RHSA-2016:2599MediumCVSS 8.8

Red Hat Security Advisory: tomcat security, bug fix, and enhancement update

Published
November 3, 2016
Last Modified
October 14, 2026

🔗 CVE IDs covered (8)

CVE-2016-0714 →CVE-2016-0763 →CVE-2016-3092 →CVE-2014-0230 →CVE-2015-5174 →CVE-2015-5345 →CVE-2015-5351 →CVE-2016-0706 →

📋 Description

CVE-2014-0230 — tomcat: non-persistent DoS attack by feeding data by aborting an upload CVE-2015-5174 — tomcat: URL Normalization issue CVE-2015-5345 — tomcat: directory disclosure CVE-2015-5351 — tomcat: CSRF token leak CVE-2016-0706 — tomcat: security manager bypass via StatusManagerServlet CVE-2016-0714 — tomcat: Security Manager bypass via persistence mechanisms CVE-2016-0763 — tomcat: security manager bypass via setGlobalContext() CVE-2016-3092 — tomcat: Usage of vulnerable FileUpload package can result in denial of service

🎯 Affected products58

  • Red Hat Enterprise Linux Client (v. 7)
  • Red Hat Enterprise Linux Client Optional (v. 7)
  • Red Hat Enterprise Linux ComputeNode (v. 7)
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Enterprise Linux Server Optional (v. 7)
  • Red Hat Enterprise Linux Workstation (v. 7)
  • Red Hat Enterprise Linux Workstation Optional (v. 7)
  • tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)
  • tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)
  • tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • tomcat-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • tomcat-0:7.0.69-10.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)
  • tomcat-0:7.0.69-10.el7.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • tomcat-0:7.0.69-10.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)
  • tomcat-0:7.0.69-10.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)
  • tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)
  • tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • tomcat-admin-webapps-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • tomcat-docs-webapp-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)
  • tomcat-docs-webapp-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • tomcat-docs-webapp-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • tomcat-docs-webapp-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)
  • tomcat-el-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)
  • tomcat-el-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • tomcat-el-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server (v. 7)
  • tomcat-el-2.2-api-0:7.0.69-10.el7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • +28 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (24)