Описание
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | not-affected | 7.0.78-1 |
| cosmic | not-affected | |
| devel | DNE | |
| disco | DNE | |
| eoan | DNE | |
| esm-apps/bionic | not-affected | 7.0.78-1 |
| esm-apps/xenial | needed | |
| esm-infra-legacy/trusty | not-affected | 7.0.52-1ubuntu0.15 |
| esm-infra/focal | DNE | |
| focal | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 8.5.39-1ubuntu1~18.04.1 |
| cosmic | not-affected | 8.5.32-1ubuntu2 |
| devel | DNE | |
| disco | DNE | |
| eoan | DNE | |
| esm-apps/bionic | released | 8.5.39-1ubuntu1~18.04.1 |
| esm-infra-legacy/trusty | DNE | |
| esm-infra/focal | DNE | |
| esm-infra/xenial | not-affected | 8.0.32-1ubuntu1.7 |
| focal | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| cosmic | DNE | |
| devel | DNE | |
| disco | DNE | |
| eoan | DNE | |
| esm-infra-legacy/trusty | DNE | |
| esm-infra/focal | DNE | |
| focal | DNE | |
| groovy | DNE | |
| hirsute | DNE |
Показывать по
EPSS
5 Medium
CVSS2
7.5 High
CVSS3
Связанные уязвимости
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
The host name verification when using TLS with the WebSocket client wa ...
The host name verification missing in Apache Tomcat
Уязвимость компонента WebSocket client сервера приложений Apache Tomcat, связанная с ошибками при проверке имен хостов при использовании протокола Transport Layer Security (TLS), позволяющая нарушителю обойти существующие ограничения безопасности
EPSS
5 Medium
CVSS2
7.5 High
CVSS3