Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Tomcat on Red Hat may let attackers bypass security

published 2 years ago

Summary

Several Tomcat components packaged for Red Hat, including the core server and its admin and documentation web apps, contain a flaw that could let an attacker bypass normal access controls. This could allow unauthorized users to view or modify protected data. Apply the latest Red Hat update for Tomcat as soon as possible to close the gap.

What to do

Update redhat tomcat to version 1:9.0.87-1.el8_10.2.
Update redhat tomcat-admin-webapps to version 1:9.0.87-1.el8_10.2.
Update redhat tomcat-docs-webapp to version 1:9.0.87-1.el8_10.2.
Update redhat tomcat-el-3.0-api to version 1:9.0.87-1.el8_10.2.
Update redhat tomcat-jsp-2.3-api to version 1:9.0.87-1.el8_10.2.
Update redhat tomcat-lib to version 1:9.0.87-1.el8_10.2.
Update redhat tomcat-servlet-4.0-api to version 1:9.0.87-1.el8_10.2.
Update redhat tomcat-webapps to version 1:9.0.87-1.el8_10.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:8::appstream	redhat	tomcat	< 1:9.0.87-1.el8_10.2 Fix: upgrade to 1:9.0.87-1.el8_10.2
Red Hat:enterprise_linux:8::appstream	redhat	tomcat-admin-webapps	< 1:9.0.87-1.el8_10.2 Fix: upgrade to 1:9.0.87-1.el8_10.2
Red Hat:enterprise_linux:8::appstream	redhat	tomcat-docs-webapp	< 1:9.0.87-1.el8_10.2 Fix: upgrade to 1:9.0.87-1.el8_10.2
Red Hat:enterprise_linux:8::appstream	redhat	tomcat-el-3.0-api	< 1:9.0.87-1.el8_10.2 Fix: upgrade to 1:9.0.87-1.el8_10.2
Red Hat:enterprise_linux:8::appstream	redhat	tomcat-jsp-2.3-api	< 1:9.0.87-1.el8_10.2 Fix: upgrade to 1:9.0.87-1.el8_10.2
Red Hat:enterprise_linux:8::appstream	redhat	tomcat-lib	< 1:9.0.87-1.el8_10.2 Fix: upgrade to 1:9.0.87-1.el8_10.2
Red Hat:enterprise_linux:8::appstream	redhat	tomcat-servlet-4.0-api	< 1:9.0.87-1.el8_10.2 Fix: upgrade to 1:9.0.87-1.el8_10.2
Red Hat:enterprise_linux:8::appstream	redhat	tomcat-webapps	< 1:9.0.87-1.el8_10.2 Fix: upgrade to 1:9.0.87-1.el8_10.2

Original advisory text

Red Hat Security Advisory: tomcat security update

References

https://access.redhat.com/errata/RHSA-2024:5694 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2295651 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2314686 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5694.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-34750 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-34750 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-34750 Vendor Advisory
https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-38286 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-38286 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-38286 Vendor Advisory
https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published14 Sep 2024

Updated17 Sep 2026

First seen17 Sep 2026

Sources

RHSA-2024:5694 · OSV

Track software like this

Free during beta