Homepage
About Snyk

org.apache.tomcat:tomcat@8.5.56 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat:tomcat package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Incomplete Cleanup

org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies.

Affected versions of this package are vulnerable to Incomplete Cleanup when recycling various internal objects. An error could cause some parts of the recycling process to be skipped, leading to information leaking from the current request/response to the next. An attacker can gain unauthorised access to sensitive information by exploiting this error.

How to fix Incomplete Cleanup?

Upgrade org.apache.tomcat:tomcat to version 8.5.94, 9.0.81, 10.1.14, 11.0.0-M12 or higher.

[8.5.0,8.5.94) [9.0.0-M1,9.0.81) [10.1.0-M1,10.1.14) [11.0.0-M1,11.0.0-M12)
  • M
Improper Input Validation

org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies.

Affected versions of this package are vulnerable to Improper Input Validation due to the improper handling of HTTP trailer headers. An attacker can manipulate the server into treating a single request as multiple requests by sending a specially crafted, invalid trailer header. This could lead to request smuggling when the server is behind a reverse proxy.

How to fix Improper Input Validation?

Upgrade org.apache.tomcat:tomcat to version 8.5.94, 9.0.81, 10.1.14, 11.0.0-M12 or higher.

[8.5.0,8.5.94) [9.0.0-M1,9.0.81) [10.1.0-M1,10.1.14) [11.0.0-M1,11.0.0-M12)
  • M
Access Restriction Bypass

org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies.

Affected versions of this package are vulnerable to Access Restriction Bypass. If the ROOT (default) web application is configured to use FORM authentication then it is possible that a specially crafted URL could be used to trigger a redirect to an URL of the attackers choice.

The vulnerability is limited to the ROOT (default) web application.

How to fix Access Restriction Bypass?

Upgrade org.apache.tomcat:tomcat to version 8.5.93, 9.0.80, 10.1.13, 11.0.0-M11 or higher.

[8.5.0,8.5.93) [9.0.0-M1,9.0.80) [10.1.0-M1,10.1.13) [11.0.0-M1,11.0.0-M11)
  • M
Cross-site Scripting (XSS)

org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The Form authentication example in the examples web application displayed user provided data without filtering, exposing a potential XSS vulnerability.

Note: This is a vulnerability in webapps/examples/jsp/security/protected/index.jsp file which is not used in any of the core Tomcat artifacts, and which therefore only affects users who did not remove the examples of web application as documented in the Tomcat security guide.

How to fix Cross-site Scripting (XSS)?

Upgrade org.apache.tomcat:tomcat to version 8.5.82, 9.0.65, 10.0.23, 10.1.0-M17 or higher.

[8.5.50,8.5.82) [9.0.30,9.0.65) [10.0.0-M1,10.0.23) [10.1.0-M1,10.1.0-M17)
  • H
Denial of Service (DoS)

org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies.

Affected versions of this package are vulnerable to Denial of Service (DoS). When Tomcat is configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially-crafted packet could be used to trigger an infinite loop resulting in a denial of service.

How to fix Denial of Service (DoS)?

Upgrade org.apache.tomcat:tomcat to version 10.0.4, 8.5.64, 9.0.44 or higher.

[10.0.0,10.0.4) [8.0.0,8.5.64) [9.0.0,9.0.44)
  • M
Improper Input Validation

org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies.

Affected versions of this package are vulnerable to Improper Input Validation. Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data (e.g., user names) as well as configuration data provided by an administrator. In limited circumstances it was possible for users to authenticate using variations of their user name and/or to bypass some of the protection provided by the LockOut Realm.

How to fix Improper Input Validation?

Upgrade org.apache.tomcat:tomcat to version 10.0.6, 9.0.46, 8.5.66, 7.0.109 or higher.

[10.0.0-M1,10.0.6) [9.0.0.M1,9.0.46) [8.5.0,8.5.66) [7.0.0,7.0.109)
  • M
HTTP Request Smuggling

org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies.

Affected versions of this package are vulnerable to HTTP Request Smuggling. Tomcat does not correctly parse the HTTP transfer-encoding request header in some circumstances, leading to the possibility of request smuggling when used with a reverse proxy.

Specifically, Tomcat incorrectly ignores the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; it honours the identify encoding; and it does not ensure that, if present, the chunked encoding was the final encoding.

How to fix HTTP Request Smuggling?

Upgrade org.apache.tomcat:tomcat to version 10.0.7, 9.0.48, 8.5.68 or higher.

[10.0.0-M1,10.0.7) [9.0.0.M1,9.0.48) [8.5.0,8.5.68)
Go back to all versions of this package