org.apache.tomcat:tomcat-util@8.0.3 vulnerabilities

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Arbitrary File Upload. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution (RCE).

Upgrade org.apache.tomcat:tomcat-util to version 9.0.31, 8.5.51, 7.0.100 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the UTF-8 decoder. When handling some special characters, the decoder may enter an infinite loop, thus denying service to other requests.

Upgrade org.apache.tomcat:tomcat-util to version 7.0.90, 8.0.52, 8.5.32, 9.0.10 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Arbitrary Code Execution. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

This is due to an incomplete fix for CVE-2017-12615.

Upgrade org.apache.tomcat:tomcat-util to version 7.0.82, 8.0.46, 8.5.22, 9.0.1 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Denial of Service (DoS). It allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.

Upgrade org.apache.tomcat:tomcat-util to version 7.0.70, 8.0.36, 8.5.3, 9.0.0.M7 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Information Exposure. The refactoring of the Connector code for 8.5.x onwards introduced a regression in the error handling of the send file code for the NIO HTTP connector. An error during send file processing resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body.

Upgrade org.apache.tomcat:tomcat-util to version 7.0.74, 8.5.9, 8.0.40, 9.0.0M15 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Information Exposure. It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

Upgrade org.apache.tomcat:tomcat-util to version 8.0.37, 8.5.5, 9.0.0.M10 or higher.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Directory Traversal. It allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

Upgrade org.apache.tomcat:tomcat-util to version 7.0.65, 8.0.27 or higher.

org.apache.tomcat:tomcat-util The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.

org.apache.tomcat:tomcat-util The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

org.apache.tomcat:tomcat-util Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Arbitrary File Read. Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

Upgrade org.apache.tomcat:tomcat-util to version 7.0.54, 8.0.6 or higher.