CVE-2018-1305: Medium severity Apache Tomcat vulnerability

Published Feb 23, 2018
·
Updated

Apache Tomcat versions 7.0.0 to 7.0.84, 8.0.0.RC1 to 8.0.49 and 8.5.0 to 8.5.27 only apply security constraints defined by Servlets once those Servlets are loaded. Depending on the order that Servlets load, some security constraints may not be applied leading to unintended resource exposure.

External References:

https://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.85 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.0.50 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.28

Upstream Fixes:

Tomcat 7.0.x:

http://svn.apache.org/viewvc?view=rev&rev=1823322 http://svn.apache.org/viewvc?view=rev&rev=1824360

Tomcat 8.0.x:

http://svn.apache.org/viewvc?view=rev&rev=1823319 http://svn.apache.org/viewvc?view=rev&rev=1824359

Tomcat 8.5.x:

http://svn.apache.org/viewvc?view=rev&rev=1823314 http://svn.apache.org/viewvc?view=rev&rev=1824358

Other sources

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.

Affected Software

93 affected componentsFixes available
redhat/tomcat<0:7.0.76-9.el7
0:7.0.76-9.el7
redhat/tomcat7<0:7.0.70-25.ep7.el6
0:7.0.70-25.ep7.el6
redhat/tomcat8<0:8.0.36-29.ep7.el6
0:8.0.36-29.ep7.el6
redhat/tomcat-native<0:1.2.8-11.redhat_11.ep7.el6
0:1.2.8-11.redhat_11.ep7.el6
redhat/tomcat-vault<0:1.1.6-1.Final_redhat_1.1.ep7.el6
0:1.1.6-1.Final_redhat_1.1.ep7.el6
redhat/tomcat7<0:7.0.70-25.ep7.el7
0:7.0.70-25.ep7.el7
redhat/tomcat8<0:8.0.36-29.ep7.el7
0:8.0.36-29.ep7.el7
redhat/tomcat-native<0:1.2.8-11.redhat_11.ep7.el7
0:1.2.8-11.redhat_11.ep7.el7
redhat/tomcat-vault<0:1.1.6-1.Final_redhat_1.1.ep7.el7
0:1.1.6-1.Final_redhat_1.1.ep7.el7
maven/org.apache.tomcat.embed:tomcat-embed-core>=9.0.0M1<=9.0.4
9.0.5
maven/org.apache.tomcat.embed:tomcat-embed-core>=7.0.0<=7.0.84
7.0.85
maven/org.apache.tomcat.embed:tomcat-embed-core>=8.5.0<=8.5.27
8.5.28
Apache Tomcat>=7.0.0<=7.0.84
Apache Tomcat>=8.0.0<=8.0.49
Apache Tomcat=8.0.0-rc1
Apache Tomcat=8.0.0-rc10
Apache Tomcat=8.0.0-rc3
Apache Tomcat=8.0.0-rc5
Apache Tomcat=9.0.0
Apache Tomcat=9.0.0-milestone1
Apache Tomcat=9.0.0-milestone10
Apache Tomcat=9.0.0-milestone11
Apache Tomcat=9.0.0-milestone12
Apache Tomcat=9.0.0-milestone13
Apache Tomcat=9.0.0-milestone14
Apache Tomcat=9.0.0-milestone15
Apache Tomcat=9.0.0-milestone16
Apache Tomcat=9.0.0-milestone17
Apache Tomcat=9.0.0-milestone18
Apache Tomcat=9.0.0-milestone19
Apache Tomcat=9.0.0-milestone2
Apache Tomcat=9.0.0-milestone20
Apache Tomcat=9.0.0-milestone21
Apache Tomcat=9.0.0-milestone22
Apache Tomcat=9.0.0-milestone23
Apache Tomcat=9.0.0-milestone24
Apache Tomcat=9.0.0-milestone25
Apache Tomcat=9.0.0-milestone26
Apache Tomcat=9.0.0-milestone27
Apache Tomcat=9.0.0-milestone3
Apache Tomcat=9.0.0-milestone4
Apache Tomcat=9.0.0-milestone5
Apache Tomcat=9.0.0-milestone6
Apache Tomcat=9.0.0-milestone7
Apache Tomcat=9.0.0-milestone8
Apache Tomcat=9.0.0-milestone9
Apache Tomcat=9.0.1
Apache Tomcat=9.0.2
Apache Tomcat=9.0.3
Apache Tomcat=9.0.4
Apache Tomcat>=8.5.0<=8.5.27
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=17.10
Canonical Ubuntu Linux=18.04
Oracle Fusion Middleware=12.2.1.3.0
Oracle Managed File Transfer=12.1.3.0.0
Oracle Managed File Transfer=12.2.1.3.0
Oracle Micros Relate Crm Software=11.4
Apache Tomcat=9.0.0-m1
Apache Tomcat=9.0.0-m10
Apache Tomcat=9.0.0-m11
Apache Tomcat=9.0.0-m12
Apache Tomcat=9.0.0-m13
Apache Tomcat=9.0.0-m14
Apache Tomcat=9.0.0-m15
Apache Tomcat=9.0.0-m16
Apache Tomcat=9.0.0-m17
Apache Tomcat=9.0.0-m18
Apache Tomcat=9.0.0-m19
Apache Tomcat=9.0.0-m2
Apache Tomcat=9.0.0-m20
Apache Tomcat=9.0.0-m21
Apache Tomcat=9.0.0-m22
Apache Tomcat=9.0.0-m23
Apache Tomcat=9.0.0-m24
Apache Tomcat=9.0.0-m25
Apache Tomcat=9.0.0-m26
Apache Tomcat=9.0.0-m27
Apache Tomcat=9.0.0-m3
Apache Tomcat=9.0.0-m4
Apache Tomcat=9.0.0-m5
Apache Tomcat=9.0.0-m6
Apache Tomcat=9.0.0-m7
Apache Tomcat=9.0.0-m8
Apache Tomcat=9.0.0-m9
redhat/tomcat<7.0.85
7.0.85
redhat/tomcat<8.0.50
8.0.50
redhat/tomcat<8.5.28
8.5.28
debian/tomcat9
9.0.43-2~deb11u109.0.118-0+deb11u19.0.70-29.0.95-19.0.118-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/tomcat to a version that resolves this vulnerability.

    Fixed in 0:7.0.76-9.el7
  2. Upgrade

    Upgrade redhat/tomcat7 to a version that resolves this vulnerability.

    Fixed in 0:7.0.70-25.ep7.el6
  3. Upgrade

    Upgrade redhat/tomcat8 to a version that resolves this vulnerability.

    Fixed in 0:8.0.36-29.ep7.el6
  4. Upgrade

    Upgrade redhat/tomcat-native to a version that resolves this vulnerability.

    Fixed in 0:1.2.8-11.redhat_11.ep7.el6
  5. Upgrade

    Upgrade redhat/tomcat-vault to a version that resolves this vulnerability.

    Fixed in 0:1.1.6-1.Final_redhat_1.1.ep7.el6
  6. Upgrade

    Upgrade redhat/tomcat7 to a version that resolves this vulnerability.

    Fixed in 0:7.0.70-25.ep7.el7
  7. Upgrade

    Upgrade redhat/tomcat8 to a version that resolves this vulnerability.

    Fixed in 0:8.0.36-29.ep7.el7
  8. Upgrade

    Upgrade redhat/tomcat-native to a version that resolves this vulnerability.

    Fixed in 0:1.2.8-11.redhat_11.ep7.el7
  9. Upgrade

    Upgrade redhat/tomcat-vault to a version that resolves this vulnerability.

    Fixed in 0:1.1.6-1.Final_redhat_1.1.ep7.el7
  10. Upgrade

    Upgrade maven/org.apache.tomcat.embed:tomcat-embed-core to a version that resolves this vulnerability.

    Fixed in 9.0.5
  11. Upgrade

    Upgrade maven/org.apache.tomcat.embed:tomcat-embed-core to a version that resolves this vulnerability.

    Fixed in 7.0.85
  12. Upgrade

    Upgrade maven/org.apache.tomcat.embed:tomcat-embed-core to a version that resolves this vulnerability.

    Fixed in 8.5.28
  13. Upgrade

    Upgrade redhat/tomcat to a version that resolves this vulnerability.

    Fixed in 7.0.85
  14. Upgrade

    Upgrade redhat/tomcat to a version that resolves this vulnerability.

    Fixed in 8.0.50
  15. Upgrade

    Upgrade redhat/tomcat to a version that resolves this vulnerability.

    Fixed in 8.5.28
  16. Upgrade

    Upgrade debian/tomcat9 to a version that resolves this vulnerability.

    Fixed in 9.0.43-2~deb11u10Fixed in 9.0.118-0+deb11u1Fixed in 9.0.70-2Fixed in 9.0.95-1Fixed in 9.0.118-1
  17. Upgrade

    Upgrade Apache Tomcat 7 to a version that resolves this vulnerability.

    Fixed in 7.0.85
  18. Upgrade

    Upgrade Apache Tomcat 8.0 to a version that resolves this vulnerability.

    Fixed in 8.0.50
  19. Upgrade

    Upgrade Apache Tomcat 8.5 to a version that resolves this vulnerability.

    Fixed in 8.5.28

Event History

Feb 23, 2018
CVE Published
12:00 AM
Data Sourced
via Red Hat·04:05 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
DescriptionWeakness
Data Sourced
via NVD·11:29 PM
RemedyDescriptionSeverityAffected Software
Oct 17, 2018
Advisory Published
via GitHub·04:31 PM
Aug 25, 2025
Data Sourced
via Ubuntu·12:06 AM
RemedyDescriptionSeverityAffected Software
Sep 22, 2025
Data Sourced
via Launchpad·12:10 AM
Description
Jun 7, 2026
Data Sourced
via Debian·09:27 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2018-1305?

CVE-2018-1305 is classified as a moderate severity vulnerability.

2

How do I fix CVE-2018-1305?

To fix CVE-2018-1305, upgrade Apache Tomcat to versions 7.0.85, 8.0.50, or 8.5.28 or later.

3

What versions of Apache Tomcat are affected by CVE-2018-1305?

CVE-2018-1305 affects Apache Tomcat versions 7.0.0 to 7.0.84, 8.0.0.RC1 to 8.0.49, and 8.5.0 to 8.5.27.

4

What type of vulnerability is CVE-2018-1305?

CVE-2018-1305 is a vulnerability that may lead to unintended resource exposure depending on the order in which Servlets are loaded.

5

Is there a workaround for CVE-2018-1305?

There are no recommended workarounds for CVE-2018-1305, the best course of action is to apply the necessary updates.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203