{"id":"USN-6943-1","summary":"tomcat8, tomcat9 vulnerabilities","details":"It was discovered that Tomcat incorrectly handled certain uncommon\nPersistenceManager with FileStore configurations. A remote attacker could\npossibly use this issue to execute arbitrary code. This issue only affected\ntomcat8 for Ubuntu 18.04 LTS (CVE-2020-9484)\n\nIt was discovered that Tomcat incorrectly handled certain HTTP/2 connection\nrequests. A remote attacker could use this issue to obtain wrong responses\npossibly containing sensitive information. This issue only affected tomcat8\nfor Ubuntu 18.04 LTS (CVE-2021-25122)\n\nThomas Wozenilek discovered that Tomcat incorrectly handled certain TLS\npackets. A remote attacker could possibly use this issue to cause a denial\nof service. This issue only affected tomcat8 for Ubuntu 18.04 LTS\n(CVE-2021-41079)\n\nTrung Pham discovered that a race condition existed in Tomcat when handling\nsession files with FileStore. A remote attacker could possibly use this\nissue to execute arbitrary code. This issue affected tomcat8 for Ubuntu\n16.04 LTS and Ubuntu 18.04 LTS, and tomcat9 for Ubuntu 18.04 LTS and Ubuntu\n20.04 LTS (CVE-2022-23181)\n\nIt was discovered that Tomcat's documentation incorrectly stated that\nEncryptInterceptor provided availability protection when running over an\nuntrusted network. A remote attacker could possibly use this issue to cause\na denial of service even if EncryptInterceptor was being used. This issue\naffected tomcat8 for Ubuntu 18.04 LTS, and tomcat9 for Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS (CVE-2022-29885)\n","modified":"2026-02-10T04:44:43Z","published":"2024-08-01T20:25:09Z","related":["UBUNTU-CVE-2020-9484","UBUNTU-CVE-2021-25122","UBUNTU-CVE-2021-41079","UBUNTU-CVE-2022-23181","UBUNTU-CVE-2022-29885"],"upstream":["CVE-2020-9484","CVE-2021-25122","CVE-2021-41079","CVE-2022-23181","CVE-2022-29885","UBUNTU-CVE-2020-9484","UBUNTU-CVE-2021-25122","UBUNTU-CVE-2021-41079","UBUNTU-CVE-2022-23181","UBUNTU-CVE-2022-29885"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-6943-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2020-9484"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-25122"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-41079"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-23181"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-29885"}],"affected":[{"package":{"name":"tomcat8","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/tomcat8@8.0.32-1ubuntu1.13+esm1?arch=source&distro=esm-infra/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+esm1"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4","8.0.32-1ubuntu1.5","8.0.32-1ubuntu1.6","8.0.32-1ubuntu1.7","8.0.32-1ubuntu1.8","8.0.32-1ubuntu1.9","8.0.32-1ubuntu1.10","8.0.32-1ubuntu1.11","8.0.32-1ubuntu1.13"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro","binaries":[{"binary_name":"libservlet3.1-java","binary_version":"8.0.32-1ubuntu1.13+esm1"},{"binary_name":"libtomcat8-java","binary_version":"8.0.32-1ubuntu1.13+esm1"},{"binary_name":"tomcat8","binary_version":"8.0.32-1ubuntu1.13+esm1"},{"binary_name":"tomcat8-admin","binary_version":"8.0.32-1ubuntu1.13+esm1"},{"binary_name":"tomcat8-common","binary_version":"8.0.32-1ubuntu1.13+esm1"},{"binary_name":"tomcat8-docs","binary_version":"8.0.32-1ubuntu1.13+esm1"},{"binary_name":"tomcat8-examples","binary_version":"8.0.32-1ubuntu1.13+esm1"},{"binary_name":"tomcat8-user","binary_version":"8.0.32-1ubuntu1.13+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6943-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:16.04:LTS","cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"low"}],"id":"CVE-2022-23181"}]}}},{"package":{"name":"tomcat8","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/tomcat8@8.5.39-1ubuntu1~18.04.3+esm2?arch=source&distro=esm-apps/bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+esm2"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2","8.5.39-1ubuntu1~18.04.3","8.5.39-1ubuntu1~18.04.3+esm1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"libtomcat8-embed-java","binary_version":"8.5.39-1ubuntu1~18.04.3+esm2"},{"binary_name":"libtomcat8-java","binary_version":"8.5.39-1ubuntu1~18.04.3+esm2"},{"binary_name":"tomcat8","binary_version":"8.5.39-1ubuntu1~18.04.3+esm2"},{"binary_name":"tomcat8-admin","binary_version":"8.5.39-1ubuntu1~18.04.3+esm2"},{"binary_name":"tomcat8-common","binary_version":"8.5.39-1ubuntu1~18.04.3+esm2"},{"binary_name":"tomcat8-docs","binary_version":"8.5.39-1ubuntu1~18.04.3+esm2"},{"binary_name":"tomcat8-examples","binary_version":"8.5.39-1ubuntu1~18.04.3+esm2"},{"binary_name":"tomcat8-user","binary_version":"8.5.39-1ubuntu1~18.04.3+esm2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6943-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"low"}],"id":"CVE-2020-9484"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2021-25122"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2021-41079"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"low"}],"id":"CVE-2022-23181"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}],"id":"CVE-2022-29885"}]}}},{"package":{"name":"tomcat9","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/tomcat9@9.0.16-3ubuntu0.18.04.2+esm2?arch=source&distro=esm-apps/bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+esm2"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"libtomcat9-embed-java","binary_version":"9.0.16-3ubuntu0.18.04.2+esm2"},{"binary_name":"libtomcat9-java","binary_version":"9.0.16-3ubuntu0.18.04.2+esm2"},{"binary_name":"tomcat9","binary_version":"9.0.16-3ubuntu0.18.04.2+esm2"},{"binary_name":"tomcat9-admin","binary_version":"9.0.16-3ubuntu0.18.04.2+esm2"},{"binary_name":"tomcat9-common","binary_version":"9.0.16-3ubuntu0.18.04.2+esm2"},{"binary_name":"tomcat9-docs","binary_version":"9.0.16-3ubuntu0.18.04.2+esm2"},{"binary_name":"tomcat9-examples","binary_version":"9.0.16-3ubuntu0.18.04.2+esm2"},{"binary_name":"tomcat9-user","binary_version":"9.0.16-3ubuntu0.18.04.2+esm2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6943-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"low"}],"id":"CVE-2020-9484"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2021-25122"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2021-41079"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"low"}],"id":"CVE-2022-23181"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}],"id":"CVE-2022-29885"}]}}},{"package":{"name":"tomcat9","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/tomcat9@9.0.31-1ubuntu0.6?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.6"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"libtomcat9-embed-java","binary_version":"9.0.31-1ubuntu0.6"},{"binary_name":"libtomcat9-java","binary_version":"9.0.31-1ubuntu0.6"},{"binary_name":"tomcat9","binary_version":"9.0.31-1ubuntu0.6"},{"binary_name":"tomcat9-admin","binary_version":"9.0.31-1ubuntu0.6"},{"binary_name":"tomcat9-common","binary_version":"9.0.31-1ubuntu0.6"},{"binary_name":"tomcat9-docs","binary_version":"9.0.31-1ubuntu0.6"},{"binary_name":"tomcat9-examples","binary_version":"9.0.31-1ubuntu0.6"},{"binary_name":"tomcat9-user","binary_version":"9.0.31-1ubuntu0.6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6943-1.json","cves_map":{"ecosystem":"Ubuntu:20.04:LTS","cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"low"}],"id":"CVE-2022-23181"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}],"id":"CVE-2022-29885"}]}}},{"package":{"name":"tomcat9","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/tomcat9@9.0.58-1ubuntu0.1+esm2?arch=source&distro=esm-apps/jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.58-1ubuntu0.1+esm2"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"libtomcat9-embed-java","binary_version":"9.0.58-1ubuntu0.1+esm2"},{"binary_name":"libtomcat9-java","binary_version":"9.0.58-1ubuntu0.1+esm2"},{"binary_name":"tomcat9","binary_version":"9.0.58-1ubuntu0.1+esm2"},{"binary_name":"tomcat9-admin","binary_version":"9.0.58-1ubuntu0.1+esm2"},{"binary_name":"tomcat9-common","binary_version":"9.0.58-1ubuntu0.1+esm2"},{"binary_name":"tomcat9-docs","binary_version":"9.0.58-1ubuntu0.1+esm2"},{"binary_name":"tomcat9-examples","binary_version":"9.0.58-1ubuntu0.1+esm2"},{"binary_name":"tomcat9-user","binary_version":"9.0.58-1ubuntu0.1+esm2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6943-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:22.04:LTS","cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}],"id":"CVE-2022-29885"}]}}}],"schema_version":"1.7.3"}