Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Tomcat web server could let attackers run code

published 2 years ago

Summary

Red Hat's Tomcat, its admin console, documentation site, and related APIs are affected. A flaw could allow an unauthenticated attacker to execute commands on the server, potentially compromising data or services. Apply the latest Red Hat Tomcat update as soon as possible to close the risk.

What to do

Update redhat tomcat to version 1:9.0.87-1.el9_4.2.
Update redhat tomcat-admin-webapps to version 1:9.0.87-1.el9_4.2.
Update redhat tomcat-docs-webapp to version 1:9.0.87-1.el9_4.2.
Update redhat tomcat-el-3.0-api to version 1:9.0.87-1.el9_4.2.
Update redhat tomcat-jsp-2.3-api to version 1:9.0.87-1.el9_4.2.
Update redhat tomcat-lib to version 1:9.0.87-1.el9_4.2.
Update redhat tomcat-servlet-4.0-api to version 1:9.0.87-1.el9_4.2.
Update redhat tomcat-webapps to version 1:9.0.87-1.el9_4.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:9::appstream	redhat	tomcat	< 1:9.0.87-1.el9_4.2 Fix: upgrade to 1:9.0.87-1.el9_4.2
Red Hat:enterprise_linux:9::appstream	redhat	tomcat-admin-webapps	< 1:9.0.87-1.el9_4.2 Fix: upgrade to 1:9.0.87-1.el9_4.2
Red Hat:enterprise_linux:9::appstream	redhat	tomcat-docs-webapp	< 1:9.0.87-1.el9_4.2 Fix: upgrade to 1:9.0.87-1.el9_4.2
Red Hat:enterprise_linux:9::appstream	redhat	tomcat-el-3.0-api	< 1:9.0.87-1.el9_4.2 Fix: upgrade to 1:9.0.87-1.el9_4.2
Red Hat:enterprise_linux:9::appstream	redhat	tomcat-jsp-2.3-api	< 1:9.0.87-1.el9_4.2 Fix: upgrade to 1:9.0.87-1.el9_4.2
Red Hat:enterprise_linux:9::appstream	redhat	tomcat-lib	< 1:9.0.87-1.el9_4.2 Fix: upgrade to 1:9.0.87-1.el9_4.2
Red Hat:enterprise_linux:9::appstream	redhat	tomcat-servlet-4.0-api	< 1:9.0.87-1.el9_4.2 Fix: upgrade to 1:9.0.87-1.el9_4.2
Red Hat:enterprise_linux:9::appstream	redhat	tomcat-webapps	< 1:9.0.87-1.el9_4.2 Fix: upgrade to 1:9.0.87-1.el9_4.2

Original advisory text

Red Hat Security Advisory: tomcat security update

References

https://access.redhat.com/errata/RHSA-2024:5693 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2295651 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2314686 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5693.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-34750 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-34750 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-34750 Vendor Advisory
https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-38286 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-38286 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-38286 Vendor Advisory
https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published14 Sep 2024

Updated17 Sep 2026

First seen17 Sep 2026

Sources

RHSA-2024:5693 · OSV

Track software like this

Free during beta