#Tomcat 7 vulnerabilities update
#Tomcat 7 vulnerabilities code

Third Party Advisory VDB Entry Vendor AdvisoryĬVE Modified by Red Hat, Inc. Third Party Advisory US Government Resource Please address comments about this page to Party Advisory Further, NIST does notĮndorse any commercial products that may be mentioned on Not necessarily endorse the views expressed, or concur with Sites that are more appropriate for your purpose. Inferences should be drawn on account of other sites being May have information that would be of interest to you. We have provided these links to other web sites because they

#Tomcat 7 vulnerabilities update

We will consider updating our tomcat implementation in a future ePO 5.10 Cumulative Update (CU) release.References to Advisories, Solutions, and Toolsīy selecting these links, you will be leaving NIST webspace. Though ePO is not affected with the above CVEs, it still consumes the vulnerable Tomcat binary. But, ePO is not affected by this CVE, because the HTTP/2 connections ( h2c connections) are not used and not enabled by default. With the ePO 5.10 Update 10 release, we upgraded Tomcat to version 9.x. This CVE affects only Tomcat versions 8.x and later. Supported ePO versions before 5.10 Update 10 use Tomcat 7.x, and is not applicable. As stated above, ePO was not affected to CVE-2020-9484, and hence does not effect ePO. This CVE is resolving a previously made incomplete fix for CVE-2020-9484. The ePO engineering team has reviewed these CVEs and determined the following:ĮPO by default does not use, or configure the Persistence Manager Tomcat function and hence ePO is not affected. When responding to new h2c connection requests, the Apache Tomcat could duplicate request headers. User A and user B could both see the results of user A's request. When using a highly unlikely configuration edge case, the Tomcat instance was still vulnerable to CVE-2020-9484. The fix for CVE-2020-9484 was incomplete. The attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over.The PersistenceManager is configured with the sessionAttributeValueClassNameFilter='null' (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized and.

The attacker can control the contents and name of a file on the server and the server is configured to use the PersistenceManager with a FileStore and.

#Tomcat 7 vulnerabilities code

If all conditions below are true, the attacker can use a crafted request to trigger remote code execution through deserialization of the file under their control: CVE-2020-9484 (High: Remote Code Execution via session persistence).The Tomcat vulnerabilities are referenced in the Tomcat Security Advisories published below: This document addresses concerns about ePolicy Orchestrator (ePO) and the Tomcat vulnerabilities documented in CVE-2020-9484, CVE-2021-25329, and CVE-2021-25122. This document describes McAfee Sustaining’s position relative to the support of a McAfee branded application. McAfee Sustaining Statement: SSC2103251.