CVE-2017-12616
Fixed in a distro release EPSS 70%
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat:tomcat-catalina | 7.0.81 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 7 | tomcat7 | 7.0.28-4+deb7u15 |
| Debian 8 | tomcat7 | 7.0.56-3+really7.0.88-1 |
| Red Hat jboss enterprise web server 3.1 | mod_cluster | 0:1.3.8-2.Final_redhat_2.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | mod_cluster | 0:1.3.8-2.Final_redhat_2.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | mod_cluster-tomcat7 | 0:1.3.8-2.Final_redhat_2.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | mod_cluster-tomcat7 | 0:1.3.8-2.Final_redhat_2.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | mod_cluster-tomcat8 | 0:1.3.8-2.Final_redhat_2.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | mod_cluster-tomcat8 | 0:1.3.8-2.Final_redhat_2.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native | 0:1.2.8-11.redhat_11.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native | 0:1.2.8-11.redhat_11.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native-debuginfo | 0:1.2.8-11.redhat_11.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native-debuginfo | 0:1.2.8-11.redhat_11.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-vault | 0:1.1.6-1.Final_redhat_1.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-vault | 0:1.1.6-1.Final_redhat_1.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-vault-tomcat7 | 0:1.1.6-1.Final_redhat_1.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-vault-tomcat7 | 0:1.1.6-1.Final_redhat_1.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-vault-tomcat8 | 0:1.1.6-1.Final_redhat_1.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-vault-tomcat8 | 0:1.1.6-1.Final_redhat_1.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7 | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7 | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-admin-webapps | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-admin-webapps | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-docs-webapp | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-docs-webapp | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-el-2.2-api | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-el-2.2-api | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-javadoc | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-javadoc | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsp-2.2-api | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsp-2.2-api | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsvc | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsvc | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-lib | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-lib | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-log4j | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-log4j | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-selinux | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-selinux | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-servlet-3.0-api | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-servlet-3.0-api | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-webapps | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-webapps | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8 | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8 | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-admin-webapps | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-admin-webapps | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-docs-webapp | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-docs-webapp | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-el-2.2-api | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-el-2.2-api | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-javadoc | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-javadoc | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsp-2.3-api | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsp-2.3-api | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsvc | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsvc | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-lib | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-lib | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-log4j | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-log4j | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-selinux | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-selinux | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-servlet-3.1-api | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-servlet-3.1-api | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-webapps | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-webapps | 0:8.0.36-29.ep7.el6 |
| SUSE Linux Enterprise Server 12-LTSS | tomcat | 7.0.82-7.16.1 |
| Ubuntu 14.04 LTS | tomcat7 | 7.0.52-1ubuntu0.14 |
| Ubuntu 16.04 LTS | tomcat8 | 8.0.32-1ubuntu1.6 |
| Ubuntu 18.04 LTS | tomcat8 | 8.5.30-1ubuntu1.2 |
| Ubuntu Pro 16.04 LTS | tomcat7 | 7.0.68-1ubuntu0.4+esm3 |
| Ubuntu Pro 18.04 LTS | tomcat7 | no fix |