The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0472-1 advisory.

    Updated to Tomcat 9.0.85:

    - CVE-2023-45648: Improve trailer header parsing (bsc#1216118).
    - CVE-2023-42794: FileUpload: remove tmp files to avoid DoS on Windows (bsc#1216120).
    - CVE-2023-42795: Improve handling of failures during recycle() methods (bsc#1216119).
    - CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing (bsc#1217649)
    - CVE-2024-22029: Fixed escalation to root from tomcat user via %post script. (bsc#1219208)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0474 advisory.

    - Resolves: #2235370 CVE-2023-41080 tomcat: Open Redirect vulnerability in FORM authentication
    - Resolves: #2243749 CVE-2023-45648 tomcat: incorrectly parsed http trailer headers can cause request     smuggling
    - Resolves: #2243751 CVE-2023-42794 tomcat: FileUpload: DoS due to accumulation of temporary files on     Windows

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0474 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)

    * tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794)

    * tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)

    * tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0500 advisory.

    This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 9.2. It addresses 29 CVEs:
    CVE-2016-5425, CVE-2018-1304, CVE-2025-24813, CVE-2016-3092, CVE-2018-8034, and 24 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
190624	SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2024:0472-1)	Nessus	SuSE Local Security Checks	2024/2/17	2026/6/25	high
189515	Oracle Linux 9 : tomcat (ELSA-2024-0474)	Nessus	Oracle Linux Local Security Checks	2024/1/25	2025/9/9	medium
189586	RHEL 9 : tomcat (RHSA-2024:0474)	Nessus	Red Hat Local Security Checks	2024/1/25	2025/3/6	medium
355265	Rocky Linux 9.2 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ciqsa-2026_0500)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical

检测

插件搜索

high

medium

medium

critical