tomcat10-10.1.14-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:13441-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z tomcat10-10.1.14-1.1 on GA media These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-13441 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2013-1976/ SUSE CVE CVE-2013-1976 page https://www.suse.com/security/cve/CVE-2014-0050/ SUSE CVE CVE-2014-0050 page https://www.suse.com/security/cve/CVE-2015-5174/ SUSE CVE CVE-2015-5174 page https://www.suse.com/security/cve/CVE-2015-5345/ SUSE CVE CVE-2015-5345 page https://www.suse.com/security/cve/CVE-2015-5346/ SUSE CVE CVE-2015-5346 page https://www.suse.com/security/cve/CVE-2015-5351/ SUSE CVE CVE-2015-5351 page https://www.suse.com/security/cve/CVE-2016-0706/ SUSE CVE CVE-2016-0706 page https://www.suse.com/security/cve/CVE-2016-0714/ SUSE CVE CVE-2016-0714 page https://www.suse.com/security/cve/CVE-2016-0763/ SUSE CVE CVE-2016-0763 page https://www.suse.com/security/cve/CVE-2016-3092/ SUSE CVE CVE-2016-3092 page https://www.suse.com/security/cve/CVE-2016-8745/ SUSE CVE CVE-2016-8745 page https://www.suse.com/security/cve/CVE-2017-12617/ SUSE CVE CVE-2017-12617 page https://www.suse.com/security/cve/CVE-2017-5647/ SUSE CVE CVE-2017-5647 page https://www.suse.com/security/cve/CVE-2017-5648/ SUSE CVE CVE-2017-5648 page https://www.suse.com/security/cve/CVE-2017-5664/ SUSE CVE CVE-2017-5664 page https://www.suse.com/security/cve/CVE-2018-11784/ SUSE CVE CVE-2018-11784 page https://www.suse.com/security/cve/CVE-2018-1336/ SUSE CVE CVE-2018-1336 page https://www.suse.com/security/cve/CVE-2018-8014/ SUSE CVE CVE-2018-8014 page https://www.suse.com/security/cve/CVE-2018-8034/ SUSE CVE CVE-2018-8034 page https://www.suse.com/security/cve/CVE-2018-8037/ SUSE CVE CVE-2018-8037 page https://www.suse.com/security/cve/CVE-2019-0199/ SUSE CVE CVE-2019-0199 page https://www.suse.com/security/cve/CVE-2019-0221/ SUSE CVE CVE-2019-0221 page https://www.suse.com/security/cve/CVE-2019-10072/ SUSE CVE CVE-2019-10072 page https://www.suse.com/security/cve/CVE-2019-12418/ SUSE CVE CVE-2019-12418 page https://www.suse.com/security/cve/CVE-2019-17563/ SUSE CVE CVE-2019-17563 page https://www.suse.com/security/cve/CVE-2019-17569/ SUSE CVE CVE-2019-17569 page https://www.suse.com/security/cve/CVE-2020-11996/ SUSE CVE CVE-2020-11996 page https://www.suse.com/security/cve/CVE-2020-13934/ SUSE CVE CVE-2020-13934 page https://www.suse.com/security/cve/CVE-2020-13935/ SUSE CVE CVE-2020-13935 page https://www.suse.com/security/cve/CVE-2020-13943/ SUSE CVE CVE-2020-13943 page https://www.suse.com/security/cve/CVE-2020-17527/ SUSE CVE CVE-2020-17527 page https://www.suse.com/security/cve/CVE-2020-1935/ SUSE CVE CVE-2020-1935 page https://www.suse.com/security/cve/CVE-2020-1938/ SUSE CVE CVE-2020-1938 page https://www.suse.com/security/cve/CVE-2020-9484/ SUSE CVE CVE-2020-9484 page https://www.suse.com/security/cve/CVE-2021-24122/ SUSE CVE CVE-2021-24122 page https://www.suse.com/security/cve/CVE-2021-25122/ SUSE CVE CVE-2021-25122 page https://www.suse.com/security/cve/CVE-2021-25329/ SUSE CVE CVE-2021-25329 page https://www.suse.com/security/cve/CVE-2021-30640/ SUSE CVE CVE-2021-30640 page https://www.suse.com/security/cve/CVE-2021-33037/ SUSE CVE CVE-2021-33037 page https://www.suse.com/security/cve/CVE-2021-41079/ SUSE CVE CVE-2021-41079 page https://www.suse.com/security/cve/CVE-2021-43980/ SUSE CVE CVE-2021-43980 page https://www.suse.com/security/cve/CVE-2022-23181/ SUSE CVE CVE-2022-23181 page https://www.suse.com/security/cve/CVE-2022-42252/ SUSE CVE CVE-2022-42252 page https://www.suse.com/security/cve/CVE-2022-45143/ SUSE CVE CVE-2022-45143 page https://www.suse.com/security/cve/CVE-2023-24998/ SUSE CVE CVE-2023-24998 page https://www.suse.com/security/cve/CVE-2023-28708/ SUSE CVE CVE-2023-28708 page https://www.suse.com/security/cve/CVE-2023-28709/ SUSE CVE CVE-2023-28709 page https://www.suse.com/security/cve/CVE-2023-41080/ SUSE CVE CVE-2023-41080 page https://www.suse.com/security/cve/CVE-2023-44487/ SUSE CVE CVE-2023-44487 page openSUSE Tumbleweed tomcat10-10.1.14-1.1 tomcat10-admin-webapps-10.1.14-1.1 tomcat10-doc-10.1.14-1.1 tomcat10-docs-webapp-10.1.14-1.1 tomcat10-el-5_0-api-10.1.14-1.1 tomcat10-embed-10.1.14-1.1 tomcat10-jsp-3_1-api-10.1.14-1.1 tomcat10-jsvc-10.1.14-1.1 tomcat10-lib-10.1.14-1.1 tomcat10-servlet-6_0-api-10.1.14-1.1 tomcat10-webapps-10.1.14-1.1 tomcat10-10.1.14-1.1 as a component of openSUSE Tumbleweed tomcat10-admin-webapps-10.1.14-1.1 as a component of openSUSE Tumbleweed tomcat10-doc-10.1.14-1.1 as a component of openSUSE Tumbleweed tomcat10-docs-webapp-10.1.14-1.1 as a component of openSUSE Tumbleweed tomcat10-el-5_0-api-10.1.14-1.1 as a component of openSUSE Tumbleweed tomcat10-embed-10.1.14-1.1 as a component of openSUSE Tumbleweed tomcat10-jsp-3_1-api-10.1.14-1.1 as a component of openSUSE Tumbleweed tomcat10-jsvc-10.1.14-1.1 as a component of openSUSE Tumbleweed tomcat10-lib-10.1.14-1.1 as a component of openSUSE Tumbleweed tomcat10-servlet-6_0-api-10.1.14-1.1 as a component of openSUSE Tumbleweed tomcat10-webapps-10.1.14-1.1 as a component of openSUSE Tumbleweed The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a symlink attack on (a) tomcat5-initd.log, (b) tomcat6-initd.log, (c) catalina.out, or (d) tomcat7-initd.log. CVE-2013-1976 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2013-1976.html CVE-2013-1976 https://bugzilla.suse.com/822177 SUSE Bug 822177 MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions. CVE-2014-0050 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2014-0050.html CVE-2014-0050 https://bugzilla.suse.com/862781 SUSE Bug 862781 Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. CVE-2015-5174 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 4.3 AV:A/AC:M/Au:N/C:P/I:P/A:N 4 AV:N/AC:L/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2015-5174.html CVE-2015-5174 https://bugzilla.suse.com/967967 SUSE Bug 967967 The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. CVE-2015-5345 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2015-5345.html CVE-2015-5345 https://bugzilla.suse.com/967965 SUSE Bug 967965 Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java. CVE-2015-5346 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 5.4 AV:A/AC:M/Au:N/C:P/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2015-5346.html CVE-2015-5346 https://bugzilla.suse.com/967814 SUSE Bug 967814 The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token. CVE-2015-5351 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 5.4 AV:A/AC:M/Au:N/C:P/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2015-5351.html CVE-2015-5351 https://bugzilla.suse.com/967812 SUSE Bug 967812 Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. CVE-2016-0706 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 low 4 AV:N/AC:L/Au:S/C:P/I:N/A:N 4 AV:N/AC:L/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-0706.html CVE-2016-0706 https://bugzilla.suse.com/967815 SUSE Bug 967815 https://bugzilla.suse.com/971085 SUSE Bug 971085 https://bugzilla.suse.com/988489 SUSE Bug 988489 The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. CVE-2016-0714 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-0714.html CVE-2016-0714 https://bugzilla.suse.com/967964 SUSE Bug 967964 https://bugzilla.suse.com/971085 SUSE Bug 971085 The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context. CVE-2016-0763 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-0763.html CVE-2016-0763 https://bugzilla.suse.com/967966 SUSE Bug 967966 https://bugzilla.suse.com/971085 SUSE Bug 971085 The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string. CVE-2016-3092 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-3092.html CVE-2016-3092 https://bugzilla.suse.com/1068865 SUSE Bug 1068865 https://bugzilla.suse.com/986359 SUSE Bug 986359 https://bugzilla.suse.com/988489 SUSE Bug 988489 A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions. CVE-2016-8745 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 low 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-8745.html CVE-2016-8745 https://bugzilla.suse.com/1015119 SUSE Bug 1015119 When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. CVE-2017-12617 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12617.html CVE-2017-12617 https://bugzilla.suse.com/1059554 SUSE Bug 1059554 https://bugzilla.suse.com/1062607 SUSE Bug 1062607 https://bugzilla.suse.com/1180947 SUSE Bug 1180947 https://bugzilla.suse.com/1189861 SUSE Bug 1189861 A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C. CVE-2017-5647 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-5647.html CVE-2017-5647 https://bugzilla.suse.com/1033448 SUSE Bug 1033448 While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application. CVE-2017-5648 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 low 1.5 AV:L/AC:M/Au:S/C:P/I:N/A:N 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-5648.html CVE-2017-5648 https://bugzilla.suse.com/1033447 SUSE Bug 1033447 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method. CVE-2017-5664 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 5 AV:N/AC:L/Au:N/C:N/I:P/A:N 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-5664.html CVE-2017-5664 https://bugzilla.suse.com/1042910 SUSE Bug 1042910 When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. CVE-2018-11784 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-11784.html CVE-2018-11784 https://bugzilla.suse.com/1110850 SUSE Bug 1110850 https://bugzilla.suse.com/1122212 SUSE Bug 1122212 An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86. CVE-2018-1336 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1336.html CVE-2018-1336 https://bugzilla.suse.com/1102400 SUSE Bug 1102400 The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. CVE-2018-8014 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 low 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-8014.html CVE-2018-8014 https://bugzilla.suse.com/1093697 SUSE Bug 1093697 The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88. CVE-2018-8034 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-8034.html CVE-2018-8034 https://bugzilla.suse.com/1102379 SUSE Bug 1102379 If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31. CVE-2018-8037 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 critical 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-8037.html CVE-2018-8037 https://bugzilla.suse.com/1003579 SUSE Bug 1003579 https://bugzilla.suse.com/1102410 SUSE Bug 1102410 The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. CVE-2019-0199 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-0199.html CVE-2019-0199 https://bugzilla.suse.com/1131055 SUSE Bug 1131055 https://bugzilla.suse.com/1139924 SUSE Bug 1139924 The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website. CVE-2019-0221 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 low 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-0221.html CVE-2019-0221 https://bugzilla.suse.com/1136085 SUSE Bug 1136085 The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. CVE-2019-10072 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-10072.html CVE-2019-10072 https://bugzilla.suse.com/1139924 SUSE Bug 1139924 https://bugzilla.suse.com/1154162 SUSE Bug 1154162 When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance. CVE-2019-12418 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-12418.html CVE-2019-12418 https://bugzilla.suse.com/1159723 SUSE Bug 1159723 When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability. CVE-2019-17563 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 low 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-17563.html CVE-2019-17563 https://bugzilla.suse.com/1159729 SUSE Bug 1159729 The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. CVE-2019-17569 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-17569.html CVE-2019-17569 https://bugzilla.suse.com/1164825 SUSE Bug 1164825 https://bugzilla.suse.com/1165858 SUSE Bug 1165858 A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. CVE-2020-11996 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-11996.html CVE-2020-11996 https://bugzilla.suse.com/1173389 SUSE Bug 1173389 https://bugzilla.suse.com/1201081 SUSE Bug 1201081 An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service. CVE-2020-13934 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-13934.html CVE-2020-13934 https://bugzilla.suse.com/1174121 SUSE Bug 1174121 The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. CVE-2020-13935 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-13935.html CVE-2020-13935 https://bugzilla.suse.com/1174117 SUSE Bug 1174117 If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. CVE-2020-13943 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 4 AV:N/AC:L/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-13943.html CVE-2020-13943 https://bugzilla.suse.com/1177582 SUSE Bug 1177582 While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests. CVE-2020-17527 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-17527.html CVE-2020-17527 https://bugzilla.suse.com/1179602 SUSE Bug 1179602 https://bugzilla.suse.com/1180830 SUSE Bug 1180830 In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. CVE-2020-1935 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-1935.html CVE-2020-1935 https://bugzilla.suse.com/1164860 SUSE Bug 1164860 When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations. CVE-2020-1938 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-1938.html CVE-2020-1938 https://bugzilla.suse.com/1164692 SUSE Bug 1164692 https://bugzilla.suse.com/1166559 SUSE Bug 1166559 https://bugzilla.suse.com/1169066 SUSE Bug 1169066 https://bugzilla.suse.com/1175170 SUSE Bug 1175170 When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed. CVE-2020-9484 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-9484.html CVE-2020-9484 https://bugzilla.suse.com/1171928 SUSE Bug 1171928 https://bugzilla.suse.com/1182909 SUSE Bug 1182909 https://bugzilla.suse.com/1195255 SUSE Bug 1195255 https://bugzilla.suse.com/1196395 SUSE Bug 1196395 https://bugzilla.suse.com/1201081 SUSE Bug 1201081 When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances. CVE-2021-24122 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-24122.html CVE-2021-24122 https://bugzilla.suse.com/1180947 SUSE Bug 1180947 When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request. CVE-2021-25122 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-25122.html CVE-2021-25122 https://bugzilla.suse.com/1182912 SUSE Bug 1182912 https://bugzilla.suse.com/1188549 SUSE Bug 1188549 The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue. CVE-2021-25329 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-25329.html CVE-2021-25329 https://bugzilla.suse.com/1182909 SUSE Bug 1182909 https://bugzilla.suse.com/1200696 SUSE Bug 1200696 A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65. CVE-2021-30640 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-30640.html CVE-2021-30640 https://bugzilla.suse.com/1188279 SUSE Bug 1188279 https://bugzilla.suse.com/1200696 SUSE Bug 1200696 Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding. CVE-2021-33037 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-33037.html CVE-2021-33037 https://bugzilla.suse.com/1188278 SUSE Bug 1188278 https://bugzilla.suse.com/1200696 SUSE Bug 1200696 Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service. CVE-2021-41079 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-41079.html CVE-2021-41079 https://bugzilla.suse.com/1190558 SUSE Bug 1190558 The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client. CVE-2021-43980 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43980.html CVE-2021-43980 https://bugzilla.suse.com/1203868 SUSE Bug 1203868 The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore. CVE-2022-23181 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-23181.html CVE-2022-23181 https://bugzilla.suse.com/1195255 SUSE Bug 1195255 https://bugzilla.suse.com/1196395 SUSE Bug 1196395 https://bugzilla.suse.com/1200696 SUSE Bug 1200696 If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header. CVE-2022-42252 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-42252.html CVE-2022-42252 https://bugzilla.suse.com/1204918 SUSE Bug 1204918 https://bugzilla.suse.com/1220503 SUSE Bug 1220503 The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output. CVE-2022-45143 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-45143.html CVE-2022-45143 https://bugzilla.suse.com/1206840 SUSE Bug 1206840 Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. CVE-2023-24998 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-24998.html CVE-2023-24998 https://bugzilla.suse.com/1208513 SUSE Bug 1208513 https://bugzilla.suse.com/1210310 SUSE Bug 1210310 https://bugzilla.suse.com/1211608 SUSE Bug 1211608 https://bugzilla.suse.com/1228313 SUSE Bug 1228313 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. CVE-2023-28708 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-28708.html CVE-2023-28708 https://bugzilla.suse.com/1209622 SUSE Bug 1209622 The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur. CVE-2023-28709 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-28709.html CVE-2023-28709 https://bugzilla.suse.com/1211608 SUSE Bug 1211608 https://bugzilla.suse.com/1228313 SUSE Bug 1228313 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. The vulnerability is limited to the ROOT (default) web application. CVE-2023-41080 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-41080.html CVE-2023-41080 https://bugzilla.suse.com/1214666 SUSE Bug 1214666 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-44487 openSUSE Tumbleweed:tomcat10-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-admin-webapps-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-doc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-docs-webapp-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-el-5_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-embed-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsp-3_1-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-jsvc-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-lib-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-servlet-6_0-api-10.1.14-1.1 openSUSE Tumbleweed:tomcat10-webapps-10.1.14-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-44487.html CVE-2023-44487 https://bugzilla.suse.com/1216109 SUSE Bug 1216109 https://bugzilla.suse.com/1216123 SUSE Bug 1216123 https://bugzilla.suse.com/1216169 SUSE Bug 1216169 https://bugzilla.suse.com/1216171 SUSE Bug 1216171 https://bugzilla.suse.com/1216174 SUSE Bug 1216174 https://bugzilla.suse.com/1216176 SUSE Bug 1216176 https://bugzilla.suse.com/1216181 SUSE Bug 1216181 https://bugzilla.suse.com/1216182 SUSE Bug 1216182 https://bugzilla.suse.com/1216190 SUSE Bug 1216190