csaf_redhat - rhsa-2009

rhsa-2009_1454

Vulnerability from csaf_redhat

Published

2009-09-21 15:51

Modified

2024-11-22 03:25

Summary

Red Hat Security Advisory: tomcat5 security update

Notes

Topic

Updated tomcat5 packages that fix several security issues are now available for JBoss Enterprise Web Server 1.0.0 for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. [Updated 23 September 2009] This erratum has been updated to include replacement packages for JBoss Enterprise Web Server 1.0.0 for Red Hat Enterprise Linux 4. The original packages did not contain a fix for the low security impact issue CVE-2009-0783. The packages for JBoss Enterprise Web Server 1.0.0 for Red Hat Enterprise Linux 5 are unchanged as they included the fix for CVE-2009-0783.

Details

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. It was discovered that Tomcat does not properly handle a certain character and character sequence in cookie values. A remote attacker could use this flaw to obtain sensitive information, such as session IDs, and then use this information for session hijacking attacks. (CVE-2007-5333) Note: The fix for the CVE-2007-5333 flaw changes the default cookie processing behavior: With this update, version 0 cookies that contain values that must be quoted to be valid are automatically changed to version 1 cookies. To reactivate the previous, but insecure behavior, add the following entry to the "/etc/tomcat5/catalina.properties" file: org.apache.tomcat.util.http.ServerCookie.VERSION_SWITCH=false It was discovered that request dispatchers did not properly normalize user requests that have trailing query strings, allowing remote attackers to send specially-crafted requests that would cause an information leak. (CVE-2008-5515) A flaw was found in the way the Tomcat AJP (Apache JServ Protocol) connector processes AJP connections. An attacker could use this flaw to send specially-crafted requests that would cause a temporary denial of service. (CVE-2009-0033) It was discovered that the error checking methods of certain authentication classes did not have sufficient error checking, allowing remote attackers to enumerate (via brute force methods) usernames registered with applications running on Tomcat when FORM-based authentication was used. (CVE-2009-0580) It was discovered that web applications containing their own XML parsers could replace the XML parser Tomcat uses to parse configuration files. A malicious web application running on a Tomcat instance could read or, potentially, modify the configuration and XML-based data of other web applications deployed on the same Tomcat instance. (CVE-2009-0783) Users of Tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues. Tomcat must be restarted for this update to take effect.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated tomcat5 packages that fix several security issues are now available\nfor JBoss Enterprise Web Server 1.0.0 for Red Hat Enterprise Linux 4 and 5.\n\nThis update has been rated as having important security impact by the Red\nHat Security Response Team.\n\n[Updated 23 September 2009]\nThis erratum has been updated to include replacement packages for JBoss\nEnterprise Web Server 1.0.0 for Red Hat Enterprise Linux 4. The original\npackages did not contain a fix for the low security impact issue\nCVE-2009-0783. The packages for JBoss Enterprise Web Server 1.0.0 for Red\nHat Enterprise Linux 5 are unchanged as they included the fix for\nCVE-2009-0783.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer\nPages (JSP) technologies.\n\nIt was discovered that Tomcat does not properly handle a certain character\nand character sequence in cookie values. A remote attacker could use this\nflaw to obtain sensitive information, such as session IDs, and then use\nthis information for session hijacking attacks. (CVE-2007-5333)\n\nNote: The fix for the CVE-2007-5333 flaw changes the default cookie\nprocessing behavior: With this update, version 0 cookies that contain\nvalues that must be quoted to be valid are automatically changed to version\n1 cookies. To reactivate the previous, but insecure behavior, add the\nfollowing entry to the \"/etc/tomcat5/catalina.properties\" file:\n\norg.apache.tomcat.util.http.ServerCookie.VERSION_SWITCH=false\n\nIt was discovered that request dispatchers did not properly normalize user\nrequests that have trailing query strings, allowing remote attackers to\nsend specially-crafted requests that would cause an information leak.\n(CVE-2008-5515)\n\nA flaw was found in the way the Tomcat AJP (Apache JServ Protocol)\nconnector processes AJP connections. An attacker could use this flaw to\nsend specially-crafted requests that would cause a temporary denial of\nservice. (CVE-2009-0033)\n\nIt was discovered that the error checking methods of certain authentication\nclasses did not have sufficient error checking, allowing remote attackers\nto enumerate (via brute force methods) usernames registered with\napplications running on Tomcat when FORM-based authentication was used.\n(CVE-2009-0580)\n\nIt was discovered that web applications containing their own XML parsers\ncould replace the XML parser Tomcat uses to parse configuration files. A\nmalicious web application running on a Tomcat instance could read or,\npotentially, modify the configuration and XML-based data of other web\napplications deployed on the same Tomcat instance. (CVE-2009-0783)\n\nUsers of Tomcat should upgrade to these updated packages, which contain\nbackported patches to resolve these issues. Tomcat must be restarted for\nthis update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2009:1454",
        "url": "https://access.redhat.com/errata/RHSA-2009:1454"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://tomcat.apache.org/security-5.html",
        "url": "http://tomcat.apache.org/security-5.html"
      },
      {
        "category": "external",
        "summary": "427766",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=427766"
      },
      {
        "category": "external",
        "summary": "493381",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=493381"
      },
      {
        "category": "external",
        "summary": "503978",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=503978"
      },
      {
        "category": "external",
        "summary": "504153",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=504153"
      },
      {
        "category": "external",
        "summary": "504753",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=504753"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1454.json"
      }
    ],
    "title": "Red Hat Security Advisory: tomcat5 security update",
    "tracking": {
      "current_release_date": "2024-11-22T03:25:53+00:00",
      "generator": {
        "date": "2024-11-22T03:25:53+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2009:1454",
      "initial_release_date": "2009-09-21T15:51:00+00:00",
      "revision_history": [
        {
          "date": "2009-09-21T15:51:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2009-09-23T11:15:12+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T03:25:53+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
                "product": {
                  "name": "Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
                  "product_id": "5Server-JBEWS-5.0.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1::el5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
                "product": {
                  "name": "Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
                  "product_id": "4AS-JBEWS-5.0.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1::el4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
                "product": {
                  "name": "Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
                  "product_id": "4ES-JBEWS-5.0.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1::el4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Web Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                "product": {
                  "name": "tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_id": "tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-webapps@5.5.23-0jpp.9.6.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                "product": {
                  "name": "tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_id": "tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5@5.5.23-0jpp.9.6.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                "product": {
                  "name": "tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_id": "tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-jasper@5.5.23-0jpp.9.6.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                "product": {
                  "name": "tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_id": "tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-server-lib@5.5.23-0jpp.9.6.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                "product": {
                  "name": "tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_id": "tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-jsp-2.0-api@5.5.23-0jpp.9.6.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                "product": {
                  "name": "tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_id": "tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-servlet-2.4-api-javadoc@5.5.23-0jpp.9.6.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                "product": {
                  "name": "tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_id": "tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-servlet-2.4-api@5.5.23-0jpp.9.6.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                "product": {
                  "name": "tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_id": "tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-admin-webapps@5.5.23-0jpp.9.6.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                "product": {
                  "name": "tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_id": "tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-jasper-javadoc@5.5.23-0jpp.9.6.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                "product": {
                  "name": "tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_id": "tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-jsp-2.0-api-javadoc@5.5.23-0jpp.9.6.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                "product": {
                  "name": "tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_id": "tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-common-lib@5.5.23-0jpp.9.6.ep5.el5?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                "product": {
                  "name": "tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_id": "tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-jasper-javadoc@5.5.23-1.patch07.19.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                "product": {
                  "name": "tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_id": "tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-jsp-2.0-api@5.5.23-1.patch07.19.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                "product": {
                  "name": "tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_id": "tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-common-lib@5.5.23-1.patch07.19.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                "product": {
                  "name": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_id": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5@5.5.23-1.patch07.19.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                "product": {
                  "name": "tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_id": "tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-servlet-2.4-api-javadoc@5.5.23-1.patch07.19.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                "product": {
                  "name": "tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_id": "tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-jsp-2.0-api-javadoc@5.5.23-1.patch07.19.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                "product": {
                  "name": "tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_id": "tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-admin-webapps@5.5.23-1.patch07.19.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                "product": {
                  "name": "tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_id": "tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-servlet-2.4-api@5.5.23-1.patch07.19.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                "product": {
                  "name": "tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_id": "tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-server-lib@5.5.23-1.patch07.19.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                "product": {
                  "name": "tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_id": "tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-webapps@5.5.23-1.patch07.19.ep5.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                "product": {
                  "name": "tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_id": "tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5-jasper@5.5.23-1.patch07.19.ep5.el4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
                "product": {
                  "name": "tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
                  "product_id": "tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5@5.5.23-0jpp.9.6.ep5.el5?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
                "product": {
                  "name": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
                  "product_id": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5@5.5.23-1.patch07.19.ep5.el4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
          "product_id": "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
          "product_id": "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src"
        },
        "product_reference": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
        "relates_to_product_reference": "4AS-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
          "product_id": "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
          "product_id": "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
          "product_id": "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
          "product_id": "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
          "product_id": "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
          "product_id": "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
          "product_id": "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
          "product_id": "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
          "product_id": "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 AS",
          "product_id": "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4AS-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
          "product_id": "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
          "product_id": "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src"
        },
        "product_reference": "tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
        "relates_to_product_reference": "4ES-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
          "product_id": "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
          "product_id": "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
          "product_id": "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
          "product_id": "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
          "product_id": "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
          "product_id": "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
          "product_id": "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
          "product_id": "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
          "product_id": "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch as a component of Red Hat JBoss Web Server 1.0 for RHEL 4 ES",
          "product_id": "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch"
        },
        "product_reference": "tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
        "relates_to_product_reference": "4ES-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        },
        "product_reference": "tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src"
        },
        "product_reference": "tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
        "relates_to_product_reference": "5Server-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        },
        "product_reference": "tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        },
        "product_reference": "tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        },
        "product_reference": "tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        },
        "product_reference": "tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        },
        "product_reference": "tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        },
        "product_reference": "tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        },
        "product_reference": "tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        },
        "product_reference": "tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        },
        "product_reference": "tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-5.0.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server",
          "product_id": "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        },
        "product_reference": "tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
        "relates_to_product_reference": "5Server-JBEWS-5.0.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2007-5333",
      "discovery_date": "2008-01-07T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "427766"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (\") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.  NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Improve cookie parsing for tomcat5",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2007-5333\n\nThe Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
          "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
          "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
          "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-5333"
        },
        {
          "category": "external",
          "summary": "RHBZ#427766",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=427766"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-5333",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-5333"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-5333",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5333"
        }
      ],
      "release_date": "2008-02-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-09-21T15:51:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
            "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1454"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Improve cookie parsing for tomcat5"
    },
    {
      "cve": "CVE-2008-5515",
      "discovery_date": "2009-06-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "504753"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat request dispatcher information disclosure vulnerability",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
          "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
          "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
          "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-5515"
        },
        {
          "category": "external",
          "summary": "RHBZ#504753",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=504753"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-5515",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-5515"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-5515",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5515"
        }
      ],
      "release_date": "2009-06-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-09-21T15:51:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
            "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1454"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat request dispatcher information disclosure vulnerability"
    },
    {
      "cve": "CVE-2009-0033",
      "discovery_date": "2009-01-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "493381"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat6 Denial-Of-Service with AJP connection",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
          "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
          "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
          "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-0033"
        },
        {
          "category": "external",
          "summary": "RHBZ#493381",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=493381"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-0033",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-0033"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0033",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0033"
        }
      ],
      "release_date": "2009-06-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-09-21T15:51:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
            "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1454"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
            "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat6 Denial-Of-Service with AJP connection"
    },
    {
      "cve": "CVE-2009-0580",
      "discovery_date": "2009-06-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "503978"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat6 Information disclosure in authentication classes",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
          "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
          "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
          "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-0580"
        },
        {
          "category": "external",
          "summary": "RHBZ#503978",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=503978"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-0580",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-0580"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0580",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0580"
        }
      ],
      "release_date": "2009-06-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-09-21T15:51:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
            "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1454"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
            "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat6 Information disclosure in authentication classes"
    },
    {
      "cve": "CVE-2009-0783",
      "discovery_date": "2009-06-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "504153"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat XML parser information disclosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
          "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
          "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
          "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
          "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-0783"
        },
        {
          "category": "external",
          "summary": "RHBZ#504153",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=504153"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-0783",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-0783"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-0783",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0783"
        }
      ],
      "release_date": "2009-06-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2009-09-21T15:51:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
            "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2009:1454"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 1.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:M/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4AS-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4AS-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-0:5.5.23-1.patch07.19.ep5.el4.src",
            "4ES-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "4ES-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-1.patch07.19.ep5.el4.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-0:5.5.23-0jpp.9.6.ep5.el5.src",
            "5Server-JBEWS-5.0.0:tomcat5-admin-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-common-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jasper-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-jsp-2.0-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-server-lib-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-servlet-2.4-api-javadoc-0:5.5.23-0jpp.9.6.ep5.el5.noarch",
            "5Server-JBEWS-5.0.0:tomcat5-webapps-0:5.5.23-0jpp.9.6.ep5.el5.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat XML parser information disclosure"
    }
  ]
}

cve-2009-0783

Vulnerability from cvelistv5

Published

2009-06-05 15:25

Modified

2024-08-07 04:48

Severity ?

Summary

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.

References

▼	URL	Tags
	http://tomcat.apache.org/security-4.html	x_refsource_CONFIRM
	http://marc.info/?l=bugtraq&m=127420533226623&w=2	vendor-advisory, x_refsource_HP
	http://svn.apache.org/viewvc?rev=652592&view=rev	x_refsource_CONFIRM
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:138	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html	vendor-advisory, x_refsource_FEDORA
	http://www.debian.org/security/2011/dsa-2207	vendor-advisory, x_refsource_DEBIAN
	http://marc.info/?l=bugtraq&m=136485229118404&w=2	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/37460	third-party-advisory, x_refsource_SECUNIA
	http://svn.apache.org/viewvc?rev=781542&view=rev	x_refsource_CONFIRM
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18913	vdb-entry, signature, x_refsource_OVAL
	http://www.vupen.com/english/advisories/2010/3056	vdb-entry, x_refsource_VUPEN
	http://www.securityfocus.com/archive/1/504090/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	x_refsource_CONFIRM
	http://secunia.com/advisories/35788	third-party-advisory, x_refsource_SECUNIA
	http://marc.info/?l=bugtraq&m=127420533226623&w=2	vendor-advisory, x_refsource_HP
	http://svn.apache.org/viewvc?rev=781708&view=rev	x_refsource_CONFIRM
	http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html	vendor-advisory, x_refsource_APPLE
	http://svn.apache.org/viewvc?rev=739522&view=rev	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2009/1856	vdb-entry, x_refsource_VUPEN
	http://www.mandriva.com/security/advisories?name=MDVSA-2010:176	vendor-advisory, x_refsource_MANDRIVA
	http://www.securityfocus.com/archive/1/507985/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://svn.apache.org/viewvc?rev=681156&view=rev	x_refsource_CONFIRM
	http://secunia.com/advisories/42368	third-party-advisory, x_refsource_SECUNIA
	http://tomcat.apache.org/security-6.html	x_refsource_CONFIRM
	http://support.apple.com/kb/HT4077	x_refsource_CONFIRM
	https://issues.apache.org/bugzilla/show_bug.cgi?id=45933	x_refsource_CONFIRM
	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html	vendor-advisory, x_refsource_FEDORA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6450	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/35685	third-party-advisory, x_refsource_SECUNIA
	http://www.securitytracker.com/id?1022336	vdb-entry, x_refsource_SECTRACK
	https://exchange.xforce.ibmcloud.com/vulnerabilities/51195	vdb-entry, x_refsource_XF
	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html	vendor-advisory, x_refsource_FEDORA
	http://tomcat.apache.org/security-5.html	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html	vendor-advisory, x_refsource_SUSE
	http://marc.info/?l=bugtraq&m=129070310906557&w=2	vendor-advisory, x_refsource_HP
	http://marc.info/?l=bugtraq&m=136485229118404&w=2	vendor-advisory, x_refsource_HP
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:136	vendor-advisory, x_refsource_MANDRIVA
	http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1	vendor-advisory, x_refsource_SUNALERT
	https://issues.apache.org/bugzilla/show_bug.cgi?id=29936	x_refsource_CONFIRM
	http://marc.info/?l=bugtraq&m=129070310906557&w=2	vendor-advisory, x_refsource_HP
	http://www.securityfocus.com/bid/35416	vdb-entry, x_refsource_BID
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10716	vdb-entry, signature, x_refsource_OVAL
	http://www.vupen.com/english/advisories/2009/3316	vdb-entry, x_refsource_VUPEN
	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:48:52.307Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-4.html"
          },
          {
            "name": "HPSBMA02535",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?rev=652592\u0026view=rev"
          },
          {
            "name": "MDVSA-2009:138",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:138"
          },
          {
            "name": "FEDORA-2009-11356",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html"
          },
          {
            "name": "DSA-2207",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2011/dsa-2207"
          },
          {
            "name": "HPSBUX02860",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
          },
          {
            "name": "37460",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37460"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?rev=781542\u0026view=rev"
          },
          {
            "name": "oval:org.mitre.oval:def:18913",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18913"
          },
          {
            "name": "ADV-2010-3056",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/3056"
          },
          {
            "name": "20090604 [SECURITY] CVE-2009-0783 Apache Tomcat Information disclosure",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/504090/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "35788",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35788"
          },
          {
            "name": "SSRT100029",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?rev=781708\u0026view=rev"
          },
          {
            "name": "APPLE-SA-2010-03-29-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?rev=739522\u0026view=rev"
          },
          {
            "name": "ADV-2009-1856",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1856"
          },
          {
            "name": "MDVSA-2010:176",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:176"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?rev=681156\u0026view=rev"
          },
          {
            "name": "42368",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42368"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-6.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT4077"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=45933"
          },
          {
            "name": "FEDORA-2009-11374",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html"
          },
          {
            "name": "oval:org.mitre.oval:def:6450",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6450"
          },
          {
            "name": "35685",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35685"
          },
          {
            "name": "1022336",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022336"
          },
          {
            "name": "tomcat-xml-information-disclosure(51195)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51195"
          },
          {
            "name": "FEDORA-2009-11352",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-5.html"
          },
          {
            "name": "SUSE-SR:2009:012",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html"
          },
          {
            "name": "HPSBUX02579",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
          },
          {
            "name": "SSRT101146",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
          },
          {
            "name": "MDVSA-2009:136",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136"
          },
          {
            "name": "263529",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=29936"
          },
          {
            "name": "SSRT100203",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
          },
          {
            "name": "35416",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35416"
          },
          {
            "name": "oval:org.mitre.oval:def:10716",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10716"
          },
          {
            "name": "ADV-2009-3316",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3316"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-06-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T16:08:27",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-4.html"
        },
        {
          "name": "HPSBMA02535",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?rev=652592\u0026view=rev"
        },
        {
          "name": "MDVSA-2009:138",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:138"
        },
        {
          "name": "FEDORA-2009-11356",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html"
        },
        {
          "name": "DSA-2207",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2011/dsa-2207"
        },
        {
          "name": "HPSBUX02860",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
        },
        {
          "name": "37460",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37460"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?rev=781542\u0026view=rev"
        },
        {
          "name": "oval:org.mitre.oval:def:18913",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18913"
        },
        {
          "name": "ADV-2010-3056",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/3056"
        },
        {
          "name": "20090604 [SECURITY] CVE-2009-0783 Apache Tomcat Information disclosure",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/504090/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "35788",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35788"
        },
        {
          "name": "SSRT100029",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?rev=781708\u0026view=rev"
        },
        {
          "name": "APPLE-SA-2010-03-29-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?rev=739522\u0026view=rev"
        },
        {
          "name": "ADV-2009-1856",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1856"
        },
        {
          "name": "MDVSA-2010:176",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:176"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?rev=681156\u0026view=rev"
        },
        {
          "name": "42368",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42368"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-6.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT4077"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=45933"
        },
        {
          "name": "FEDORA-2009-11374",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html"
        },
        {
          "name": "oval:org.mitre.oval:def:6450",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6450"
        },
        {
          "name": "35685",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35685"
        },
        {
          "name": "1022336",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022336"
        },
        {
          "name": "tomcat-xml-information-disclosure(51195)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51195"
        },
        {
          "name": "FEDORA-2009-11352",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-5.html"
        },
        {
          "name": "SUSE-SR:2009:012",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html"
        },
        {
          "name": "HPSBUX02579",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
        },
        {
          "name": "SSRT101146",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
        },
        {
          "name": "MDVSA-2009:136",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136"
        },
        {
          "name": "263529",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=29936"
        },
        {
          "name": "SSRT100203",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
        },
        {
          "name": "35416",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35416"
        },
        {
          "name": "oval:org.mitre.oval:def:10716",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10716"
        },
        {
          "name": "ADV-2009-3316",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3316"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-0783",
    "datePublished": "2009-06-05T15:25:00",
    "dateReserved": "2009-03-04T00:00:00",
    "dateUpdated": "2024-08-07T04:48:52.307Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2007-5333

Vulnerability from cvelistv5

Published

2008-02-12 00:00

Modified

2024-08-07 15:24

Severity ?

Summary

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.

References

▼	URL	Tags
	http://www.vupen.com/english/advisories/2008/2690	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/33330	third-party-advisory, x_refsource_SECUNIA
	http://tomcat.apache.org/security-4.html	x_refsource_CONFIRM
	http://support.apple.com/kb/HT2163	x_refsource_CONFIRM
	http://secunia.com/advisories/30676	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/bid/27706	vdb-entry, x_refsource_BID
	http://securityreason.com/securityalert/3636	third-party-advisory, x_refsource_SREASON
	http://jvn.jp/jp/JVN%2309470767/index.html	third-party-advisory, x_refsource_JVN
	http://www.vupen.com/english/advisories/2008/1981/references	vdb-entry, x_refsource_VUPEN
	http://www-1.ibm.com/support/docview.wss?uid=swg1IZ20133	vendor-advisory, x_refsource_AIXAPAR
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11177	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/28915	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/37460	third-party-advisory, x_refsource_SECUNIA
	http://www-1.ibm.com/support/docview.wss?uid=swg1IZ20991	vendor-advisory, x_refsource_AIXAPAR
	http://www.securityfocus.com/bid/31681	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/28884	third-party-advisory, x_refsource_SECUNIA
	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	x_refsource_CONFIRM
	http://www.securityfocus.com/archive/1/487822/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www-01.ibm.com/support/docview.wss?uid=swg27012048	x_refsource_CONFIRM
	http://secunia.com/advisories/28878	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/32036	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2008/0488	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/44183	third-party-advisory, x_refsource_SECUNIA
	http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html	vendor-advisory, x_refsource_APPLE
	http://www.mandriva.com/security/advisories?name=MDVSA-2010:176	vendor-advisory, x_refsource_MANDRIVA
	http://www.securityfocus.com/archive/1/507985/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html	vendor-advisory, x_refsource_SUSE
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:018	vendor-advisory, x_refsource_MANDRIVA
	http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp08/html-single/Release_Notes/index.html	x_refsource_CONFIRM
	http://tomcat.apache.org/security-6.html	x_refsource_CONFIRM
	http://secunia.com/advisories/57126	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/32222	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/30802	third-party-advisory, x_refsource_SECUNIA
	http://www-01.ibm.com/support/docview.wss?uid=swg27012047	x_refsource_CONFIRM
	https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html	vendor-advisory, x_refsource_FEDORA
	http://security.gentoo.org/glsa/glsa-200804-10.xml	vendor-advisory, x_refsource_GENTOO
	https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html	vendor-advisory, x_refsource_FEDORA
	http://www.vupen.com/english/advisories/2008/1856/references	vdb-entry, x_refsource_VUPEN
	http://www.vmware.com/security/advisories/VMSA-2008-0010.html	x_refsource_CONFIRM
	http://tomcat.apache.org/security-5.html	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2008/2780	vdb-entry, x_refsource_VUPEN
	http://marc.info/?l=bugtraq&m=139344343412337&w=2	vendor-advisory, x_refsource_HP
	http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html	vendor-advisory, x_refsource_APPLE
	http://support.apple.com/kb/HT3216	x_refsource_CONFIRM
	http://www-01.ibm.com/support/docview.wss?uid=swg24018932	x_refsource_CONFIRM
	http://secunia.com/advisories/29711	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/3316	vdb-entry, x_refsource_VUPEN
	https://bugzilla.redhat.com/show_bug.cgi?id=532111	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:24:42.490Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2008-2690",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2690"
          },
          {
            "name": "33330",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33330"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-4.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT2163"
          },
          {
            "name": "30676",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30676"
          },
          {
            "name": "27706",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/27706"
          },
          {
            "name": "3636",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3636"
          },
          {
            "name": "JVN#09470767",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/jp/JVN%2309470767/index.html"
          },
          {
            "name": "ADV-2008-1981",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1981/references"
          },
          {
            "name": "IZ20133",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IZ20133"
          },
          {
            "name": "oval:org.mitre.oval:def:11177",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11177"
          },
          {
            "name": "28915",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28915"
          },
          {
            "name": "37460",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37460"
          },
          {
            "name": "IZ20991",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IZ20991"
          },
          {
            "name": "31681",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/31681"
          },
          {
            "name": "28884",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28884"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "20080208 [SECURITY] CVE-2007-5333: Tomcat Cookie handling vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/487822/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27012048"
          },
          {
            "name": "28878",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28878"
          },
          {
            "name": "32036",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32036"
          },
          {
            "name": "ADV-2008-0488",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/0488"
          },
          {
            "name": "44183",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/44183"
          },
          {
            "name": "APPLE-SA-2008-06-30",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html"
          },
          {
            "name": "MDVSA-2010:176",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:176"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "name": "SUSE-SR:2009:004",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html"
          },
          {
            "name": "MDVSA-2009:018",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:018"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp08/html-single/Release_Notes/index.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-6.html"
          },
          {
            "name": "57126",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/57126"
          },
          {
            "name": "32222",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32222"
          },
          {
            "name": "30802",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30802"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27012047"
          },
          {
            "name": "FEDORA-2008-1467",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html"
          },
          {
            "name": "GLSA-200804-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200804-10.xml"
          },
          {
            "name": "FEDORA-2008-1603",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html"
          },
          {
            "name": "ADV-2008-1856",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1856/references"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2008-0010.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-5.html"
          },
          {
            "name": "ADV-2008-2780",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2780"
          },
          {
            "name": "HPSBST02955",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2"
          },
          {
            "name": "APPLE-SA-2008-10-09",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT3216"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24018932"
          },
          {
            "name": "29711",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29711"
          },
          {
            "name": "ADV-2009-3316",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3316"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=532111"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-02-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (\") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.  NOTE: this issue exists because of an incomplete fix for CVE-2007-3385."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T16:08:21",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "ADV-2008-2690",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2690"
        },
        {
          "name": "33330",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33330"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-4.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT2163"
        },
        {
          "name": "30676",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30676"
        },
        {
          "name": "27706",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/27706"
        },
        {
          "name": "3636",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3636"
        },
        {
          "name": "JVN#09470767",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/jp/JVN%2309470767/index.html"
        },
        {
          "name": "ADV-2008-1981",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1981/references"
        },
        {
          "name": "IZ20133",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IZ20133"
        },
        {
          "name": "oval:org.mitre.oval:def:11177",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11177"
        },
        {
          "name": "28915",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28915"
        },
        {
          "name": "37460",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37460"
        },
        {
          "name": "IZ20991",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IZ20991"
        },
        {
          "name": "31681",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/31681"
        },
        {
          "name": "28884",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28884"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "20080208 [SECURITY] CVE-2007-5333: Tomcat Cookie handling vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/487822/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27012048"
        },
        {
          "name": "28878",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28878"
        },
        {
          "name": "32036",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32036"
        },
        {
          "name": "ADV-2008-0488",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/0488"
        },
        {
          "name": "44183",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/44183"
        },
        {
          "name": "APPLE-SA-2008-06-30",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html"
        },
        {
          "name": "MDVSA-2010:176",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:176"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "name": "SUSE-SR:2009:004",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html"
        },
        {
          "name": "MDVSA-2009:018",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:018"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp08/html-single/Release_Notes/index.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-6.html"
        },
        {
          "name": "57126",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/57126"
        },
        {
          "name": "32222",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32222"
        },
        {
          "name": "30802",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30802"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg27012047"
        },
        {
          "name": "FEDORA-2008-1467",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00315.html"
        },
        {
          "name": "GLSA-200804-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200804-10.xml"
        },
        {
          "name": "FEDORA-2008-1603",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00460.html"
        },
        {
          "name": "ADV-2008-1856",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1856/references"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2008-0010.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-5.html"
        },
        {
          "name": "ADV-2008-2780",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2780"
        },
        {
          "name": "HPSBST02955",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2"
        },
        {
          "name": "APPLE-SA-2008-10-09",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT3216"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg24018932"
        },
        {
          "name": "29711",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29711"
        },
        {
          "name": "ADV-2009-3316",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3316"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=532111"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2007-5333",
    "datePublished": "2008-02-12T00:00:00",
    "dateReserved": "2007-10-10T00:00:00",
    "dateUpdated": "2024-08-07T15:24:42.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2008-5515

Vulnerability from cvelistv5

Published

2009-06-16 20:26

Modified

2024-08-07 10:56

Severity ?

Summary

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.

References

▼	URL	Tags
	http://tomcat.apache.org/security-4.html	x_refsource_CONFIRM
	http://marc.info/?l=bugtraq&m=127420533226623&w=2	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/39317	third-party-advisory, x_refsource_SECUNIA
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:138	vendor-advisory, x_refsource_MANDRIVA
	http://www.vupen.com/english/advisories/2009/1535	vdb-entry, x_refsource_VUPEN
	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html	vendor-advisory, x_refsource_FEDORA
	http://www.debian.org/security/2011/dsa-2207	vendor-advisory, x_refsource_DEBIAN
	http://jvn.jp/en/jp/JVN63832775/index.html	third-party-advisory, x_refsource_JVN
	http://marc.info/?l=bugtraq&m=136485229118404&w=2	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/37460	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2010/3056	vdb-entry, x_refsource_VUPEN
	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	x_refsource_CONFIRM
	http://secunia.com/advisories/35788	third-party-advisory, x_refsource_SECUNIA
	http://marc.info/?l=bugtraq&m=127420533226623&w=2	vendor-advisory, x_refsource_HP
	http://www.securityfocus.com/archive/1/504202/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html	vendor-advisory, x_refsource_APPLE
	http://www.securityfocus.com/bid/35263	vdb-entry, x_refsource_BID
	http://www.vupen.com/english/advisories/2009/1520	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/44183	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2009/1856	vdb-entry, x_refsource_VUPEN
	http://www.securityfocus.com/archive/1/504170/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.mandriva.com/security/advisories?name=MDVSA-2010:176	vendor-advisory, x_refsource_MANDRIVA
	http://www.securityfocus.com/archive/1/507985/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://secunia.com/advisories/42368	third-party-advisory, x_refsource_SECUNIA
	http://tomcat.apache.org/security-6.html	x_refsource_CONFIRM
	http://secunia.com/advisories/35393	third-party-advisory, x_refsource_SECUNIA
	http://support.apple.com/kb/HT4077	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html	vendor-advisory, x_refsource_SUSE
	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html	vendor-advisory, x_refsource_FEDORA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6445	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/35685	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html	vendor-advisory, x_refsource_FEDORA
	http://tomcat.apache.org/security-5.html	x_refsource_CONFIRM
	http://www.fujitsu.com/global/support/software/security/products-f/interstage-200902e.html	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html	vendor-advisory, x_refsource_SUSE
	http://marc.info/?l=bugtraq&m=129070310906557&w=2	vendor-advisory, x_refsource_HP
	http://marc.info/?l=bugtraq&m=136485229118404&w=2	vendor-advisory, x_refsource_HP
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:136	vendor-advisory, x_refsource_MANDRIVA
	http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1	vendor-advisory, x_refsource_SUNALERT
	http://marc.info/?l=bugtraq&m=129070310906557&w=2	vendor-advisory, x_refsource_HP
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10422	vdb-entry, signature, x_refsource_OVAL
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19452	vdb-entry, signature, x_refsource_OVAL
	http://www.vupen.com/english/advisories/2009/3316	vdb-entry, x_refsource_VUPEN
	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T10:56:46.803Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-4.html"
          },
          {
            "name": "HPSBMA02535",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
          },
          {
            "name": "39317",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/39317"
          },
          {
            "name": "MDVSA-2009:138",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:138"
          },
          {
            "name": "ADV-2009-1535",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1535"
          },
          {
            "name": "FEDORA-2009-11356",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html"
          },
          {
            "name": "DSA-2207",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2011/dsa-2207"
          },
          {
            "name": "JVN#63832775",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN63832775/index.html"
          },
          {
            "name": "HPSBUX02860",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
          },
          {
            "name": "37460",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37460"
          },
          {
            "name": "ADV-2010-3056",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/3056"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "35788",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35788"
          },
          {
            "name": "SSRT100029",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
          },
          {
            "name": "20090610 [SECURITY] UPDATED CVE-2008-5515 RequestDispatcher directory traversal vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/504202/100/0/threaded"
          },
          {
            "name": "APPLE-SA-2010-03-29-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
          },
          {
            "name": "35263",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35263"
          },
          {
            "name": "ADV-2009-1520",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1520"
          },
          {
            "name": "44183",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/44183"
          },
          {
            "name": "ADV-2009-1856",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1856"
          },
          {
            "name": "20090608 [SECURITY] CVE-2008-5515 RequestDispatcher directory traversal vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/504170/100/0/threaded"
          },
          {
            "name": "MDVSA-2010:176",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:176"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "name": "42368",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42368"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-6.html"
          },
          {
            "name": "35393",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35393"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT4077"
          },
          {
            "name": "SUSE-SR:2010:008",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html"
          },
          {
            "name": "FEDORA-2009-11374",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html"
          },
          {
            "name": "oval:org.mitre.oval:def:6445",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6445"
          },
          {
            "name": "35685",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35685"
          },
          {
            "name": "FEDORA-2009-11352",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-5.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200902e.html"
          },
          {
            "name": "SUSE-SR:2009:012",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html"
          },
          {
            "name": "HPSBUX02579",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
          },
          {
            "name": "SSRT101146",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
          },
          {
            "name": "MDVSA-2009:136",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136"
          },
          {
            "name": "263529",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1"
          },
          {
            "name": "SSRT100203",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
          },
          {
            "name": "oval:org.mitre.oval:def:10422",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10422"
          },
          {
            "name": "oval:org.mitre.oval:def:19452",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19452"
          },
          {
            "name": "ADV-2009-3316",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3316"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-06-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T16:08:25",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-4.html"
        },
        {
          "name": "HPSBMA02535",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
        },
        {
          "name": "39317",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/39317"
        },
        {
          "name": "MDVSA-2009:138",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:138"
        },
        {
          "name": "ADV-2009-1535",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1535"
        },
        {
          "name": "FEDORA-2009-11356",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html"
        },
        {
          "name": "DSA-2207",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2011/dsa-2207"
        },
        {
          "name": "JVN#63832775",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN63832775/index.html"
        },
        {
          "name": "HPSBUX02860",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
        },
        {
          "name": "37460",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37460"
        },
        {
          "name": "ADV-2010-3056",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/3056"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "35788",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35788"
        },
        {
          "name": "SSRT100029",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
        },
        {
          "name": "20090610 [SECURITY] UPDATED CVE-2008-5515 RequestDispatcher directory traversal vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/504202/100/0/threaded"
        },
        {
          "name": "APPLE-SA-2010-03-29-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
        },
        {
          "name": "35263",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35263"
        },
        {
          "name": "ADV-2009-1520",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1520"
        },
        {
          "name": "44183",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/44183"
        },
        {
          "name": "ADV-2009-1856",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1856"
        },
        {
          "name": "20090608 [SECURITY] CVE-2008-5515 RequestDispatcher directory traversal vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/504170/100/0/threaded"
        },
        {
          "name": "MDVSA-2010:176",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:176"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "name": "42368",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42368"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-6.html"
        },
        {
          "name": "35393",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35393"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT4077"
        },
        {
          "name": "SUSE-SR:2010:008",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html"
        },
        {
          "name": "FEDORA-2009-11374",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html"
        },
        {
          "name": "oval:org.mitre.oval:def:6445",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6445"
        },
        {
          "name": "35685",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35685"
        },
        {
          "name": "FEDORA-2009-11352",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-5.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200902e.html"
        },
        {
          "name": "SUSE-SR:2009:012",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html"
        },
        {
          "name": "HPSBUX02579",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
        },
        {
          "name": "SSRT101146",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
        },
        {
          "name": "MDVSA-2009:136",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136"
        },
        {
          "name": "263529",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1"
        },
        {
          "name": "SSRT100203",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
        },
        {
          "name": "oval:org.mitre.oval:def:10422",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10422"
        },
        {
          "name": "oval:org.mitre.oval:def:19452",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19452"
        },
        {
          "name": "ADV-2009-3316",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3316"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2008-5515",
    "datePublished": "2009-06-16T20:26:00",
    "dateReserved": "2008-12-12T00:00:00",
    "dateUpdated": "2024-08-07T10:56:46.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-0033

Vulnerability from cvelistv5

Published

2009-06-05 15:25

Modified

2024-08-07 04:17

Severity ?

Summary

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.

References

▼	URL	Tags
	http://tomcat.apache.org/security-4.html	x_refsource_CONFIRM
	http://marc.info/?l=bugtraq&m=127420533226623&w=2	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/35326	third-party-advisory, x_refsource_SECUNIA
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:138	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html	vendor-advisory, x_refsource_FEDORA
	http://www.debian.org/security/2011/dsa-2207	vendor-advisory, x_refsource_DEBIAN
	http://secunia.com/advisories/35344	third-party-advisory, x_refsource_SECUNIA
	http://marc.info/?l=bugtraq&m=136485229118404&w=2	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/37460	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2010/3056	vdb-entry, x_refsource_VUPEN
	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	x_refsource_CONFIRM
	http://secunia.com/advisories/35788	third-party-advisory, x_refsource_SECUNIA
	http://marc.info/?l=bugtraq&m=127420533226623&w=2	vendor-advisory, x_refsource_HP
	http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html	vendor-advisory, x_refsource_APPLE
	http://jvn.jp/en/jp/JVN87272440/index.html	third-party-advisory, x_refsource_JVN
	http://www.vupen.com/english/advisories/2009/1496	vdb-entry, x_refsource_VUPEN
	http://marc.info/?l=bugtraq&m=133469267822771&w=2	vendor-advisory, x_refsource_HP
	http://securitytracker.com/id?1022331	vdb-entry, x_refsource_SECTRACK
	http://www.vupen.com/english/advisories/2009/1856	vdb-entry, x_refsource_VUPEN
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10231	vdb-entry, signature, x_refsource_OVAL
	http://www.securityfocus.com/bid/35193	vdb-entry, x_refsource_BID
	http://www.mandriva.com/security/advisories?name=MDVSA-2010:176	vendor-advisory, x_refsource_MANDRIVA
	http://www.securityfocus.com/archive/1/507985/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://secunia.com/advisories/42368	third-party-advisory, x_refsource_SECUNIA
	http://tomcat.apache.org/security-6.html	x_refsource_CONFIRM
	http://www.securityfocus.com/archive/1/504044/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://support.apple.com/kb/HT4077	x_refsource_CONFIRM
	http://svn.apache.org/viewvc?rev=742915&view=rev	x_refsource_CONFIRM
	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html	vendor-advisory, x_refsource_FEDORA
	http://svn.apache.org/viewvc?rev=781362&view=rev	x_refsource_CONFIRM
	http://secunia.com/advisories/35685	third-party-advisory, x_refsource_SECUNIA
	http://marc.info/?l=bugtraq&m=133469267822771&w=2	vendor-advisory, x_refsource_HP
	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html	vendor-advisory, x_refsource_FEDORA
	http://tomcat.apache.org/security-5.html	x_refsource_CONFIRM
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19110	vdb-entry, signature, x_refsource_OVAL
	http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html	vendor-advisory, x_refsource_SUSE
	http://marc.info/?l=bugtraq&m=129070310906557&w=2	vendor-advisory, x_refsource_HP
	http://marc.info/?l=bugtraq&m=136485229118404&w=2	vendor-advisory, x_refsource_HP
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:136	vendor-advisory, x_refsource_MANDRIVA
	http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1	vendor-advisory, x_refsource_SUNALERT
	http://marc.info/?l=bugtraq&m=129070310906557&w=2	vendor-advisory, x_refsource_HP
	https://exchange.xforce.ibmcloud.com/vulnerabilities/50928	vdb-entry, x_refsource_XF
	http://www.vupen.com/english/advisories/2009/3316	vdb-entry, x_refsource_VUPEN
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5739	vdb-entry, signature, x_refsource_OVAL
	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:17:10.437Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-4.html"
          },
          {
            "name": "HPSBMA02535",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
          },
          {
            "name": "35326",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35326"
          },
          {
            "name": "MDVSA-2009:138",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:138"
          },
          {
            "name": "FEDORA-2009-11356",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html"
          },
          {
            "name": "DSA-2207",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2011/dsa-2207"
          },
          {
            "name": "35344",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35344"
          },
          {
            "name": "HPSBUX02860",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
          },
          {
            "name": "37460",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37460"
          },
          {
            "name": "ADV-2010-3056",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/3056"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "35788",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35788"
          },
          {
            "name": "SSRT100029",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
          },
          {
            "name": "APPLE-SA-2010-03-29-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
          },
          {
            "name": "JVN#87272440",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN87272440/index.html"
          },
          {
            "name": "ADV-2009-1496",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1496"
          },
          {
            "name": "HPSBOV02762",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
          },
          {
            "name": "1022331",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1022331"
          },
          {
            "name": "ADV-2009-1856",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1856"
          },
          {
            "name": "oval:org.mitre.oval:def:10231",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10231"
          },
          {
            "name": "35193",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35193"
          },
          {
            "name": "MDVSA-2010:176",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:176"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "name": "42368",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42368"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-6.html"
          },
          {
            "name": "20090603 [SECURITY] CVE-2009-0033 Apache Tomcat DoS when using Java AJP connector",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/504044/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT4077"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?rev=742915\u0026view=rev"
          },
          {
            "name": "FEDORA-2009-11374",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?rev=781362\u0026view=rev"
          },
          {
            "name": "35685",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35685"
          },
          {
            "name": "SSRT100825",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
          },
          {
            "name": "FEDORA-2009-11352",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-5.html"
          },
          {
            "name": "oval:org.mitre.oval:def:19110",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19110"
          },
          {
            "name": "SUSE-SR:2009:012",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html"
          },
          {
            "name": "HPSBUX02579",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
          },
          {
            "name": "SSRT101146",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
          },
          {
            "name": "MDVSA-2009:136",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136"
          },
          {
            "name": "263529",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1"
          },
          {
            "name": "SSRT100203",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
          },
          {
            "name": "tomcat-ajp-dos(50928)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50928"
          },
          {
            "name": "ADV-2009-3316",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3316"
          },
          {
            "name": "oval:org.mitre.oval:def:5739",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5739"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-06-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T16:08:52",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-4.html"
        },
        {
          "name": "HPSBMA02535",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
        },
        {
          "name": "35326",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35326"
        },
        {
          "name": "MDVSA-2009:138",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:138"
        },
        {
          "name": "FEDORA-2009-11356",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html"
        },
        {
          "name": "DSA-2207",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2011/dsa-2207"
        },
        {
          "name": "35344",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35344"
        },
        {
          "name": "HPSBUX02860",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
        },
        {
          "name": "37460",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37460"
        },
        {
          "name": "ADV-2010-3056",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/3056"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "35788",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35788"
        },
        {
          "name": "SSRT100029",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
        },
        {
          "name": "APPLE-SA-2010-03-29-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
        },
        {
          "name": "JVN#87272440",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN87272440/index.html"
        },
        {
          "name": "ADV-2009-1496",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1496"
        },
        {
          "name": "HPSBOV02762",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
        },
        {
          "name": "1022331",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1022331"
        },
        {
          "name": "ADV-2009-1856",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1856"
        },
        {
          "name": "oval:org.mitre.oval:def:10231",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10231"
        },
        {
          "name": "35193",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35193"
        },
        {
          "name": "MDVSA-2010:176",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:176"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "name": "42368",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42368"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-6.html"
        },
        {
          "name": "20090603 [SECURITY] CVE-2009-0033 Apache Tomcat DoS when using Java AJP connector",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/504044/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT4077"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?rev=742915\u0026view=rev"
        },
        {
          "name": "FEDORA-2009-11374",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?rev=781362\u0026view=rev"
        },
        {
          "name": "35685",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35685"
        },
        {
          "name": "SSRT100825",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
        },
        {
          "name": "FEDORA-2009-11352",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-5.html"
        },
        {
          "name": "oval:org.mitre.oval:def:19110",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19110"
        },
        {
          "name": "SUSE-SR:2009:012",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html"
        },
        {
          "name": "HPSBUX02579",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
        },
        {
          "name": "SSRT101146",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
        },
        {
          "name": "MDVSA-2009:136",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136"
        },
        {
          "name": "263529",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1"
        },
        {
          "name": "SSRT100203",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
        },
        {
          "name": "tomcat-ajp-dos(50928)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50928"
        },
        {
          "name": "ADV-2009-3316",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3316"
        },
        {
          "name": "oval:org.mitre.oval:def:5739",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5739"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-0033",
    "datePublished": "2009-06-05T15:25:00",
    "dateReserved": "2008-12-15T00:00:00",
    "dateUpdated": "2024-08-07T04:17:10.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2009-0580

Vulnerability from cvelistv5

Published

2009-06-05 15:25

Modified

2024-08-07 04:40

Severity ?

Summary

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.

References

▼	URL	Tags
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9101	vdb-entry, signature, x_refsource_OVAL
	http://tomcat.apache.org/security-4.html	x_refsource_CONFIRM
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18915	vdb-entry, signature, x_refsource_OVAL
	http://marc.info/?l=bugtraq&m=127420533226623&w=2	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/35326	third-party-advisory, x_refsource_SECUNIA
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:138	vendor-advisory, x_refsource_MANDRIVA
	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html	vendor-advisory, x_refsource_FEDORA
	http://www.debian.org/security/2011/dsa-2207	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/bid/35196	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/35344	third-party-advisory, x_refsource_SECUNIA
	http://marc.info/?l=bugtraq&m=136485229118404&w=2	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/37460	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2010/3056	vdb-entry, x_refsource_VUPEN
	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	x_refsource_CONFIRM
	http://secunia.com/advisories/35788	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/archive/1/504125/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://marc.info/?l=bugtraq&m=127420533226623&w=2	vendor-advisory, x_refsource_HP
	http://svn.apache.org/viewvc?rev=747840&view=rev	x_refsource_CONFIRM
	http://www.securityfocus.com/archive/1/504045/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html	vendor-advisory, x_refsource_APPLE
	http://www.vupen.com/english/advisories/2009/1496	vdb-entry, x_refsource_VUPEN
	http://marc.info/?l=bugtraq&m=133469267822771&w=2	vendor-advisory, x_refsource_HP
	http://www.securityfocus.com/archive/1/504108/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://svn.apache.org/viewvc?rev=781382&view=rev	x_refsource_CONFIRM
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6628	vdb-entry, signature, x_refsource_OVAL
	http://www.vupen.com/english/advisories/2009/1856	vdb-entry, x_refsource_VUPEN
	http://securitytracker.com/id?1022332	vdb-entry, x_refsource_SECTRACK
	http://www.mandriva.com/security/advisories?name=MDVSA-2010:176	vendor-advisory, x_refsource_MANDRIVA
	http://www.securityfocus.com/archive/1/507985/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://secunia.com/advisories/42368	third-party-advisory, x_refsource_SECUNIA
	http://tomcat.apache.org/security-6.html	x_refsource_CONFIRM
	http://support.apple.com/kb/HT4077	x_refsource_CONFIRM
	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html	vendor-advisory, x_refsource_FEDORA
	http://secunia.com/advisories/35685	third-party-advisory, x_refsource_SECUNIA
	http://marc.info/?l=bugtraq&m=133469267822771&w=2	vendor-advisory, x_refsource_HP
	https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html	vendor-advisory, x_refsource_FEDORA
	http://tomcat.apache.org/security-5.html	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html	vendor-advisory, x_refsource_SUSE
	http://marc.info/?l=bugtraq&m=129070310906557&w=2	vendor-advisory, x_refsource_HP
	https://exchange.xforce.ibmcloud.com/vulnerabilities/50930	vdb-entry, x_refsource_XF
	http://svn.apache.org/viewvc?rev=781379&view=rev	x_refsource_CONFIRM
	http://marc.info/?l=bugtraq&m=136485229118404&w=2	vendor-advisory, x_refsource_HP
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:136	vendor-advisory, x_refsource_MANDRIVA
	http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1	vendor-advisory, x_refsource_SUNALERT
	http://marc.info/?l=bugtraq&m=129070310906557&w=2	vendor-advisory, x_refsource_HP
	http://www.vupen.com/english/advisories/2009/3316	vdb-entry, x_refsource_VUPEN
	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:40:04.335Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "oval:org.mitre.oval:def:9101",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9101"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-4.html"
          },
          {
            "name": "oval:org.mitre.oval:def:18915",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18915"
          },
          {
            "name": "HPSBMA02535",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
          },
          {
            "name": "35326",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35326"
          },
          {
            "name": "MDVSA-2009:138",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:138"
          },
          {
            "name": "FEDORA-2009-11356",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html"
          },
          {
            "name": "DSA-2207",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2011/dsa-2207"
          },
          {
            "name": "35196",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35196"
          },
          {
            "name": "35344",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35344"
          },
          {
            "name": "HPSBUX02860",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
          },
          {
            "name": "37460",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37460"
          },
          {
            "name": "ADV-2010-3056",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/3056"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "35788",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35788"
          },
          {
            "name": "20090605 [SECURITY] CVE-2009-0580 UPDATED Apache Tomcat User enumeration vulnerability with FORM authentication",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/504125/100/0/threaded"
          },
          {
            "name": "SSRT100029",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?rev=747840\u0026view=rev"
          },
          {
            "name": "20090603 [SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/504045/100/0/threaded"
          },
          {
            "name": "APPLE-SA-2010-03-29-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
          },
          {
            "name": "ADV-2009-1496",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1496"
          },
          {
            "name": "HPSBOV02762",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
          },
          {
            "name": "20090604 Re: [SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/504108/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?rev=781382\u0026view=rev"
          },
          {
            "name": "oval:org.mitre.oval:def:6628",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6628"
          },
          {
            "name": "ADV-2009-1856",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1856"
          },
          {
            "name": "1022332",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1022332"
          },
          {
            "name": "MDVSA-2010:176",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:176"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "name": "42368",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42368"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-6.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT4077"
          },
          {
            "name": "FEDORA-2009-11374",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html"
          },
          {
            "name": "35685",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35685"
          },
          {
            "name": "SSRT100825",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
          },
          {
            "name": "FEDORA-2009-11352",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-5.html"
          },
          {
            "name": "SUSE-SR:2009:012",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html"
          },
          {
            "name": "HPSBUX02579",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
          },
          {
            "name": "tomcat-jsecuritycheck-info-disclosure(50930)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50930"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/viewvc?rev=781379\u0026view=rev"
          },
          {
            "name": "SSRT101146",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
          },
          {
            "name": "MDVSA-2009:136",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136"
          },
          {
            "name": "263529",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1"
          },
          {
            "name": "SSRT100203",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
          },
          {
            "name": "ADV-2009-3316",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3316"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-06-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T16:08:37",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "oval:org.mitre.oval:def:9101",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9101"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-4.html"
        },
        {
          "name": "oval:org.mitre.oval:def:18915",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18915"
        },
        {
          "name": "HPSBMA02535",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
        },
        {
          "name": "35326",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35326"
        },
        {
          "name": "MDVSA-2009:138",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:138"
        },
        {
          "name": "FEDORA-2009-11356",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html"
        },
        {
          "name": "DSA-2207",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2011/dsa-2207"
        },
        {
          "name": "35196",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35196"
        },
        {
          "name": "35344",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35344"
        },
        {
          "name": "HPSBUX02860",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
        },
        {
          "name": "37460",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37460"
        },
        {
          "name": "ADV-2010-3056",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/3056"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "35788",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35788"
        },
        {
          "name": "20090605 [SECURITY] CVE-2009-0580 UPDATED Apache Tomcat User enumeration vulnerability with FORM authentication",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/504125/100/0/threaded"
        },
        {
          "name": "SSRT100029",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=127420533226623\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?rev=747840\u0026view=rev"
        },
        {
          "name": "20090603 [SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/504045/100/0/threaded"
        },
        {
          "name": "APPLE-SA-2010-03-29-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
        },
        {
          "name": "ADV-2009-1496",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1496"
        },
        {
          "name": "HPSBOV02762",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
        },
        {
          "name": "20090604 Re: [SECURITY] CVE-2009-0580 Apache Tomcat User enumeration vulnerability with FORM authentication",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/504108/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?rev=781382\u0026view=rev"
        },
        {
          "name": "oval:org.mitre.oval:def:6628",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6628"
        },
        {
          "name": "ADV-2009-1856",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1856"
        },
        {
          "name": "1022332",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1022332"
        },
        {
          "name": "MDVSA-2010:176",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:176"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "name": "42368",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42368"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-6.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT4077"
        },
        {
          "name": "FEDORA-2009-11374",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01156.html"
        },
        {
          "name": "35685",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35685"
        },
        {
          "name": "SSRT100825",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=133469267822771\u0026w=2"
        },
        {
          "name": "FEDORA-2009-11352",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01216.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-5.html"
        },
        {
          "name": "SUSE-SR:2009:012",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html"
        },
        {
          "name": "HPSBUX02579",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
        },
        {
          "name": "tomcat-jsecuritycheck-info-disclosure(50930)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50930"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/viewvc?rev=781379\u0026view=rev"
        },
        {
          "name": "SSRT101146",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136485229118404\u0026w=2"
        },
        {
          "name": "MDVSA-2009:136",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136"
        },
        {
          "name": "263529",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-263529-1"
        },
        {
          "name": "SSRT100203",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=129070310906557\u0026w=2"
        },
        {
          "name": "ADV-2009-3316",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3316"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-0580",
    "datePublished": "2009-06-05T15:25:00",
    "dateReserved": "2009-02-13T00:00:00",
    "dateUpdated": "2024-08-07T04:40:04.335Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2009_1454

Vulnerability from csaf_redhat

cve-2009-0783

Vulnerability from cvelistv5

cve-2007-5333

Vulnerability from cvelistv5

cve-2008-5515

Vulnerability from cvelistv5

cve-2009-0033

Vulnerability from cvelistv5

cve-2009-0580

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature