An update of the apache package has been released.

The version of Tomcat installed on the remote host is prior to 10.0.0.M10. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.0.0-m10_security-10 advisory.

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

  - While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to     9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on     an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely     lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak     between requests. (CVE-2020-17527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When serving resources from a network location using     the NTFS file system, Apache Tomcat versions 10.0.0-M1     to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and     7.0.0 to 7.0.106 were susceptible to JSP source code     disclosure in some configurations. The root cause was     the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the     inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances.(CVE-2021-24122)

  - While investigating bug 64830 it was discovered that     Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to     9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request     header value from the previous stream received on an     HTTP/2 connection for the request associated with the     subsequent stream. While this would most likely lead to     an error and the closure of the HTTP/2 connection, it     is possible that information could leak between     requests.(CVE-2020-17527)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tomcat installed on the remote host is prior to 7.0.107. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.107_security-7 advisory.

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The fix for CVE-2020-9484 was incomplete. When using     Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41,     8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a     configuration edge case that was highly unlikely to be     used, the Tomcat instance was still vulnerable to     CVE-2020-9494. Note that both the previously published     prerequisites for CVE-2020-9484 and the previously     published mitigations for CVE-2020-9484 also apply to     this issue.(CVE-2021-25329)

  - When serving resources from a network location using     the NTFS file system, Apache Tomcat versions 10.0.0-M1     to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and     7.0.0 to 7.0.106 were susceptible to JSP source code     disclosure in some configurations. The root cause was     the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the     inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances.(CVE-2021-24122)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14705-1 advisory.

  - When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to     7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default     servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This     JSP could then be requested and any code it contained would be executed by the server. (CVE-2017-12617)

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

  - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to     9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be     used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published     prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to     this issue. (CVE-2021-25329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When serving resources from a network location using     the NTFS file system, Apache Tomcat versions 10.0.0-M1     to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and     7.0.0 to 7.0.106 were susceptible to JSP source code     disclosure in some configurations. The root cause was     the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the     inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances.(CVE-2021-24122)

  - The fix for CVE-2020-9484 was incomplete. When using     Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41,     8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a     configuration edge case that was highly unlikely to be     used, the Tomcat instance was still vulnerable to     CVE-2020-9494. Note that both the previously published     prerequisites for CVE-2020-9484 and the previously     published mitigations for CVE-2020-9484 also apply to     this issue.(CVE-2021-25329)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
148353	Photon OS 4.0: Apache PHSA-2021-4.0-0007	Nessus	PhotonOS Local Security Checks	2021/4/7	2025/8/22	high
150937	Apache Tomcat 10.0.0.M1 < 10.0.0.M10 multiple vulnerabilities	Nessus	Web Servers	2021/6/21	2025/3/13	high
145727	EulerOS 2.0 SP8 : tomcat (EulerOS-SA-2021-1175)	Nessus	Huawei Local Security Checks	2021/2/1	2024/1/25	high
148405	Apache Tomcat 7.0.0 < 7.0.107	Nessus	Web Servers	2021/4/9	2025/3/13	medium
149630	EulerOS 2.0 SP5 : tomcat (EulerOS-SA-2021-1915)	Nessus	Huawei Local Security Checks	2021/5/18	2024/1/1	high
150565	SUSE SLES11 Security Update : tomcat6 (SUSE-SU-2021:14705-1)	Nessus	SuSE Local Security Checks	2021/6/10	2023/1/17	high
153352	EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2021-2435)	Nessus	Huawei Local Security Checks	2021/9/14	2023/11/30	high

检测

插件搜索

high

high

high

medium

high

high

high