As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 9.0.2, 8.5.24, 8.0.48, 7.0.84
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected.
Timeline
- CVE published
- Record last updated
Affected versions
- Apache Software Foundation Apache Tomcat
9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47, 7.0.79 to 7.0.82
- org.apache.tomcat:tomcatMaven
From 9.0.0.M22 · fixed in 9.0.2
- org.apache.tomcat:tomcatMaven
From 8.5.16 · fixed in 8.5.24
- org.apache.tomcat:tomcatMaven
From 8.0.45 · fixed in 8.0.48
- org.apache.tomcat:tomcatMaven
From 7.0.79 · fixed in 7.0.84
References 20
lists.apache.org
- thread.html/e1ef853fc0079cdb55befbd2dac042934e49288b476d5f6a649e5da2@<announce.tomcat.apache.org>
- thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@<dev.tomcat.apache.org>
- thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@<dev.tomcat.apache.org>
- thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@<dev.tomcat.apache.org>
- thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@<dev.tomcat.apache.org>
- thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@<dev.tomcat.apache.org>
- thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@<dev.tomcat.apache.org>
- thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@<dev.tomcat.apache.org>
- thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@<dev.tomcat.apache.org>
- thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@<dev.tomcat.apache.org>
- thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@<dev.tomcat.apache.org>
- thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@<dev.tomcat.apache.org>
- thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@<dev.tomcat.apache.org>
- thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@<dev.tomcat.apache.org>
- thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@<dev.tomcat.apache.org>
- thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@<dev.tomcat.apache.org>
- thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@<dev.tomcat.apache.org>