org.apache.tomcat:tomcat-util@7.0.25 vulnerabilities
-
latest version
11.0.1
-
latest non vulnerable version
-
first published
14 years ago
-
latest version published
17 days ago
-
licenses detected
- [0,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.tomcat:tomcat-util package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.| Vulnerability | Vulnerable Version |
|---|---|
org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Arbitrary File Upload. This is enabled by default with a default configuration port of How to fix Arbitrary File Upload? Upgrade |
[9.0.0,9.0.31)
[8.0.0,8.5.51)
[,7.0.100)
|
org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Denial of Service (DoS) via the UTF-8 decoder. When handling some special characters, the decoder may enter an infinite loop, thus denying service to other requests. How to fix Denial of Service (DoS)? Upgrade |
[,7.0.90)
[8.0.0,8.0.52)
[8.5.0,8.5.32)
[9.0.0,9.0.10)
|
org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Arbitrary Code Execution. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. This is due to an incomplete fix for CVE-2017-12615. How to fix Arbitrary Code Execution? Upgrade |
[,7.0.82)
[8,8.0.46)
[8.5,8.5.22)
[9.0.0.M1,9.0.1)
|
org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Denial of Service (DoS). It allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string. How to fix Denial of Service (DoS)? Upgrade |
[7.0.0,7.0.70)
[8.0,8.0.36)
[8.5.0,8.5.3)
[9-alpha,9.0.0.M7)
|
org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Arbitrary File Upload in certain situations involving outdated NOTE: This vulnerability has also been identified as: CVE-2013-4444 How to fix Arbitrary File Upload? Upgrade |
[7.0.0,7.0.40)
|
org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Arbitrary File Upload in certain situations involving outdated NOTE: This vulnerability has also been identified as: CVE-2013-2185 How to fix Arbitrary File Upload? Upgrade |
[7.0.0,7.0.40)
|
org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Information Exposure. The refactoring of the Connector code for 8.5.x onwards introduced a regression in the error handling of the send file code for the NIO HTTP connector. An error during send file processing resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. How to fix Information Exposure? Upgrade |
[7,7.0.74)
[8.5.0,8.5.9)
[8.0.0RC1,8.0.40)
[9.0.0M1,9.0.0M15)
|
org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Directory Traversal. It allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. How to fix Directory Traversal? Upgrade |
[7.0.0,7.0.65)
[8,8.0.27)
|
|
[7.0.0,7.0.68)
[8,8.0.31)
[9-alpha,9.0.0.M2)
|
|
[7.0.0,7.0.68)
[8,8.0.30)
[9-alpha,9.0.0.M2)
|
|
[7.0.0,7.0.53)
[8,8.0.4)
|
org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Arbitrary File Read. Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application. How to fix Arbitrary File Read? Upgrade |
[7.0.0,7.0.54)
[8,8.0.6)
|