CVE-2013-4590
Fixed in a distro release EPSS 9%
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Products: apache tomcat, debian_linux, oracle solaris
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat:tomcat | 6.0.39 |
| Maven | org.apache.tomcat:tomcat | 7.0.50 |
| Maven | org.apache.tomcat:tomcat | 8.0.0-RC10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 6.0 | tomcat6 | 6.0.41-2+squeeze5 |
| Debian 7 | tomcat6 | 6.0.45+dfsg-1~deb7u1 |
| Red Hat Enterprise Linux 6 | tomcat6 | 0:6.0.24-78.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-admin-webapps | 0:6.0.24-78.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-docs-webapp | 0:6.0.24-78.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-el-2.1-api | 0:6.0.24-78.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-javadoc | 0:6.0.24-78.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-jsp-2.1-api | 0:6.0.24-78.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-lib | 0:6.0.24-78.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-servlet-2.5-api | 0:6.0.24-78.el6_5 |
| Red Hat Enterprise Linux 6 | tomcat6-webapps | 0:6.0.24-78.el6_5 |
| Red Hat jboss enterprise web server 2 | antlr-eap6 | 0:2.7.7-17.redhat_4.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | antlr-eap6 | 0:2.7.7-17.redhat_4.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | apache-commons-collections-eap6 | 0:3.2.1-15.redhat_3.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | apache-commons-collections-eap6 | 0:3.2.1-15.redhat_3.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | apache-commons-collections-tomcat-eap6 | 0:3.2.1-15.redhat_3.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | apache-commons-collections-tomcat-eap6 | 0:3.2.1-15.redhat_3.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | apache-commons-daemon-eap6 | 1:1.0.15-5.redhat_1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | apache-commons-daemon-eap6 | 1:1.0.15-5.redhat_1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | apache-commons-daemon-jsvc-eap6 | 1:1.0.15-6.redhat_2.ep6.el6 |
| Red Hat jboss enterprise web server 2 | apache-commons-daemon-jsvc-eap6 | 1:1.0.15-6.redhat_2.ep6.el5 |
| Red Hat jboss enterprise web server 2 | apache-commons-daemon-jsvc-eap6-debuginfo | 1:1.0.15-6.redhat_2.ep6.el6 |
| Red Hat jboss enterprise web server 2 | apache-commons-logging-eap6 | 0:1.1.1-7.9_redhat_1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | apache-commons-logging-tomcat-eap6 | 0:1.1.1-7.9_redhat_1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | apache-commons-pool-eap6 | 0:1.6-7.redhat_6.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | apache-commons-pool-eap6 | 0:1.6-7.redhat_6.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | apache-commons-pool-tomcat-eap6 | 0:1.6-7.redhat_6.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | apache-commons-pool-tomcat-eap6 | 0:1.6-7.redhat_6.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | dom4j-eap6 | 0:1.6.1-20.redhat_6.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | dom4j-eap6 | 0:1.6.1-20.redhat_6.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | ecj3 | 1:3.7.2-9.redhat_3.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | ecj3 | 1:3.7.2-9.redhat_3.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | hibernate4-c3p0-eap6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | hibernate4-c3p0-eap6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | hibernate4-core-eap6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | hibernate4-core-eap6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | hibernate4-eap6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | hibernate4-eap6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | hibernate4-entitymanager-eap6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | hibernate4-entitymanager-eap6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | hibernate4-envers-eap6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | hibernate4-envers-eap6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | hibernate4-infinispan-eap6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | hibernate4-infinispan-eap6 | 0:4.2.14-3.SP1_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd | 0:2.2.26-35.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd | 0:2.2.26-35.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-debuginfo | 0:2.2.26-35.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-devel | 0:2.2.26-35.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd-devel | 0:2.2.26-35.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-manual | 0:2.2.26-35.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd-manual | 0:2.2.26-35.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-tools | 0:2.2.26-35.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-tools | 0:2.2.26-35.ep6.el5 |
| Red Hat jboss enterprise web server 2 | javassist-eap6 | 0:3.18.1-1.GA_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | javassist-eap6 | 0:3.18.1-1.GA_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | jboss-logging | 0:3.1.4-1.GA_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | jboss-logging | 0:3.1.4-1.GA_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | jboss-transaction-api_1.1_spec | 0:1.0.1-12.Final_redhat_2.2.ep6.el5 |
| Red Hat jboss enterprise web server 2 | jboss-transaction-api_1.1_spec | 0:1.0.1-12.Final_redhat_2.2.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_cluster | 0:1.2.9-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_cluster | 0:1.2.9-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_cluster-native | 0:1.2.9-3.Final_redhat_2.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_cluster-native | 0:1.2.9-3.Final_redhat_2.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_cluster-native-debuginfo | 0:1.2.9-3.Final_redhat_2.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_cluster-tomcat6 | 0:1.2.9-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_cluster-tomcat6 | 0:1.2.9-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_cluster-tomcat7 | 0:1.2.9-1.Final_redhat_1.1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_cluster-tomcat7 | 0:1.2.9-1.Final_redhat_1.1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_jk | 0:1.2.40-2.redhat_1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_jk | 0:1.2.40-2.redhat_1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_jk-ap22 | 0:1.2.40-2.redhat_1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_jk-ap22 | 0:1.2.40-2.redhat_1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_jk-debuginfo | 0:1.2.40-2.redhat_1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_jk-manual | 0:1.2.40-2.redhat_1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_jk-manual | 0:1.2.40-2.redhat_1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_rt | 0:2.4.1-6.GA.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_rt | 0:2.4.1-6.GA.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_rt-debuginfo | 0:2.4.1-6.GA.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_snmp | 0:2.4.1-13.GA.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_snmp | 0:2.4.1-13.GA.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_snmp-debuginfo | 0:2.4.1-13.GA.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_ssl | 1:2.2.26-35.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_ssl | 1:2.2.26-35.ep6.el5 |
| Red Hat jboss enterprise web server 2 | storeconfig-tc6 | 0:0.0.1-7.Alpha3_redhat_12.3.ep6.el6 |
| Red Hat jboss enterprise web server 2 | storeconfig-tc6 | 0:0.0.1-7.Alpha3_redhat_12.3.ep6.el5 |
| Red Hat jboss enterprise web server 2 | storeconfig-tc7 | 0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6 |
| Red Hat jboss enterprise web server 2 | storeconfig-tc7 | 0:0.0.1-7.Alpha3_redhat_12.5.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat-native | 0:1.1.30-2.redhat_1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat-native | 0:1.1.30-2.redhat_1.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat-native-debuginfo | 0:1.1.30-2.redhat_1.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6 | 0:6.0.41-5_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6 | 0:6.0.41-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-admin-webapps | 0:6.0.41-5_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-admin-webapps | 0:6.0.41-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-docs-webapp | 0:6.0.41-5_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-docs-webapp | 0:6.0.41-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-el-2.1-api | 0:6.0.41-5_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-el-2.1-api | 0:6.0.41-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-javadoc | 0:6.0.41-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-javadoc | 0:6.0.41-5_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-jsp-2.1-api | 0:6.0.41-5_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-jsp-2.1-api | 0:6.0.41-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-lib | 0:6.0.41-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-lib | 0:6.0.41-5_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-log4j | 0:6.0.41-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-log4j | 0:6.0.41-5_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-servlet-2.5-api | 0:6.0.41-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat6-servlet-2.5-api | 0:6.0.41-5_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-webapps | 0:6.0.41-5_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat6-webapps | 0:6.0.41-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7 | 0:7.0.54-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7 | 0:7.0.54-6_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-admin-webapps | 0:7.0.54-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-admin-webapps | 0:7.0.54-6_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-docs-webapp | 0:7.0.54-6_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-docs-webapp | 0:7.0.54-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-el-2.2-api | 0:7.0.54-6_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-el-2.2-api | 0:7.0.54-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-javadoc | 0:7.0.54-6_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-javadoc | 0:7.0.54-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-jsp-2.2-api | 0:7.0.54-6_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-jsp-2.2-api | 0:7.0.54-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-lib | 0:7.0.54-6_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-lib | 0:7.0.54-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-log4j | 0:7.0.54-6_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-log4j | 0:7.0.54-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-servlet-3.0-api | 0:7.0.54-6_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-servlet-3.0-api | 0:7.0.54-6_patch_02.ep6.el5 |
| Red Hat jboss enterprise web server 2 | tomcat7-webapps | 0:7.0.54-6_patch_02.ep6.el6 |
| Red Hat jboss enterprise web server 2 | tomcat7-webapps | 0:7.0.54-6_patch_02.ep6.el5 |