The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2469 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache     Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 3.1 Service Pack 4 serves as a replacement for Red Hat JBoss Web     Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the     References.

    Security Fix(es):

    * tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)

    * tomcat-native: Mishandled OCSP invalid response (CVE-2018-8019)

    * tomcat-native: Mishandled OCSP responses can allow clients to authenticate with revoked certificates     (CVE-2018-8020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    The following packages have been upgraded to a newer upstream version:
    * OpenSSL (1.0.2n)
    * APR (1.6.3)

    CVE-2018-8019 and CVE-2018-8020 were discovered by Coty Sutherland (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for tomcat to 8.0.53 fixes the following issues :

Security issue fixed :

  - CVE-2018-1336: An improper handing of overflow in the     UTF-8 decoder with supplementary characters could have     lead to an infinite loop in the decoder causing a Denial     of Service (bsc#1102400).

  - CVE-2018-8034: The host name verification when using TLS     with the WebSocket client was missing. It is now enabled     by default (bsc#1102379).

  - CVE-2018-8037: If an async request was completed by the     application at the same time as the container triggered     the async timeout, a race condition existed that could     have resulted in a user seeing a response intended for a     different user. An additional issue was present in the     NIO and NIO2 connectors that did not correctly track the     closure of the connection when an async request was     completed by the application and timed out by the     container at the same time. This could also have     resulted in a user seeing a response intended for     another user (bsc#1102410).

  - CVE-2018-8014: Fix insecure default CORS filter settings     (bsc#1093697).

Bug fixes :

  - bsc#1067720: Avoid overwriting of customer's     configuration during update.

  - bsc#1095472: Add Obsoletes for tomcat6 packages.

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update includes a rebase from 8.5.30 up to 8.5.32 which resolves two CVEs along with various other bugs/features :

  - rhbz#1579612 CVE-2018-8014 tomcat: Insecure defaults in     CORS filter enable 'supportsCredentials' for all origins

  - rhbz#1607586 CVE-2018-8034 tomcat: host name     verification missing in WebSocket client

  - rhbz#1607584 CVE-2018-8037 tomcat: Due to a mishandling     of close in NIO/NIO2 connectors user sessions can get     mixed up

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - tomcat: Incorrect handling of empty string URL in     security constraints can lead to unintended exposure of     resources (CVE-2018-1304)

  - tomcat: Late application of security constraints can     lead to resource exposure for unauthorised users     (CVE-2018-1305)

  - tomcat: Insecure defaults in CORS filter enable     'supportsCredentials' for all origins (CVE-2018-8014)

  - tomcat: Host name verification missing in WebSocket     client (CVE-2018-8034)

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)

* tomcat: Late application of security constraints can lead to resource exposure for unauthorised users (CVE-2018-1305)

* tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)

* tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1529 advisory.

  - tomcat: Open redirect in default servlet (CVE-2018-11784)

  - tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)

  - tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)

  - tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up     (CVE-2018-8037)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1529 advisory.

    - Resolves: rhbz#1658846 CVE-2018-8034 pki-servlet-container: tomcat: host name verification missing in     WebSocket client
    - Resolves: rhbz#1579614 CVE-2018-8014 pki-servlet-container: tomcat: Insecure defaults in CORS filter     enable 'supportsCredentials' for all origins
    - Resolves: rhbz#1619232 - CVE-2018-8037 pki-servlet-container: tomcat: Due to a mishandling of close in     NIO/NIO2 connectors user sessions can get mixed up
    - Resolves: rhbz#1641874 - CVE-2018-11784 pki-servlet-container: tomcat: Open redirect in default servlet

    velocity

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.10. It is, therefore, affected by multiple vulnerabilities:

 - A security misconfiguration vulnerability exists in Apache Tomcat prior to version 9.0.9 due to insecure default settings for the CORS filter (CVE-2018-8014).

 - A security misconfiguration vulnerability exists in Apache Tomcat prior to version 9.0.10. Hostname validation was not enabled by default when using TLS with the WebSocket client (CVE-2018-8034).

 - An information disclosure vulnerability exists in Apache Tomcat prior to version 9.0.10 due to a race condition. If an async request was completed by the application at the same time as the container triggered the async timeout, this could lead to a user being sent the response of another user. (CVE-2018-8037).

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.10. It is, therefore, affected by multiple vulnerabilities.

 - A security misconfiguration vulnerability exists in Apache Tomcat prior to version 9.0.9 due to insecure default settings for the CORS filter (CVE-2018-8014).

 - A security misconfiguration vulnerability exists in Apache Tomcat prior to version 9.0.10. Hostname validation was not enabled by default when using TLS with the WebSocket client (CVE-2018-8034).

 - An information disclosure vulnerability exists in Apache Tomcat prior to version 9.0.10 due to a race condition. If an async request was completed by the application at the same time as the container triggered the async timeout, this could lead to a user being sent the response of another user. (CVE-2018-8037)

The version of Apache Tomcat installed on the remote host is version 8.0.x prior to 8.0.53. It is, therefore, affected by multiple vulnerabilities:

 - The defaults settings for the CORS filter are insecure and enable supportsCredentials for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. (CVE-2018-8014)

 - A vulnerability exists that could allow a remote attacker to bypass security restrictions, caused by a missing host name verification when using TLS with the WebSocket client. An attacker could exploit this vulnerability to bypass security constraints to access restricted resources. (CVE-2018-8034)

The version of Apache Tomcat installed on the remote host is version 7.0.41 prior to 7.0.89. It is, therefore, affected by an improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service.

The version of Apache Tomcat installed on the remote host is version 8.5.x prior to 8.5.32. It is, therefore, affected by multiple vulnerabilities :

 - The defaults settings for the CORS filter are insecure and enable supportsCredentials for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. (CVE-2018-8014)
 - The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. (CVE-2018-8034)
 - If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. (CVE-2018-8037)

ID	Name	Product	Family	Published	Updated	Severity
111804	RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 4 (RHSA-2018:2469)	Nessus	Red Hat Local Security Checks	8/17/2018	4/29/2025	critical
117526	openSUSE Security Update : tomcat (openSUSE-2018-1019)	Nessus	SuSE Local Security Checks	9/17/2018	8/7/2024	critical
120717	Fedora 28 : 1:tomcat (2018-b1832101b8)	Nessus	Fedora Local Security Checks	1/3/2019	7/1/2024	critical
128266	Scientific Linux Security Update : tomcat on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	8/27/2019	5/1/2024	critical
128376	CentOS 7 : tomcat (CESA-2019:2205)	Nessus	CentOS Local Security Checks	8/30/2019	12/31/2019	critical
145683	CentOS 8 : pki-deps:10.6 (CESA-2019:1529)	Nessus	CentOS Local Security Checks	1/29/2021	2/8/2023	critical
127594	Oracle Linux 8 : pki-deps:10.6 (ELSA-2019-1529)	Nessus	Oracle Linux Local Security Checks	8/12/2019	11/1/2024	critical
700707	Apache Tomcat 9.0.x < 9.0.10 Security Misconfiguration	Nessus Network Monitor	Web Servers	5/13/2019	5/13/2019	critical
700708	Apache Tomcat 9.0.x < 9.0.10 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	5/13/2019	5/13/2019	critical
700689	Apache Tomcat 8.0.x < 8.0.53 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	5/13/2019	5/13/2019	critical
700679	Apache Tomcat 7.0.x < 7.0.89 DoS	Nessus Network Monitor	Web Servers	5/13/2019	5/13/2019	critical
700695	Apache Tomcat 8.5.x < 8.5.32 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	5/13/2019	5/13/2019	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical