{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Tomcat versions 11.0.x ant\u00e9rieures \u00e0 11.0.10",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 10.1.x ant\u00e9rieures \u00e0 10.1.44",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 9.0.x ant\u00e9rieures \u00e0 9.0.108",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-48989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48989"
    }
  ],
  "initial_release_date": "2025-08-14T00:00:00",
  "last_revision_date": "2025-08-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0694",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-08-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": "2025-08-07",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_10.1.44",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.44"
    },
    {
      "published_at": "2025-08-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_9.0.108",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.108"
    },
    {
      "published_at": "2025-08-06",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_11.0.10",
      "url": "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.10"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Tomcat versions 11.0.x ant\u00e9rieures \u00e0 11.0.9",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 9.0.x ant\u00e9rieures \u00e0 9.0.107",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 10.1.x ant\u00e9rieures \u00e0 10.1.43",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-52520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520"
    },
    {
      "name": "CVE-2025-52434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434"
    },
    {
      "name": "CVE-2025-53506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506"
    }
  ],
  "initial_release_date": "2025-07-11T00:00:00",
  "last_revision_date": "2025-07-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0584",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-07-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Tomcat. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": "2025-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_10.1.43",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.43"
    },
    {
      "published_at": "2025-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_11.0.9",
      "url": "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.9"
    },
    {
      "published_at": "2025-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_9.0.107",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.107"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Tomcat versions 10.1.x ant\u00e9rieures \u00e0 10.1.42",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 9.0.x ant\u00e9rieures \u00e0 9.0.106",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 11.0.x ant\u00e9rieures \u00e0 11.0.8",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-49125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-49125"
    },
    {
      "name": "CVE-2025-48976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976"
    },
    {
      "name": "CVE-2025-48988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48988"
    },
    {
      "name": "CVE-2025-49124",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-49124"
    }
  ],
  "initial_release_date": "2025-06-17T00:00:00",
  "last_revision_date": "2025-06-17T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0516",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-06-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Tomcat. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": "2025-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_10.1.42",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.42"
    },
    {
      "published_at": "2025-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_9.0.106",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.106"
    },
    {
      "published_at": "2025-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_11.0.8",
      "url": "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.8"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Tomcat versions 10.1.x ant\u00e9rieures \u00e0 10.1.41",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 9.0.x ant\u00e9rieures \u00e0 9.0.105",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 11.0.x ant\u00e9rieures \u00e0 11.0.7",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-46701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-46701"
    }
  ],
  "initial_release_date": "2025-05-30T00:00:00",
  "last_revision_date": "2025-05-30T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0461",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-05-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": "2025-05-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_11.0.7",
      "url": "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.7"
    },
    {
      "published_at": "2025-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_9.0.105",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.105"
    },
    {
      "published_at": "2025-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_10.1.41",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.41"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Tomcat versions 10.1.x ant\u00e9rieures \u00e0 10.1.40",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 11.0.x ant\u00e9rieures \u00e0 11.0.6",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 9.0.x ant\u00e9rieures \u00e0 9.0.104",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-31651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31651"
    },
    {
      "name": "CVE-2025-31650",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-31650"
    }
  ],
  "initial_release_date": "2025-04-29T00:00:00",
  "last_revision_date": "2025-04-29T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0352",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-04-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Tomcat. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": "2025-04-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_9.0.104",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.104"
    },
    {
      "published_at": "2025-04-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_10.1.40",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.40"
    },
    {
      "published_at": "2025-04-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_11.0.6",
      "url": "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.6"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Tomcat versions 9.0.x ant\u00e9rieures \u00e0 9.0.99",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 11.0.x ant\u00e9rieures \u00e0 11.0.3",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 10.1.x ant\u00e9rieures \u00e0 10.1.35",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-24813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-24813"
    }
  ],
  "initial_release_date": "2025-03-12T00:00:00",
  "last_revision_date": "2025-03-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0200",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-03-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": "2025-02-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_11.0.3",
      "url": "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.3"
    },
    {
      "published_at": "2025-02-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_9.0.99",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.99"
    },
    {
      "published_at": "2025-02-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_10.1.35",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.35"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Tomcat versions 10.1.x ant\u00e9rieures \u00e0 10.1.34",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 11.0.x ant\u00e9rieures \u00e0 11.0.2",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 9.0.x ant\u00e9rieures \u00e0 9.0.98",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-54677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-54677"
    },
    {
      "name": "CVE-2024-56337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-56337"
    },
    {
      "name": "CVE-2024-50379",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-50379"
    }
  ],
  "initial_release_date": "2024-12-18T00:00:00",
  "last_revision_date": "2024-12-24T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-1091",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-12-18T00:00:00.000000"
    },
    {
      "description": "Ajout de la version vuln\u00e9rable 11.0.2",
      "revision_date": "2024-12-20T00:00:00.000000"
    },
    {
      "description": "Ajout de la vuln\u00e9rabilit\u00e9 CVE-2024-56337",
      "revision_date": "2024-12-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Tomcat. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": "2024-12-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_10.1.34",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.34"
    },
    {
      "published_at": "2024-12-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_9.0.98",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.98"
    },
    {
      "published_at": "2024-12-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Apache_Tomcat_11.0.2",
      "url": "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.2"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Tomcat versions 10.x ant\u00e9rieures \u00e0 10.1.33",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 9.x ant\u00e9rieures \u00e0 9.0.97",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-52318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-52318"
    },
    {
      "name": "CVE-2024-52317",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-52317"
    },
    {
      "name": "CVE-2024-52316",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-52316"
    }
  ],
  "initial_release_date": "2024-11-18T00:00:00",
  "last_revision_date": "2024-11-18T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-1000",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-11-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apache. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Tomcat Apache_Tomcat_9.0.96",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.96"
    },
    {
      "published_at": "2024-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Apache_Tomcat_10.1.33",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.33"
    },
    {
      "published_at": "2024-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Apache_Tomcat_10.1.31",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.31"
    },
    {
      "published_at": "2024-11-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Tomcat Apache_Tomcat_9.0.97",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.97"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 10.x ant\u00e9rieures \u00e0 10.1.25",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 9.0.x ant\u00e9rieures \u00e0 9.0.90",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-34750",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34750"
    }
  ],
  "initial_release_date": "2024-07-04T00:00:00",
  "last_revision_date": "2024-07-04T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0543",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-07-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": "2024-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_10.1.25",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.25"
    },
    {
      "published_at": "2024-07-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat Apache_Tomcat_9.0.90",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.90"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 8.x.x ant\u00e9rieures \u00e0 8.5.99",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 10.x.x ant\u00e9rieures \u00e0 10.1.19",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 9.x.x ant\u00e9rieures \u00e0 9.0.86",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-23672",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-23672"
    },
    {
      "name": "CVE-2024-24549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24549"
    }
  ],
  "initial_release_date": "2024-03-14T00:00:00",
  "last_revision_date": "2024-03-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0218",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-03-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Tomcat.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0\ndistance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 9 du 14 mars 2024",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.86"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 10 du 14 mars 2024",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.19"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 8 du 14 mars 2024",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.99"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Tomcat versions 8.x ant\u00e9rieures \u00e0 8.5.96",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 10.x ant\u00e9rieures \u00e0 10.1.16",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Tomcat versions 9.x ant\u00e9rieures \u00e0 9.0.83",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-46589",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46589"
    }
  ],
  "initial_release_date": "2023-11-29T00:00:00",
  "last_revision_date": "2023-11-29T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0982",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-11-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 9 du 28 novembre 2023",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.83"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 8 du 28 novembre 2023",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.96"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 10 du 28 novembre 2023",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.16"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 9.x.x ant\u00e9rieures \u00e0 9.0.81",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 10.x.x ant\u00e9rieures \u00e0 10.1.14",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 8.x.x ant\u00e9rieures \u00e0 8.5.94",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2023-42795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42795"
    },
    {
      "name": "CVE-2023-45648",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45648"
    },
    {
      "name": "CVE-2023-42794",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42794"
    }
  ],
  "initial_release_date": "2023-10-12T00:00:00",
  "last_revision_date": "2023-10-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0832",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-10-12T00:00:00.000000"
    },
    {
      "description": "Ajout des versions 10.x.x dans les syst\u00e8mes affect\u00e9s",
      "revision_date": "2023-10-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Apache Tomcat\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9, une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service \u00e0\ndistance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 10.1.14 du 10 octobre 2023",
      "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 8.5.94 du 10 octobre 2023",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 9.0.81 du 10 octobre 2023",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 8.x ant\u00e9rieures \u00e0 8.5.93",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 9.x ant\u00e9rieures \u00e0 9.0.80",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-41080",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41080"
    }
  ],
  "initial_release_date": "2023-08-28T00:00:00",
  "last_revision_date": "2023-08-28T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0691",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-08-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache security-8 du 25 ao\u00fbt 2023",
      "url": "https://tomcat.apache.org/security-8.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache security-9 du 25 ao\u00fbt 2023",
      "url": "https://tomcat.apache.org/security-9.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat version 9.0.74",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat version 8.5.88",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-34981",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34981"
    }
  ],
  "initial_release_date": "2023-06-21T00:00:00",
  "last_revision_date": "2023-06-21T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Apache\u00a09.0.75 du 21 juin 2023",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.75"
    }
  ],
  "reference": "CERTFR-2023-AVI-0478",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-06-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 8.5.89 du 21 juin 2023",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.89"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 9.0.75 du 21 juin 2023",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 8.5.85 \u00e0 8.5.87 ant\u00e9rieures \u00e0 9.0.88",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 9.0.71 \u00e0 9.0.73 ant\u00e9rieures \u00e0 9.0.74",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-28709",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28709"
    }
  ],
  "initial_release_date": "2023-05-22T00:00:00",
  "last_revision_date": "2023-05-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0404",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-05-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 9.0.74 du 18 avril 2023",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.74"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 8.5.88 du 19 avril 2023",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.88"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 8.5.x ant\u00e9rieures \u00e0 8.5.86",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 9.0.x ant\u00e9rieures \u00e0 9.0.72",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-28708",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28708"
    }
  ],
  "initial_release_date": "2023-03-22T00:00:00",
  "last_revision_date": "2023-03-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0253",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-03-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 8.5.86 du 23 mars 2023",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.86"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 9.0.72 du 23 mars 2023",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.72"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 8.5.x ant\u00e9rieures \u00e0 8.5.85",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 9.0.x ant\u00e9rieures \u00e0 9.0.71",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-24998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-24998"
    }
  ],
  "initial_release_date": "2023-02-21T00:00:00",
  "last_revision_date": "2023-02-21T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0150",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-02-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 9.0.71 du 19 f\u00e9vrier 2023",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.71"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 8.5.85 du 19 f\u00e9vrier 2023",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.85"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 9.x ant\u00e9rieures \u00e0 9.0.69",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 8.x ant\u00e9rieures \u00e0 8.5.84",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-45143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45143"
    }
  ],
  "initial_release_date": "2023-01-04T00:00:00",
  "last_revision_date": "2023-01-04T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Apache\u00a08.5.84 du 21 novembre 2022",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.84"
    }
  ],
  "reference": "CERTFR-2023-AVI-0001",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-01-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par\nl\u0027\u00e9diteur.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 9.0.69 du 14 novembre 2022",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.69"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 8.5.84 du 21 novembre 2022",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 9.x ant\u00e9rieures \u00e0 9.0.68",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 8.x ant\u00e9rieures \u00e0 8.5.83",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-42252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42252"
    }
  ],
  "initial_release_date": "2022-11-02T00:00:00",
  "last_revision_date": "2022-11-02T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-975",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-11-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 9.0.68 du 31 octobre 2022",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.68"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 8.5.83 du 31 octobre 2022",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.83"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 8.5.50 \u00e0 8.5.81 ant\u00e9rieures \u00e0 8.5.82",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 9.0.30 \u00e0 9.0.64 ant\u00e9rieures \u00e0 9.0.65",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-34305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34305"
    }
  ],
  "initial_release_date": "2022-06-23T00:00:00",
  "last_revision_date": "2022-06-23T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-579",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-06-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 8.5.82 du 22 juin 2022",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.82"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 9.0.65 du 22 juin 2022",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.65"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 9.0.x ant\u00e9rieures \u00e0 9.0.63",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 8.5.x ant\u00e9rieures \u00e0 8.5.79",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-29885",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-29885"
    }
  ],
  "initial_release_date": "2022-05-11T00:00:00",
  "last_revision_date": "2022-05-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-443",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-05-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 8.5.79 du 10 mai 2022",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.79"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 9.0.63 du 10 mai 2022",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.63"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 8.x ant\u00e9rieures \u00e0 8.5.75",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 9.x ant\u00e9rieures \u00e0 9.0.58",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-23181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23181"
    },
    {
      "name": "CVE-2020-9484",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-9484"
    }
  ],
  "initial_release_date": "2022-01-26T00:00:00",
  "last_revision_date": "2022-01-26T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-082",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-01-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Tomcat.\nElles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges\net une ex\u00e9cution de code arbitraire.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 8.5.75 du 20 janvier 2022",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.75"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 9.0.58 du 20 janvier 2022",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.58"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 8.x ant\u00e9rieures \u00e0 8.5.63",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 7.x ant\u00e9rieures \u00e0 7.0.108",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 9.x ant\u00e9rieures \u00e0 9.0.43",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-25329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-25329"
    },
    {
      "name": "CVE-2021-25122",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-25122"
    }
  ],
  "initial_release_date": "2021-03-04T00:00:00",
  "last_revision_date": "2021-03-04T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-164",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-03-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Tomcat.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 7 du 01 mars 2021",
      "url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.108"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 9 du 01 mars 2021",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 8 du 01 mars 2021",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat 8.x versions ant\u00e9rieures \u00e0 8.5.60",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat 9.x versions ant\u00e9rieures \u00e0 9.0.40",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-17527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-17527"
    }
  ],
  "initial_release_date": "2020-12-07T00:00:00",
  "last_revision_date": "2020-12-07T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-792",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-12-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 8 du 03 d\u00e9cembre 2020",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat 9 du 03 d\u00e9cembre 2020",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat 8.5.x versions ant\u00e9rieures \u00e0 8.5.56",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat 7.x versions ant\u00e9rieures \u00e0 7.0.104",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat 9.x versions ant\u00e9rieures \u00e0 9.0.36",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-13934",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-13934"
    },
    {
      "name": "CVE-2020-13935",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-13935"
    }
  ],
  "initial_release_date": "2020-10-12T00:00:00",
  "last_revision_date": "2020-10-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-626",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-10-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Tomcat.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat du 05 juillet 2020",
      "url": "https://tomcat.apache.org/security-9.html#Apache_Tomcat_9.x_vulnerabilities"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat du 07 juillet 2020",
      "url": "https://tomcat.apache.org/security-7.html#Apache_Tomcat_7.x_vulnerabilities"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions ant\u00e9rieures \u00e0 8.5.56",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions ant\u00e9rieures \u00e0 9.0.36",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-11996",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11996"
    }
  ],
  "initial_release_date": "2020-06-30T00:00:00",
  "last_revision_date": "2020-06-30T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-397",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-06-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 8.5.56 du 25 juin 2020",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.56"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 9.0.36 du 25 juin 2020",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.36"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 8.x ant\u00e9rieures \u00e0 8.5.55",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 7.x ant\u00e9rieures \u00e0 7.0.104",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 9.x ant\u00e9rieures \u00e0 9.0.35",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-9484",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-9484"
    }
  ],
  "initial_release_date": "2020-05-25T00:00:00",
  "last_revision_date": "2020-05-25T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-315",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-05-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 8 du 11 mai 2020",
      "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.55"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 9 du 11 mai 2020",
      "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.35"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 7 du 16 mai 2020",
      "url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.104"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat 6 toutes versions",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat 9 versions ant\u00e9rieures \u00e0 9.0.31",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat 7 versions ant\u00e9rieures \u00e0 7.0.100",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat 8 versions ant\u00e9rieures \u00e0 8.5.51",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n\n**Notes importantes** :\n\n-   Le nouveau param\u00e9trage du connecteur AJP requiert une adaptation de\n    la configuration pour \u00eatre fonctionnel ;\n-   Apache Tomcat 6 n\u0027est plus maintenu par l\u0027\u00e9diteur, aucun correctif\n    n\u0027est donc propos\u00e9. Il est donc n\u00e9cessaire de proc\u00e9der \u00e0 la mise \u00e0\n    jour de Apache Tomcat 6 vers une version support\u00e9e.\n",
  "cves": [
    {
      "name": "CVE-2020-1938",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1938"
    }
  ],
  "initial_release_date": "2020-02-24T00:00:00",
  "last_revision_date": "2020-02-24T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-112",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-02-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans le connecteur AJP de Apache\nTomcat, qui est activ\u00e9 par d\u00e9faut. Elle permet \u00e0 un attaquant ayant la\ncapacit\u00e9 de se connecter directement sur le connecteur AJP de Tomcat de\nprovoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n\nDans le cas o\u00f9 l\u0027application propose une fonctionnalit\u00e9 de\nt\u00e9l\u00e9chargement de fichier, un attaquant ayant acc\u00e8s \u00e0 cette\nfonctionnalit\u00e9 pourrait d\u00e9poser du code ex\u00e9cutable JSP (*JavaServer\nPages*) et en d\u00e9clencher l\u0027ex\u00e9cution via la pr\u00e9sente vuln\u00e9rabilit\u00e9.\n\nDes premi\u00e8res preuves de concept ont \u00e9t\u00e9 publi\u00e9es, elles permettent\nd\u0027acc\u00e9der \u00e0 un fichier arbitraire au sein du r\u00e9pertoire d\u0027ex\u00e9cution de\nApache Tomcat.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de S\u00e9curit\u00e9 Apache Tomcat 8 du 24 f\u00e9vrier 2020",
      "url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51"
    },
    {
      "published_at": null,
      "title": "Bulletin de S\u00e9curit\u00e9 Apache Tomcat 7 du 24 f\u00e9vrier 2020",
      "url": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100"
    },
    {
      "published_at": null,
      "title": "Bulletin de S\u00e9curit\u00e9 Apache Tomcat 9 du 24 f\u00e9vrier 2020",
      "url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat 7 versions ant\u00e9rieures \u00e0 7.0.99",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-12418",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-12418"
    },
    {
      "name": "CVE-2019-17563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-17563"
    }
  ],
  "initial_release_date": "2019-12-19T00:00:00",
  "last_revision_date": "2019-12-19T00:00:00",
  "links": [],
  "reference": "CERTFR-2019-AVI-643",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-12-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Tomcat.\nElles permettent \u00e0 un attaquant de provoquer un contournement de la\npolitique de s\u00e9curit\u00e9 et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache Tomcat du 17 d\u00e9cembre 2019",
      "url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.99"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apache Tomcat versions 9.0.0.M1 \u00e0 9.0.19",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Apache Tomcat versions 8.5.0 \u00e0 8.5.40",
      "product": {
        "name": "Tomcat",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-10072",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-10072"
    }
  ],
  "initial_release_date": "2019-06-21T00:00:00",
  "last_revision_date": "2019-06-21T00:00:00",
  "links": [],
  "reference": "CERTFR-2019-AVI-290",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-06-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Apache Tomcat. Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Apache Tomcat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apache 9.0.20 du 13 mai 2019",
      "url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20"
    }
  ]
}