The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.(CVE-2018-8014)

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 8.5.0 to 8.5.30. (CVE-2018-1336)

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 8.5.0 to 8.5.31.(CVE-2018-8034)

A bug in the tracking of connection closures can lead to reuse of user sessions in a new connection. Versions Affected: Apache Tomcat 8.5.5 to 8.5.31.(CVE-2018-8037)

This update includes a rebase from 8.5.30 up to 8.5.32 which resolves two CVEs along with various other bugs/features :

  - rhbz#1579612 CVE-2018-8014 tomcat: Insecure defaults in     CORS filter enable 'supportsCredentials' for all origins

  - rhbz#1607586 CVE-2018-8034 tomcat: host name     verification missing in WebSocket client

  - rhbz#1607584 CVE-2018-8037 tomcat: Due to a mishandling     of close in NIO/NIO2 connectors user sessions can get     mixed up

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tomcat installed on the remote host is prior to 9.0.9. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.9_security-9 advisory.

  - The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31,     8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is     expected that users of the CORS filter will have configured it appropriately for their environment rather     than using it in the default configuration. Therefore, it is expected that most users will not be impacted     by this issue. (CVE-2018-8014)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2205 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure     of resources (CVE-2018-1304)

    * tomcat: Late application of security constraints can lead to resource exposure for unauthorised users     (CVE-2018-1305)

    * tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)

    * tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)

* tomcat: Late application of security constraints can lead to resource exposure for unauthorised users (CVE-2018-1305)

* tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)

* tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

According to the version of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The defaults settings for the CORS filter provided in     Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31,     8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and     enable 'supportsCredentials' for all origins. It is     expected that users of the CORS filter will have     configured it appropriately for their environment     rather than using it in the default configuration.
    Therefore, it is expected that most users will not be     impacted by this issue.(CVE-2018-8014)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.(CVE-2018-8014)

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86. (CVE-2018-1336)

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.(CVE-2018-8034)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2469 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache     Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 3.1 Service Pack 4 serves as a replacement for Red Hat JBoss Web     Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the     References.

    Security Fix(es):

    * tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)

    * tomcat-native: Mishandled OCSP invalid response (CVE-2018-8019)

    * tomcat-native: Mishandled OCSP responses can allow clients to authenticate with revoked certificates     (CVE-2018-8020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    The following packages have been upgraded to a newer upstream version:
    * OpenSSL (1.0.2n)
    * APR (1.6.3)

    CVE-2018-8019 and CVE-2018-8020 were discovered by Coty Sutherland (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31,     8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is     expected that users of the CORS filter will have configured it appropriately for their environment rather     than using it in the default configuration. Therefore, it is expected that most users will not be impacted     by this issue. (CVE-2018-8014)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tomcat installed on the remote host is prior to 7.0.89. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.89_security-7 advisory.

  - The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31,     8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is     expected that users of the CORS filter will have configured it appropriately for their environment rather     than using it in the default configuration. Therefore, it is expected that most users will not be impacted     by this issue. (CVE-2018-8014)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - tomcat: Incorrect handling of empty string URL in     security constraints can lead to unintended exposure of     resources (CVE-2018-1304)

  - tomcat: Late application of security constraints can     lead to resource exposure for unauthorised users     (CVE-2018-1305)

  - tomcat: Insecure defaults in CORS filter enable     'supportsCredentials' for all origins (CVE-2018-8014)

  - tomcat: Host name verification missing in WebSocket     client (CVE-2018-8034)

This update for tomcat to version 9.0.10 fixes the following issues :

Security issues fixed :

  - CVE-2018-1336: An improper handing of overflow in the     UTF-8 decoder with supplementary characters could have     lead to an infinite loop in the decoder causing a Denial     of Service (bsc#1102400).

  - CVE-2018-8014: Fix insecure default CORS filter settings     (bsc#1093697).

  - CVE-2018-8034: The host name verification when using TLS     with the WebSocket client was missing. It is now enabled     by default (bsc#1102379).

  - CVE-2018-8037: If an async request was completed by the     application at the same time as the container triggered     the async timeout, a race condition existed that could     have resulted in a user seeing a response intended for a     different user. An additional issue was present in the     NIO and NIO2 connectors that did not correctly track the     closure of the connection when an async request was     completed by the application and timed out by the     container at the same time. This could also have     resulted in a user seeing a response intended for     another user (bsc#1102410).

Bug fixes :

  - Avoid overwriting of customer's configuration during     update (bsc#1067720)

  - Disable adding OSGi metadata to JAR files

  - See changelog at     http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#T     omcat_9.0.10_(markt)

This update was imported from the SUSE:SLE-15:Update update project.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1529 advisory.

    - Resolves: rhbz#1658846 CVE-2018-8034 pki-servlet-container: tomcat: host name verification missing in     WebSocket client
    - Resolves: rhbz#1579614 CVE-2018-8014 pki-servlet-container: tomcat: Insecure defaults in CORS filter     enable 'supportsCredentials' for all origins
    - Resolves: rhbz#1619232 - CVE-2018-8037 pki-servlet-container: tomcat: Due to a mishandling of close in     NIO/NIO2 connectors user sessions can get mixed up
    - Resolves: rhbz#1641874 - CVE-2018-11784 pki-servlet-container: tomcat: Open redirect in default servlet

    velocity

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for tomcat to 8.0.53 fixes the following issues :

Security issue fixed :

  - CVE-2018-1336: An improper handing of overflow in the     UTF-8 decoder with supplementary characters could have     lead to an infinite loop in the decoder causing a Denial     of Service (bsc#1102400).

  - CVE-2018-8034: The host name verification when using TLS     with the WebSocket client was missing. It is now enabled     by default (bsc#1102379).

  - CVE-2018-8037: If an async request was completed by the     application at the same time as the container triggered     the async timeout, a race condition existed that could     have resulted in a user seeing a response intended for a     different user. An additional issue was present in the     NIO and NIO2 connectors that did not correctly track the     closure of the connection when an async request was     completed by the application and timed out by the     container at the same time. This could also have     resulted in a user seeing a response intended for     another user (bsc#1102410).

  - CVE-2018-8014: Fix insecure default CORS filter settings     (bsc#1093697).

Bug fixes :

  - bsc#1067720: Avoid overwriting of customer's     configuration during update.

  - bsc#1095472: Add Obsoletes for tomcat6 packages.

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The version of Tomcat installed on the remote host is prior to 8.5.32. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_8.5.32_security-8 advisory.

  - If an async request was completed by the application at the same time as the container triggered the async     timeout, a race condition existed that could result in a user seeing a response intended for a different     user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the     closure of the connection when an async request was completed by the application and timed out by the     container at the same time. This could also result in a user seeing a response intended for another user.
    Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31. (CVE-2018-8037)

  - The host name verification when using TLS with the WebSocket client was missing. It is now enabled by     default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and     7.0.35 to 7.0.88. (CVE-2018-8034)

  - The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31,     8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is     expected that users of the CORS filter will have configured it appropriately for their environment rather     than using it in the default configuration. Therefore, it is expected that most users will not be impacted     by this issue. (CVE-2018-8014)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 8.0.53. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_8.0.53_security-8 advisory.

  - The host name verification when using TLS with the WebSocket client was missing. It is now enabled by     default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and     7.0.35 to 7.0.88. (CVE-2018-8034)

  - The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31,     8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is     expected that users of the CORS filter will have configured it appropriately for their environment rather     than using it in the default configuration. Therefore, it is expected that most users will not be impacted     by this issue. (CVE-2018-8014)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the MySQL Enterprise Monitor running on the remote host is affected by the following vulnerabilities in its subcomponents:

  - Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when     alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results     are used with no namespace and in same time, its upper package have no or wildcard namespace and similar     to results, same possibility when using url tag which doesn't have value and action set and in same time,     its upper package have no or wildcard namespace. (CVE-2018-11776)

  - The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31,     8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It     is expected that users of the CORS filter will have configured it appropriately for their environment     rather than using it in the default configuration. Therefore, it is expected that most users will not be     impacted by this issue. (CVE-2018-8014)

  - Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an     authorization bypass when using method security. An unauthorized malicious user can gain unauthorized     access to methods that should be restricted. (CVE-2018-1258)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
111611	Amazon Linux AMI : tomcat8 (ALAS-2018-1056)	Nessus	Amazon Linux Local Security Checks	2018/8/10	2024/8/23	critical
120717	Fedora 28 : 1:tomcat (2018-b1832101b8)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/1	critical
111069	Apache Tomcat 9.0.0 < 9.0.9	Nessus	Web Servers	2018/7/24	2024/5/23	critical
127697	RHEL 7 : tomcat (RHSA-2019:2205)	Nessus	Red Hat Local Security Checks	2019/8/12	2024/11/6	critical
128376	CentOS 7 : tomcat (CESA-2019:2205)	Nessus	CentOS Local Security Checks	2019/8/30	2019/12/31	critical
111647	EulerOS 2.0 SP3 : tomcat (EulerOS-SA-2018-1227)	Nessus	Huawei Local Security Checks	2018/8/10	2024/8/22	critical
111610	Amazon Linux AMI : tomcat7 / tomcat80 (ALAS-2018-1055)	Nessus	Amazon Linux Local Security Checks	2018/8/10	2024/8/23	critical
111804	RHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 4 (RHSA-2018:2469)	Nessus	Red Hat Local Security Checks	2018/8/17	2025/4/29	critical
246942	Linux Distros Unpatched Vulnerability : CVE-2018-8014	Nessus	Misc.	2025/8/9	2025/8/9	critical
111066	Apache Tomcat 7.0.0 < 7.0.89	Nessus	Web Servers	2018/7/24	2024/5/23	critical
128266	Scientific Linux Security Update : tomcat on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	2019/8/27	2024/5/1	critical
111182	EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2018-1220)	Nessus	Huawei Local Security Checks	2018/7/20	2024/9/4	critical
117983	openSUSE Security Update : tomcat (openSUSE-2018-1129)	Nessus	SuSE Local Security Checks	2018/10/9	2024/7/31	critical
127594	Oracle Linux 8 : pki-deps:10.6 (ELSA-2019-1529)	Nessus	Oracle Linux Local Security Checks	2019/8/12	2024/11/1	critical
117526	openSUSE Security Update : tomcat (openSUSE-2018-1019)	Nessus	SuSE Local Security Checks	2018/9/17	2024/8/7	critical
111068	Apache Tomcat 8.5.5 < 8.5.32 multiple vulnerabilities	Nessus	Web Servers	2018/7/13	2024/5/23	critical
111067	Apache Tomcat 8.0.0.RC1 < 8.0.53 multiple vulnerabilities	Nessus	Web Servers	2018/7/13	2024/5/23	critical
138901	MySQL Enterprise Monitor 3.4.x < 3.4.10 / 4.x < 4.0.7 / 8.x < 8.0.3 Multiple Vulnerabilities (Oct 2018 CPU)	Nessus	CGI abuses	2020/7/24	2023/4/25	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical