Описание
Incorrect object recycling and reuse vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96.
Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.
A flaw was found in Apache Tomcat. Pooled JavaServer Pages (JSP) tags are not released after use, which could cause the output of some tags not to escape as expected. This unescaped output could leave the application vulnerable to Cross-site scripting (XSS).
Отчет
Per the upstream advisory, this vulnerability is limited to Tomcat versions 9.0.96, 10.1.31, and 11.0.0. No Red Hat products are vulnerable to this flaw.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 7 | tomcat | Not affected | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/pki-servlet-engine | Not affected | ||
| Red Hat Enterprise Linux 8 | tomcat | Not affected | ||
| Red Hat Enterprise Linux 9 | pki-servlet-engine | Not affected | ||
| Red Hat Enterprise Linux 9 | tomcat | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.
Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.
Incorrect object recycling and reuse vulnerability in Apache Tomcat. ...
Уязвимость сервера приложений Apache Tomcat, связанная с недостаточно стойким шифрованием данных, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)
EPSS
5.4 Medium
CVSS3