org.apache.tomcat:tomcat-util@8.0.26 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat:tomcat-util package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Arbitrary File Upload

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Arbitrary File Upload. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution (RCE).

How to fix Arbitrary File Upload?

Upgrade org.apache.tomcat:tomcat-util to version 9.0.31, 8.5.51, 7.0.100 or higher.

[9.0.0,9.0.31) [8.0.0,8.5.51) [,7.0.100)
  • H
Denial of Service (DoS)

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the UTF-8 decoder. When handling some special characters, the decoder may enter an infinite loop, thus denying service to other requests.

How to fix Denial of Service (DoS)?

Upgrade org.apache.tomcat:tomcat-util to version 7.0.90, 8.0.52, 8.5.32, 9.0.10 or higher.

[,7.0.90) [8.0.0,8.0.52) [8.5.0,8.5.32) [9.0.0,9.0.10)
  • H
Arbitrary Code Execution

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Arbitrary Code Execution. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

This is due to an incomplete fix for CVE-2017-12615.

How to fix Arbitrary Code Execution?

Upgrade org.apache.tomcat:tomcat-util to version 7.0.82, 8.0.46, 8.5.22, 9.0.1 or higher.

[,7.0.82) [8,8.0.46) [8.5,8.5.22) [9.0.0.M1,9.0.1)
  • H
Denial of Service (DoS)

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Denial of Service (DoS). It allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

How to fix Denial of Service (DoS)?

Upgrade org.apache.tomcat:tomcat-util to version 7.0.70, 8.0.36, 8.5.3, 9.0.0.M7 or higher.

[7.0.0,7.0.70) [8.0,8.0.36) [8.5.0,8.5.3) [9-alpha,9.0.0.M7)
  • H
Information Exposure

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Information Exposure. The refactoring of the Connector code for 8.5.x onwards introduced a regression in the error handling of the send file code for the NIO HTTP connector. An error during send file processing resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body.

How to fix Information Exposure?

Upgrade org.apache.tomcat:tomcat-util to version 7.0.74, 8.5.9, 8.0.40, 9.0.0M15 or higher.

[7,7.0.74) [8.5.0,8.5.9) [8.0.0RC1,8.0.40) [9.0.0M1,9.0.0M15)
  • M
Information Exposure

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Information Exposure. It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

How to fix Information Exposure?

Upgrade org.apache.tomcat:tomcat-util to version 8.0.37, 8.5.5, 9.0.0.M10 or higher.

[8,8.0.37) [8.5.0,8.5.5) [9-alpha,9.0.0.M10)
  • M
Directory Traversal

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Directory Traversal. It allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

How to fix Directory Traversal?

Upgrade org.apache.tomcat:tomcat-util to version 7.0.65, 8.0.27 or higher.

[7.0.0,7.0.65) [8,8.0.27)
  • H
Access Restriction Bypass

org.apache.tomcat:tomcat-util The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.

[7.0.0,7.0.68) [8,8.0.31) [9-alpha,9.0.0.M2)
  • M
Directory Traversal

org.apache.tomcat:tomcat-util The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

[7.0.0,7.0.68) [8,8.0.30) [9-alpha,9.0.0.M2)