CVE-2013-4286
NoneCVSS
—
EPSS
16.2%
Published
Feb 26, 2014
CISA due date
—
The record
Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | 0 | 6.0.39 |
| Maven | org.apache.tomcat:tomcat | 7.0.0 | 7.0.47 |
| Maven | org.apache.tomcat:tomcat | 8.0.0-RC1 | 8.0.0-RC3 |
| Debian:6.0 | tomcat6 | 0 | 6.0.41-2+squeeze5 |
| Debian:7 | tomcat6 | 0 | 6.0.45+dfsg-1~deb7u1 |
| Debian:7 | tomcat7 | 0 | 7.0.28-4+deb7u1 |
| Mageia:3 | tomcat | 0 | 7.0.52-1.mga3 |
| Mageia:4 | tomcat | 0 | 7.0.52-1.mga4 |
| Red Hat:enterprise_linux:6::client | tomcat6 | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::client | tomcat6-admin-webapps | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::client | tomcat6-docs-webapp | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::client | tomcat6-el-2.1-api | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::client | tomcat6-javadoc | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::client | tomcat6-jsp-2.1-api | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::client | tomcat6-lib | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::client | tomcat6-servlet-2.5-api | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::client | tomcat6-webapps | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::computenode | tomcat6 | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-admin-webapps | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-docs-webapp | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-el-2.1-api | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-javadoc | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-jsp-2.1-api | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-lib | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-servlet-2.5-api | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-webapps | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::server | tomcat6 | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::server | tomcat6-admin-webapps | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::server | tomcat6-docs-webapp | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::server | tomcat6-el-2.1-api | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::server | tomcat6-javadoc | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::server | tomcat6-jsp-2.1-api | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::server | tomcat6-lib | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::server | tomcat6-servlet-2.5-api | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::server | tomcat6-webapps | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::workstation | tomcat6 | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-admin-webapps | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-docs-webapp | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-el-2.1-api | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-javadoc | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-jsp-2.1-api | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-lib | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-servlet-2.5-api | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-webapps | 0 | 0:6.0.24-64.el6_5 |
| Red Hat:enterprise_linux:7::client | tomcat | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::client | tomcat-admin-webapps | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::client | tomcat-docs-webapp | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::client | tomcat-el-2.2-api | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::client | tomcat-javadoc | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::client | tomcat-jsp-2.2-api | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::client | tomcat-jsvc | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::client | tomcat-lib | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::client | tomcat-servlet-3.0-api | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::client | tomcat-webapps | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::computenode | tomcat | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::computenode | tomcat-admin-webapps | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::computenode | tomcat-docs-webapp | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::computenode | tomcat-el-2.2-api | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::computenode | tomcat-javadoc | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::computenode | tomcat-jsp-2.2-api | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::computenode | tomcat-jsvc | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::computenode | tomcat-lib | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::computenode | tomcat-servlet-3.0-api | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::computenode | tomcat-webapps | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::server | tomcat | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::server | tomcat-admin-webapps | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::server | tomcat-docs-webapp | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::server | tomcat-el-2.2-api | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::server | tomcat-javadoc | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::server | tomcat-jsp-2.2-api | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::server | tomcat-jsvc | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::server | tomcat-lib | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::server | tomcat-servlet-3.0-api | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::server | tomcat-webapps | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::workstation | tomcat | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::workstation | tomcat-admin-webapps | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::workstation | tomcat-docs-webapp | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::workstation | tomcat-el-2.2-api | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::workstation | tomcat-javadoc | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::workstation | tomcat-jsp-2.2-api | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::workstation | tomcat-jsvc | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::workstation | tomcat-lib | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::workstation | tomcat-servlet-3.0-api | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:enterprise_linux:7::workstation | tomcat-webapps | 0 | 0:7.0.42-5.el7_0 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | apache-cxf | 0 | 0:2.7.10-1.redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | glassfish-jsf-eap6 | 0 | 0:2.1.27-6.redhat_8.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-common-api-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-common-impl-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-common-spi-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-core-api-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-core-impl-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-deployers-common-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-jdbc-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-spec-api-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | ironjacamar-validator-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-appclient | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-cli | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-client-all | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-clustering | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-cmp | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-configadmin | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-connector | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-controller | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-controller-client | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-core-security | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-deployment-repository | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-deployment-scanner | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-domain-http | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-domain-management | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-ee | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-ee-deployment | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-ejb3 | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-embedded | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-host-controller | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jacorb | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jaxr | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jaxrs | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jdr | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jmx | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jpa | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jsf | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-jsr77 | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-logging | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-mail | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-management-client-content | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-messaging | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-modcluster | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-naming | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-network | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-osgi | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-osgi-configadmin | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-osgi-service | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-platform-mbean | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-pojo | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-process-controller | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-protocol | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-remoting | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-sar | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-security | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-server | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-system-jmx | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-threads | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-transactions | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-version | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-web | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-webservices | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-weld | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-as-xts | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-ejb-client | 0 | 0:1.0.25-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-el-api_2.2_spec | 0 | 0:1.0.4-2.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-jsf-api_2.1_spec | 0 | 0:2.1.27-2.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-metadata | 0 | 0:7.0.9-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-metadata-appclient | 0 | 0:7.0.9-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-metadata-common | 0 | 0:7.0.9-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-metadata-ear | 0 | 0:7.0.9-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-metadata-ejb | 0 | 0:7.0.9-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-metadata-web | 0 | 0:7.0.9-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-modules | 0 | 0:1.3.3-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-remote-naming | 0 | 0:1.0.8-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-remoting3 | 0 | 0:3.2.19-1.GA_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jboss-security-negotiation | 0 | 0:2.2.7-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-core | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-javadocs | 0 | 0:7.3.2-2.1.Final_redhat_2.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-modules-eap | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossas-product-eap | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossweb | 0 | 0:7.3.1-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | jbossws-cxf | 0 | 0:4.2.4-1.Final_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | picketbox | 0 | 0:4.0.19-4.SP4_redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el5 | wss4j | 0 | 0:1.6.14-2.redhat_1.1.ep6.el5 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | apache-cxf | 0 | 0:2.7.10-1.redhat_1.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | glassfish-jsf-eap6 | 0 | 0:2.1.27-6.redhat_8.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-common-api-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-common-impl-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-common-spi-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-core-api-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-core-impl-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-deployers-common-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-jdbc-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-spec-api-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | ironjacamar-validator-eap6 | 0 | 0:1.0.23-5.Final_redhat_5.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-appclient | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-cli | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-client-all | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-clustering | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-cmp | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-configadmin | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-connector | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-controller | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-controller-client | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-core-security | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-deployment-repository | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-deployment-scanner | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-domain-http | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-domain-management | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-ee | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-ee-deployment | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-ejb3 | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
| Red Hat:jboss_enterprise_application_platform:6::el6 | jboss-as-embedded | 0 | 0:7.3.2-2.Final_redhat_2.1.ep6.el6 |
Related vulnerabilities
- CVE-2026-24733 Improper Input Validation vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-66614 Improper Input Validation vulnerability. Also affects org.apache.tomcat:tomcat
- GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal Also affects org.apache.tomcat:tomcat
- GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences Also affects org.apache.tomcat:tomcat
- CVE-2025-61795 Improper Resource Shutdown or Release vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-55752 Relative Path Traversal vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-55754 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache… Also affects org.apache.tomcat:tomcat
- CVE-2025-49124 Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. Also affects org.apache.tomcat:tomcat