CVE-2019-17563
Fixed in a distro release EPSS 11%
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 7.0.99 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.50 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.30 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | spark-3.5.0-compat | 3.5.0-r2 |
| Debian 10 | tomcat9 | 9.0.31-1~deb10u1 |
| Debian 12 | tomcat9 | 9.0.31-1 |
| Debian 13 | tomcat9 | 9.0.31-1 |
| Debian 14 | tomcat9 | 9.0.31-1 |
| Debian 8 | tomcat7 | 7.0.56-3+really7.0.99-1 |
| Debian 8 | tomcat8 | 8.0.14-1+deb8u17 |
| Debian 9 | tomcat8 | 8.5.50-0+deb9u1 |
| Red Hat Enterprise Linux 7 | tomcat | 0:7.0.76-15.el7 |
| Red Hat Enterprise Linux 7 | tomcat-admin-webapps | 0:7.0.76-15.el7 |
| Red Hat Enterprise Linux 7 | tomcat-docs-webapp | 0:7.0.76-15.el7 |
| Red Hat Enterprise Linux 7 | tomcat-el-2.2-api | 0:7.0.76-15.el7 |
| Red Hat Enterprise Linux 7 | tomcat-javadoc | 0:7.0.76-15.el7 |
| Red Hat Enterprise Linux 7 | tomcat-jsp-2.2-api | 0:7.0.76-15.el7 |
| Red Hat Enterprise Linux 7 | tomcat-jsvc | 0:7.0.76-15.el7 |
| Red Hat Enterprise Linux 7 | tomcat-lib | 0:7.0.76-15.el7 |
| Red Hat Enterprise Linux 7 | tomcat-servlet-3.0-api | 0:7.0.76-15.el7 |
| Red Hat Enterprise Linux 7 | tomcat-webapps | 0:7.0.76-15.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native | 0:1.2.23-21.redhat_21.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native | 0:1.2.23-21.redhat_21.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native-debuginfo | 0:1.2.23-21.redhat_21.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat-native-debuginfo | 0:1.2.23-21.redhat_21.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7 | 0:7.0.70-38.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7 | 0:7.0.70-38.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-admin-webapps | 0:7.0.70-38.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-admin-webapps | 0:7.0.70-38.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-docs-webapp | 0:7.0.70-38.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-docs-webapp | 0:7.0.70-38.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-el-2.2-api | 0:7.0.70-38.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-el-2.2-api | 0:7.0.70-38.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-javadoc | 0:7.0.70-38.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-javadoc | 0:7.0.70-38.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsp-2.2-api | 0:7.0.70-38.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsp-2.2-api | 0:7.0.70-38.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsvc | 0:7.0.70-38.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-jsvc | 0:7.0.70-38.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-lib | 0:7.0.70-38.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-lib | 0:7.0.70-38.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-log4j | 0:7.0.70-38.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-log4j | 0:7.0.70-38.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-selinux | 0:7.0.70-38.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-selinux | 0:7.0.70-38.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-servlet-3.0-api | 0:7.0.70-38.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-servlet-3.0-api | 0:7.0.70-38.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-webapps | 0:7.0.70-38.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat7-webapps | 0:7.0.70-38.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8 | 0:8.0.36-42.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8 | 0:8.0.36-42.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-admin-webapps | 0:8.0.36-42.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-admin-webapps | 0:8.0.36-42.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-docs-webapp | 0:8.0.36-42.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-docs-webapp | 0:8.0.36-42.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-el-2.2-api | 0:8.0.36-42.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-el-2.2-api | 0:8.0.36-42.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-javadoc | 0:8.0.36-42.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-javadoc | 0:8.0.36-42.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsp-2.3-api | 0:8.0.36-42.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsp-2.3-api | 0:8.0.36-42.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsvc | 0:8.0.36-42.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-jsvc | 0:8.0.36-42.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-lib | 0:8.0.36-42.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-lib | 0:8.0.36-42.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-log4j | 0:8.0.36-42.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-log4j | 0:8.0.36-42.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-selinux | 0:8.0.36-42.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-selinux | 0:8.0.36-42.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-servlet-3.1-api | 0:8.0.36-42.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-servlet-3.1-api | 0:8.0.36-42.ep7.el6 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-webapps | 0:8.0.36-42.ep7.el7 |
| Red Hat jboss enterprise web server 3.1 | tomcat8-webapps | 0:8.0.36-42.ep7.el6 |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat | 0:9.0.30-3.redhat_4.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat | 0:9.0.30-3.redhat_4.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat | 0:9.0.30-3.redhat_4.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-admin-webapps | 0:9.0.30-3.redhat_4.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-admin-webapps | 0:9.0.30-3.redhat_4.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-admin-webapps | 0:9.0.30-3.redhat_4.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-docs-webapp | 0:9.0.30-3.redhat_4.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-docs-webapp | 0:9.0.30-3.redhat_4.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-docs-webapp | 0:9.0.30-3.redhat_4.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-el-3.0-api | 0:9.0.30-3.redhat_4.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-el-3.0-api | 0:9.0.30-3.redhat_4.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-el-3.0-api | 0:9.0.30-3.redhat_4.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-javadoc | 0:9.0.30-3.redhat_4.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-javadoc | 0:9.0.30-3.redhat_4.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-javadoc | 0:9.0.30-3.redhat_4.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-jsp-2.3-api | 0:9.0.30-3.redhat_4.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-jsp-2.3-api | 0:9.0.30-3.redhat_4.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-jsp-2.3-api | 0:9.0.30-3.redhat_4.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-lib | 0:9.0.30-3.redhat_4.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-lib | 0:9.0.30-3.redhat_4.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-lib | 0:9.0.30-3.redhat_4.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-native | 0:1.2.23-4.redhat_4.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-native | 0:1.2.23-4.redhat_4.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-native | 0:1.2.23-4.redhat_4.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-native-debuginfo | 0:1.2.23-4.redhat_4.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-native-debuginfo | 0:1.2.23-4.redhat_4.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-native-debuginfo | 0:1.2.23-4.redhat_4.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-selinux | 0:9.0.30-3.redhat_4.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-selinux | 0:9.0.30-3.redhat_4.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-selinux | 0:9.0.30-3.redhat_4.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-servlet-4.0-api | 0:9.0.30-3.redhat_4.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-servlet-4.0-api | 0:9.0.30-3.redhat_4.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-servlet-4.0-api | 0:9.0.30-3.redhat_4.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-webapps | 0:9.0.30-3.redhat_4.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-webapps | 0:9.0.30-3.redhat_4.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-webapps | 0:9.0.30-3.redhat_4.1.el7jws |
| Red Hat rhel eus 7.6 | tomcat | 0:7.0.76-11.el7_6 |
| Red Hat rhel eus 7.6 | tomcat-admin-webapps | 0:7.0.76-11.el7_6 |
| Red Hat rhel eus 7.6 | tomcat-docs-webapp | 0:7.0.76-11.el7_6 |
| Red Hat rhel eus 7.6 | tomcat-el-2.2-api | 0:7.0.76-11.el7_6 |
| Red Hat rhel eus 7.6 | tomcat-javadoc | 0:7.0.76-11.el7_6 |
| Red Hat rhel eus 7.6 | tomcat-jsp-2.2-api | 0:7.0.76-11.el7_6 |
| Red Hat rhel eus 7.6 | tomcat-jsvc | 0:7.0.76-11.el7_6 |
| Red Hat rhel eus 7.6 | tomcat-lib | 0:7.0.76-11.el7_6 |
| Red Hat rhel eus 7.6 | tomcat-servlet-3.0-api | 0:7.0.76-11.el7_6 |
| Red Hat rhel eus 7.6 | tomcat-webapps | 0:7.0.76-11.el7_6 |
| Red Hat rhel eus 7.7 | tomcat | 0:7.0.76-12.el7_7 |
| Red Hat rhel eus 7.7 | tomcat-admin-webapps | 0:7.0.76-12.el7_7 |
| Red Hat rhel eus 7.7 | tomcat-docs-webapp | 0:7.0.76-12.el7_7 |
| Red Hat rhel eus 7.7 | tomcat-el-2.2-api | 0:7.0.76-12.el7_7 |
| Red Hat rhel eus 7.7 | tomcat-javadoc | 0:7.0.76-12.el7_7 |
| Red Hat rhel eus 7.7 | tomcat-jsp-2.2-api | 0:7.0.76-12.el7_7 |
| Red Hat rhel eus 7.7 | tomcat-jsvc | 0:7.0.76-12.el7_7 |
| Red Hat rhel eus 7.7 | tomcat-lib | 0:7.0.76-12.el7_7 |
| Red Hat rhel eus 7.7 | tomcat-servlet-3.0-api | 0:7.0.76-12.el7_7 |
| Red Hat rhel eus 7.7 | tomcat-webapps | 0:7.0.76-12.el7_7 |
| SUSE Enterprise Storage 5 | tomcat | 8.0.53-29.27.1 |
| SUSE HPE Helion OpenStack 8 | tomcat | 8.0.53-29.27.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 | tomcat | 9.0.30-3.34.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP1 | tomcat | 9.0.30-4.10.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | tomcat | 8.0.53-10.43.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | tomcat | 8.0.53-29.27.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | tomcat | 8.0.53-29.27.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | tomcat | 8.0.53-29.27.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | tomcat | 8.0.53-29.27.1 |
| SUSE Linux Enterprise Server 12 SP4 | tomcat | 9.0.31-3.25.1 |
| SUSE Linux Enterprise Server 12 SP5 | tomcat | 9.0.31-3.25.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | tomcat | 8.0.53-10.43.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | tomcat | 8.0.53-29.27.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | tomcat | 8.0.53-29.27.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | tomcat | 9.0.31-3.25.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | tomcat | 9.0.31-3.25.1 |
| SUSE OpenStack Cloud 7 | tomcat | 8.0.53-29.27.1 |
| SUSE OpenStack Cloud 8 | tomcat | 8.0.53-29.27.1 |
| SUSE OpenStack Cloud Crowbar 8 | tomcat | 8.0.53-29.27.1 |
| Ubuntu 16.04 LTS | tomcat8 | 8.0.32-1ubuntu1.11 |
| Ubuntu Pro 14.04 LTS | tomcat7 | no fix |
| Ubuntu Pro 16.04 LTS | tomcat7 | no fix |
| Ubuntu Pro 18.04 LTS | tomcat8 | no fix |
| Ubuntu Pro 18.04 LTS | tomcat9 | no fix |
| openSUSE Leap 15.1 | tomcat | 9.0.30-lp151.3.6.1 |
| openSUSE Tumbleweed | tomcat | 9.0.36-8.4 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 |