 16.04", "product_id": "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" }, "product_reference": "libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "relates_to_product_reference": "Ubuntu-16" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all as a component of Ubuntu 16.04", "product_id": "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" }, "product_reference": "tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "relates_to_product_reference": "Ubuntu-16" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all as a component of Ubuntu 16.04", "product_id": "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" }, "product_reference": "tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "relates_to_product_reference": "Ubuntu-16" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all as a component of Ubuntu 16.04", "product_id": "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" }, "product_reference": "tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "relates_to_product_reference": "Ubuntu-16" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all as a component of Ubuntu 16.04", "product_id": "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" }, "product_reference": "tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "relates_to_product_reference": "Ubuntu-16" }, { "category": "default_component_of", "full_product_name": { "name": "libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all as a component of Ubuntu 16.04", "product_id": "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" }, "product_reference": "libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "relates_to_product_reference": "Ubuntu-16" }, { "category": "default_component_of", "full_product_name": { "name": "tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all as a component of Ubuntu 16.04", "product_id": "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" }, "product_reference": "tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "relates_to_product_reference": "Ubuntu-16" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-17563", "cwe": { "id": "CWE-384", "name": "Session Fixation" }, "notes": [ { "category": "description", "text": "When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2019-17563" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/8b4c1db8300117b28a0f3f743c0b9e3f964687a690cdf9662a884bbd%40%3Cannounce.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/8b4c1db8300117b28a0f3f743c0b9e3f964687a690cdf9662a884bbd%40%3Cannounce.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/reb9a66f176df29b9a832caa95ebd9ffa3284e8f4922ec4fa3ad8eb2e%40%3Cissues.cxf.apache.org%3E", "url": "https://lists.apache.org/thread.html/reb9a66f176df29b9a832caa95ebd9ffa3284e8f4922ec4fa3ad8eb2e%40%3Cissues.cxf.apache.org%3E" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html", "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html", "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html" }, { "category": "external", "summary": "https://seclists.org/bugtraq/2019/Dec/43", "url": "https://seclists.org/bugtraq/2019/Dec/43" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202003-43", "url": "https://security.gentoo.org/glsa/202003-43" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20200107-0001/", "url": "https://security.netapp.com/advisory/ntap-20200107-0001/" }, { "category": "external", "summary": "https://usn.ubuntu.com/4251-1/", "url": "https://usn.ubuntu.com/4251-1/" }, { "category": "external", "summary": "https://www.debian.org/security/2019/dsa-4596", "url": "https://www.debian.org/security/2019/dsa-4596" }, { "category": "external", "summary": "https://www.debian.org/security/2020/dsa-4680", "url": "https://www.debian.org/security/2020/dsa-4680" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuapr2020.html", "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpujan2021.html", "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpujul2020.html", "url": "https://www.oracle.com/security-alerts/cpujul2020.html" } ], "release_date": "2019-12-23T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-29T07:10:03.695289Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1777446601", "product_ids": [ "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1777446601" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2018-1336", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "notes": [ { "category": "description", "text": "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2018-1336" }, { "category": "external", "summary": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722090435.GA60759%40minotaur.apache.org%3E", "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722090435.GA60759%40minotaur.apache.org%3E" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/104898", "url": "http://www.securityfocus.com/bid/104898" }, { "category": "external", "summary": "http://www.securitytracker.com/id/1041375", "url": "http://www.securitytracker.com/id/1041375" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHEA-2018:2188", "url": "https://access.redhat.com/errata/RHEA-2018:2188" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHEA-2018:2189", "url": "https://access.redhat.com/errata/RHEA-2018:2189" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:2700", "url": "https://access.redhat.com/errata/RHSA-2018:2700" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:2701", "url": "https://access.redhat.com/errata/RHSA-2018:2701" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:2740", "url": "https://access.redhat.com/errata/RHSA-2018:2740" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:2741", "url": "https://access.redhat.com/errata/RHSA-2018:2741" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:2742", "url": "https://access.redhat.com/errata/RHSA-2018:2742" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:2743", "url": "https://access.redhat.com/errata/RHSA-2018:2743" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:2921", "url": "https://access.redhat.com/errata/RHSA-2018:2921" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:2930", "url": "https://access.redhat.com/errata/RHSA-2018:2930" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:2939", "url": "https://access.redhat.com/errata/RHSA-2018:2939" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:2945", "url": "https://access.redhat.com/errata/RHSA-2018:2945" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2018:3768", "url": "https://access.redhat.com/errata/RHSA-2018:3768" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20180817-0001/", "url": "https://security.netapp.com/advisory/ntap-20180817-0001/" }, { "category": "external", "summary": "https://support.f5.com/csp/article/K73008537?utm_source=f5support&%3Butm_medium=RSS", "url": "https://support.f5.com/csp/article/K73008537?utm_source=f5support&%3Butm_medium=RSS" }, { "category": "external", "summary": "https://usn.ubuntu.com/3723-1/", "url": "https://usn.ubuntu.com/3723-1/" }, { "category": "external", "summary": "https://www.debian.org/security/2018/dsa-4281", "url": "https://www.debian.org/security/2018/dsa-4281" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuapr2020.html", "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" } ], "release_date": "2018-08-02T14:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-29T07:10:03.695289Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1777446601", "product_ids": [ "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1777446601" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2020-13935", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "notes": [ { "category": "description", "text": "The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2020-13935" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html" }, { "category": "external", "summary": "https://kc.mcafee.com/corporate/index?page=content&id=SB10332", "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10332" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50%40%3Cusers.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50%40%3Cusers.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html", "url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20200724-0003/", "url": "https://security.netapp.com/advisory/ntap-20200724-0003/" }, { "category": "external", "summary": "https://usn.ubuntu.com/4448-1/", "url": "https://usn.ubuntu.com/4448-1/" }, { "category": "external", "summary": "https://usn.ubuntu.com/4596-1/", "url": "https://usn.ubuntu.com/4596-1/" }, { "category": "external", "summary": "https://www.debian.org/security/2020/dsa-4727", "url": "https://www.debian.org/security/2020/dsa-4727" }, { "category": "external", "summary": "https://www.oracle.com//security-alerts/cpujul2021.html", "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuApr2021.html", "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuapr2022.html", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpujan2021.html", "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpujan2022.html", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuoct2020.html", "url": "https://www.oracle.com/security-alerts/cpuoct2020.html" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuoct2021.html", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" } ], "release_date": "2020-07-14T15:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-29T07:10:03.695289Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1777446601", "product_ids": [ "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1777446601" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2018-8034", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "description", "text": "The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2018-8034" }, { "category": "external", "summary": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722091057.GA70283%40minotaur.apache.org%3E", "url": "http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722091057.GA70283%40minotaur.apache.org%3E" }, { "category": "external", "summary": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/104895", "url": "http://www.securityfocus.com/bid/104895" }, { "category": "external", "summary": "http://www.securitytracker.com/id/1041374", "url": "http://www.securitytracker.com/id/1041374" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:0130", "url": "https://access.redhat.com/errata/RHSA-2019:0130" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:0131", "url": "https://access.redhat.com/errata/RHSA-2019:0131" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:0450", "url": "https://access.redhat.com/errata/RHSA-2019:0450" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:0451", "url": "https://access.redhat.com/errata/RHSA-2019:0451" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1159", "url": "https://access.redhat.com/errata/RHSA-2019:1159" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1160", "url": "https://access.redhat.com/errata/RHSA-2019:1160" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1161", "url": "https://access.redhat.com/errata/RHSA-2019:1161" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1162", "url": "https://access.redhat.com/errata/RHSA-2019:1162" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1529", "url": "https://access.redhat.com/errata/RHSA-2019:1529" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2205", "url": "https://access.redhat.com/errata/RHSA-2019:2205" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:3892", "url": "https://access.redhat.com/errata/RHSA-2019:3892" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E", "url": "https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E", "url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/07/msg00047.html", "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00047.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00001.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20180817-0001/", "url": "https://security.netapp.com/advisory/ntap-20180817-0001/" }, { "category": "external", "summary": "https://usn.ubuntu.com/3723-1/", "url": "https://usn.ubuntu.com/3723-1/" }, { "category": "external", "summary": "https://www.debian.org/security/2018/dsa-4281", "url": "https://www.debian.org/security/2018/dsa-4281" }, { "category": "external", "summary": "https://www.oracle.com/security-alerts/cpuapr2020.html", "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "category": "external", "summary": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html", "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html" }, { "category": "external", "summary": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" }, { "category": "external", "summary": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" } ], "release_date": "2018-08-01T18:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-29T07:10:03.695289Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1777446601", "product_ids": [ "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1777446601" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "Ubuntu-16:libservlet3.0-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libservlet3.0-java-doc-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:libtomcat7-java-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-admin-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-common-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-docs-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-examples-0:7.0.68-1ubuntu0.4+tuxcare.els7.all", "Ubuntu-16:tomcat7-user-0:7.0.68-1ubuntu0.4+tuxcare.els7.all" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }