CVE-2018-1305
Fixed in a distro release EPSS 14%
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.5 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.28 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 7.0.85 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 7 | tomcat7 | 7.0.28-4+deb7u18 |
| Debian 8 | tomcat7 | 7.0.56-3+really7.0.88-1 |
| Debian 8 | tomcat8 | 8.0.14-1+deb8u12 |
| Debian 9 | tomcat8 | 8.5.14-1+deb9u3 |
| Red Hat Enterprise Linux 7 | tomcat | 0:7.0.76-9.el7 |
| Red Hat Enterprise Linux 7 | tomcat-admin-webapps | 0:7.0.76-9.el7 |
| Red Hat Enterprise Linux 7 | tomcat-docs-webapp | 0:7.0.76-9.el7 |
| Red Hat Enterprise Linux 7 | tomcat-el-2.2-api | 0:7.0.76-9.el7 |
| Red Hat Enterprise Linux 7 | tomcat-javadoc | 0:7.0.76-9.el7 |
| Red Hat Enterprise Linux 7 | tomcat-jsp-2.2-api | 0:7.0.76-9.el7 |
| Red Hat Enterprise Linux 7 | tomcat-jsvc | 0:7.0.76-9.el7 |
| Red Hat Enterprise Linux 7 | tomcat-lib | 0:7.0.76-9.el7 |
| Red Hat Enterprise Linux 7 | tomcat-servlet-3.0-api | 0:7.0.76-9.el7 |
| Red Hat Enterprise Linux 7 | tomcat-webapps | 0:7.0.76-9.el7 |
| Red Hat jboss enterprise web server 3.1 | mod_cluster | 0:1.3.8-2.Final_redhat_2.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | mod_cluster | 0:1.3.8-2.Final_redhat_2.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | mod_cluster-tomcat7 | 0:1.3.8-2.Final_redhat_2.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | mod_cluster-tomcat7 | 0:1.3.8-2.Final_redhat_2.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | mod_cluster-tomcat8 | 0:1.3.8-2.Final_redhat_2.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | mod_cluster-tomcat8 | 0:1.3.8-2.Final_redhat_2.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native | 0:1.2.8-11.redhat_11.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native | 0:1.2.8-11.redhat_11.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native-debuginfo | 0:1.2.8-11.redhat_11.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native-debuginfo | 0:1.2.8-11.redhat_11.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-vault | 0:1.1.6-1.Final_redhat_1.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-vault | 0:1.1.6-1.Final_redhat_1.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-vault-tomcat7 | 0:1.1.6-1.Final_redhat_1.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-vault-tomcat7 | 0:1.1.6-1.Final_redhat_1.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-vault-tomcat8 | 0:1.1.6-1.Final_redhat_1.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-vault-tomcat8 | 0:1.1.6-1.Final_redhat_1.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7 | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7 | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-admin-webapps | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-admin-webapps | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-docs-webapp | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-docs-webapp | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-el-2.2-api | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-el-2.2-api | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-javadoc | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-javadoc | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsp-2.2-api | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsp-2.2-api | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsvc | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsvc | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-lib | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-lib | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-log4j | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-log4j | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-selinux | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-selinux | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-servlet-3.0-api | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-servlet-3.0-api | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-webapps | 0:7.0.70-25.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-webapps | 0:7.0.70-25.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8 | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8 | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-admin-webapps | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-admin-webapps | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-docs-webapp | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-docs-webapp | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-el-2.2-api | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-el-2.2-api | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-javadoc | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-javadoc | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsp-2.3-api | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsp-2.3-api | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsvc | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsvc | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-lib | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-lib | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-log4j | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-log4j | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-selinux | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-selinux | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-servlet-3.1-api | 0:8.0.36-29.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-servlet-3.1-api | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-webapps | 0:8.0.36-29.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-webapps | 0:8.0.36-29.ep7.el7 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | tomcat | 8.0.53-10.35.1 |
| SUSE Linux Enterprise Server 12 SP2 | tomcat | 8.0.50-29.8.2 |
| SUSE Linux Enterprise Server 12 SP3 | tomcat | 8.0.50-29.8.2 |
| SUSE Linux Enterprise Server 12-LTSS | tomcat | 7.0.90-7.23.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | tomcat | 8.0.50-29.8.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | tomcat | 8.0.53-10.35.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | tomcat | 8.0.50-29.8.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | tomcat | 8.0.50-29.8.2 |
| Ubuntu 14.04 LTS | tomcat7 | 7.0.52-1ubuntu0.14 |
| Ubuntu 16.04 LTS | tomcat8 | 8.0.32-1ubuntu1.6 |
| Ubuntu 18.04 LTS | tomcat8 | 8.5.30-1ubuntu1.2 |
| Ubuntu Pro 16.04 LTS | tomcat7 | no fix |