CVE-2016-6796
CVE-2016-6796
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.
CVSS 7.5 · High · EPSS 8.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
apache tomcat
- Versions
- 9.0.0.M1 to 9.0.0.M9: Affected
- 8.5.0 to 8.5.4: Affected
- 8.0.0.RC1 to 8.0.36: Affected
- 7.0.0 to 7.0.70: Affected
- 6.0.0 to 6.0.45: Affected
No fix published
tomcat7 Ubuntu:14.04:LTS
- Versions
- 7.0.42-1
- 7.0.47-1
- 7.0.50-1
- 7.0.52-1
- 7.0.52-1ubuntu0.1
- 7.0.52-1ubuntu0.3
- 7.0.52-1ubuntu0.6
- 7.0.52-1ubuntu0.7
- Affected ranges
- ECOSYSTEM: < 7.0.52-1ubuntu0.8
Update to 7.0.52-1ubuntu0.8
tomcat6 Ubuntu:Pro:14.04:LTS
- Versions
- 6.0.37-1
- 6.0.39-1
- 6.0.39-1ubuntu0.1
- 6.0.39-1ubuntu0.1+esm1
- 6.0.39-1ubuntu0.1+esm2
- 6.0.39-1ubuntu0.1+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat6 Ubuntu:16.04:LTS
- Versions
- 6.0.41-4
- 6.0.45+dfsg-1
- Affected ranges
- ECOSYSTEM: < 6.0.45+dfsg-1ubuntu0.1
Update to 6.0.45+dfsg-1ubuntu0.1
tomcat7 Ubuntu:16.04:LTS
- Versions
- 7.0.64-1
- 7.0.68-1
- 7.0.68-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: < 7.0.68-1ubuntu0.3
Update to 7.0.68-1ubuntu0.3
tomcat8 Ubuntu:16.04:LTS
- Versions
- 8.0.26-1
- 8.0.28-1
- 8.0.30-1
- 8.0.32-1
- 8.0.32-1ubuntu1
- 8.0.32-1ubuntu1.1
- 8.0.32-1ubuntu1.2
- Affected ranges
- ECOSYSTEM: < 8.0.32-1ubuntu1.3
Update to 8.0.32-1ubuntu1.3
Original sources
- https://access.redhat.com/errata/RHSA-2017:1548
- https://lists.apache.org/thread.html/5a2105a56b2495ab70fa568f06925bd861f0d71ffab4fb38bb4fdc45%40%3Cannounce.tomcat.apache.org%3E
- https://access.redhat.com/errata/RHSA-2017:1549
- http://www.securityfocus.com/bid/93944
- https://access.redhat.com/errata/RHSA-2017:1552
- http://www.securitytracker.com/id/1038757
- http://www.securitytracker.com/id/1037141
- https://access.redhat.com/errata/RHSA-2017:2247
- http://rhn.redhat.com/errata/RHSA-2017-1551.html
- http://rhn.redhat.com/errata/RHSA-2017-0457.html
- https://access.redhat.com/errata/RHSA-2017:0455
- https://access.redhat.com/errata/RHSA-2017:1550
- http://www.debian.org/security/2016/dsa-3720
- https://access.redhat.com/errata/RHSA-2017:0456
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-6796