CVE-2019-0221: XSS

Q: What is CVE-2019-0221?

CVE-2019-0221 is a vulnerability in the printenv command in Apache Tomcat 7.0.0 to 7.0.93, 8.5.0 to 8.5.39, and 9.0.0.M1 to 9.0.0.17 that allows for cross-site scripting (XSS) attacks.

Q: How severe is CVE-2019-0221?

The severity of CVE-2019-0221 is rated as medium.

Q: What is the affected software for CVE-2019-0221?

The affected software versions are Apache Tomcat 7.0.0 to 7.0.93, 8.5.0 to 8.5.39, and 9.0.0.M1 to 9.0.0.17.

Q: How can I fix CVE-2019-0221?

To fix CVE-2019-0221, update your Apache Tomcat installation to version 7.0.94, 8.5.40, or 9.0.18 or later.

Q: Where can I find more information about CVE-2019-0221?

You can find more information about CVE-2019-0221 on the Apache Tomcat security page and the GitHub commit page.

Published Apr 13, 2019

Updated

Apache Tomcat is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the SSI printenv command. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Other sources

The SSI printenv command echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

Reference: http://tomcat.apache.org/security-9.html

Upstream commit: https://github.com/apache/tomcat/commit/15fcd16

— Red Hat

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

Affected Software

86 affected componentsFixes available

redhat/tomcat7<0:7.0.70-38.ep7.el6

0:7.0.70-38.ep7.el6

redhat/tomcat8<0:8.0.36-42.ep7.el6

0:8.0.36-42.ep7.el6

redhat/tomcat-native<0:1.2.23-21.redhat_21.ep7.el6

0:1.2.23-21.redhat_21.ep7.el6

redhat/tomcat7<0:7.0.70-38.ep7.el7

0:7.0.70-38.ep7.el7

redhat/tomcat8<0:8.0.36-42.ep7.el7

0:8.0.36-42.ep7.el7

redhat/tomcat-native<0:1.2.23-21.redhat_21.ep7.el7

0:1.2.23-21.redhat_21.ep7.el7

redhat/jws5-ecj<0:4.12.0-1.redhat_1.1.el6

0:4.12.0-1.redhat_1.1.el6

redhat/jws5-javapackages-tools<0:3.4.1-5.15.11.el6

0:3.4.1-5.15.11.el6

redhat/jws5-jboss-logging<0:3.3.2-1.Final_redhat_00001.1.el6

0:3.3.2-1.Final_redhat_00001.1.el6

redhat/jws5-tomcat<0:9.0.21-10.redhat_4.1.el6

0:9.0.21-10.redhat_4.1.el6

redhat/jws5-tomcat-native<0:1.2.21-34.redhat_34.el6

0:1.2.21-34.redhat_34.el6

redhat/jws5-tomcat-vault<0:1.1.8-1.Final_redhat_1.1.el6

0:1.1.8-1.Final_redhat_1.1.el6

redhat/jws5-ecj<0:4.12.0-1.redhat_1.1.el7

0:4.12.0-1.redhat_1.1.el7

redhat/jws5-javapackages-tools<0:3.4.1-5.15.11.el7

0:3.4.1-5.15.11.el7

redhat/jws5-jboss-logging<0:3.3.2-1.Final_redhat_00001.1.el7

0:3.3.2-1.Final_redhat_00001.1.el7

redhat/jws5-tomcat<0:9.0.21-10.redhat_4.1.el7

0:9.0.21-10.redhat_4.1.el7

redhat/jws5-tomcat-native<0:1.2.21-34.redhat_34.el7

0:1.2.21-34.redhat_34.el7

redhat/jws5-tomcat-vault<0:1.1.8-1.Final_redhat_1.1.el7

0:1.1.8-1.Final_redhat_1.1.el7

redhat/jws5-ecj<0:4.12.0-1.redhat_1.1.el8

0:4.12.0-1.redhat_1.1.el8

redhat/jws5-javapackages-tools<0:3.4.1-5.15.11.el8

0:3.4.1-5.15.11.el8

redhat/jws5-jboss-logging<0:3.3.2-1.Final_redhat_00001.1.el8

0:3.3.2-1.Final_redhat_00001.1.el8

redhat/jws5-tomcat<0:9.0.21-10.redhat_4.1.el8

0:9.0.21-10.redhat_4.1.el8

redhat/jws5-tomcat-native<0:1.2.21-34.redhat_34.el8

0:1.2.21-34.redhat_34.el8

redhat/jws5-tomcat-vault<0:1.1.8-1.Final_redhat_1.1.el8

0:1.1.8-1.Final_redhat_1.1.el8

maven/org.apache.tomcat.embed:tomcat-embed-core>=7.0.0<7.0.94

7.0.94

maven/org.apache.tomcat.embed:tomcat-embed-core>=8.0.0<8.5.40

8.5.40

maven/org.apache.tomcat.embed:tomcat-embed-core>=9.0.0<9.0.17

9.0.17

Apache Tomcat>=7.0.0<=7.0.93

Apache Tomcat>=8.5.0<=8.5.39

Apache Tomcat>=9.0.1<=9.0.17

Apache Tomcat=9.0.0-milestone1

Apache Tomcat=9.0.0-milestone10

Apache Tomcat=9.0.0-milestone11

Apache Tomcat=9.0.0-milestone12

Apache Tomcat=9.0.0-milestone13

Apache Tomcat=9.0.0-milestone14

Apache Tomcat=9.0.0-milestone15

Apache Tomcat=9.0.0-milestone16

Apache Tomcat=9.0.0-milestone17

Apache Tomcat=9.0.0-milestone18

Apache Tomcat=9.0.0-milestone19

Apache Tomcat=9.0.0-milestone2

Apache Tomcat=9.0.0-milestone20

Apache Tomcat=9.0.0-milestone21

Apache Tomcat=9.0.0-milestone22

Apache Tomcat=9.0.0-milestone23

Apache Tomcat=9.0.0-milestone24

Apache Tomcat=9.0.0-milestone25

Apache Tomcat=9.0.0-milestone26

Apache Tomcat=9.0.0-milestone27

Apache Tomcat=9.0.0-milestone3

Apache Tomcat=9.0.0-milestone4

Apache Tomcat=9.0.0-milestone5

Apache Tomcat=9.0.0-milestone6

Apache Tomcat=9.0.0-milestone7

Apache Tomcat=9.0.0-milestone8

Apache Tomcat=9.0.0-milestone9

Apache Tomcat=9.0.0-m1

Apache Tomcat=9.0.0-m10

Apache Tomcat=9.0.0-m11

Apache Tomcat=9.0.0-m12

Apache Tomcat=9.0.0-m13

Apache Tomcat=9.0.0-m14

Apache Tomcat=9.0.0-m15

Apache Tomcat=9.0.0-m16

Apache Tomcat=9.0.0-m17

Apache Tomcat=9.0.0-m18

Apache Tomcat=9.0.0-m19

Apache Tomcat=9.0.0-m2

Apache Tomcat=9.0.0-m20

Apache Tomcat=9.0.0-m21

Apache Tomcat=9.0.0-m22

Apache Tomcat=9.0.0-m23

Apache Tomcat=9.0.0-m24

Apache Tomcat=9.0.0-m25

Apache Tomcat=9.0.0-m26

Apache Tomcat=9.0.0-m27

Apache Tomcat=9.0.0-m3

Apache Tomcat=9.0.0-m4

Apache Tomcat=9.0.0-m5

Apache Tomcat=9.0.0-m6

Apache Tomcat=9.0.0-m7

Apache Tomcat=9.0.0-m8

Apache Tomcat=9.0.0-m9

IBM GDE<=3.0.0.2

debian/tomcat9

9.0.70-29.0.95-19.0.122-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/tomcat7 to a version that resolves this vulnerability.
Fixed in 0:7.0.70-38.ep7.el6
Upgrade
Upgrade redhat/tomcat8 to a version that resolves this vulnerability.
Fixed in 0:8.0.36-42.ep7.el6
Upgrade
Upgrade redhat/tomcat-native to a version that resolves this vulnerability.
Fixed in 0:1.2.23-21.redhat_21.ep7.el6
Upgrade
Upgrade redhat/tomcat7 to a version that resolves this vulnerability.
Fixed in 0:7.0.70-38.ep7.el7
Upgrade
Upgrade redhat/tomcat8 to a version that resolves this vulnerability.
Fixed in 0:8.0.36-42.ep7.el7
Upgrade
Upgrade redhat/tomcat-native to a version that resolves this vulnerability.
Fixed in 0:1.2.23-21.redhat_21.ep7.el7
Upgrade
Upgrade redhat/jws5-ecj to a version that resolves this vulnerability.
Fixed in 0:4.12.0-1.redhat_1.1.el6
Upgrade
Upgrade redhat/jws5-javapackages-tools to a version that resolves this vulnerability.
Fixed in 0:3.4.1-5.15.11.el6
Upgrade
Upgrade redhat/jws5-jboss-logging to a version that resolves this vulnerability.
Fixed in 0:3.3.2-1.Final_redhat_00001.1.el6
Upgrade
Upgrade redhat/jws5-tomcat to a version that resolves this vulnerability.
Fixed in 0:9.0.21-10.redhat_4.1.el6
Upgrade
Upgrade redhat/jws5-tomcat-native to a version that resolves this vulnerability.
Fixed in 0:1.2.21-34.redhat_34.el6
Upgrade
Upgrade redhat/jws5-tomcat-vault to a version that resolves this vulnerability.
Fixed in 0:1.1.8-1.Final_redhat_1.1.el6
Upgrade
Upgrade redhat/jws5-ecj to a version that resolves this vulnerability.
Fixed in 0:4.12.0-1.redhat_1.1.el7
Upgrade
Upgrade redhat/jws5-javapackages-tools to a version that resolves this vulnerability.
Fixed in 0:3.4.1-5.15.11.el7
Upgrade
Upgrade redhat/jws5-jboss-logging to a version that resolves this vulnerability.
Fixed in 0:3.3.2-1.Final_redhat_00001.1.el7
Upgrade
Upgrade redhat/jws5-tomcat to a version that resolves this vulnerability.
Fixed in 0:9.0.21-10.redhat_4.1.el7
Upgrade
Upgrade redhat/jws5-tomcat-native to a version that resolves this vulnerability.
Fixed in 0:1.2.21-34.redhat_34.el7
Upgrade
Upgrade redhat/jws5-tomcat-vault to a version that resolves this vulnerability.
Fixed in 0:1.1.8-1.Final_redhat_1.1.el7
Upgrade
Upgrade redhat/jws5-ecj to a version that resolves this vulnerability.
Fixed in 0:4.12.0-1.redhat_1.1.el8
Upgrade
Upgrade redhat/jws5-javapackages-tools to a version that resolves this vulnerability.
Fixed in 0:3.4.1-5.15.11.el8
Upgrade
Upgrade redhat/jws5-jboss-logging to a version that resolves this vulnerability.
Fixed in 0:3.3.2-1.Final_redhat_00001.1.el8
Upgrade
Upgrade redhat/jws5-tomcat to a version that resolves this vulnerability.
Fixed in 0:9.0.21-10.redhat_4.1.el8
Upgrade
Upgrade redhat/jws5-tomcat-native to a version that resolves this vulnerability.
Fixed in 0:1.2.21-34.redhat_34.el8
Upgrade
Upgrade redhat/jws5-tomcat-vault to a version that resolves this vulnerability.
Fixed in 0:1.1.8-1.Final_redhat_1.1.el8
Upgrade
Upgrade maven/org.apache.tomcat.embed:tomcat-embed-core to a version that resolves this vulnerability.
Fixed in 7.0.94
Upgrade
Upgrade maven/org.apache.tomcat.embed:tomcat-embed-core to a version that resolves this vulnerability.
Fixed in 8.5.40
Upgrade
Upgrade maven/org.apache.tomcat.embed:tomcat-embed-core to a version that resolves this vulnerability.
Fixed in 9.0.17
Upgrade
Upgrade debian/tomcat9 to a version that resolves this vulnerability.
Fixed in 9.0.70-2Fixed in 9.0.95-1Fixed in 9.0.122-1
Configuration
Do not enable the SSI printenv command in production; it is intended for debugging and is vulnerable to XSS. SSI is disabled by default in Tomcat.
Apache Tomcat SSI printenv command printenv command availability = disabled

Event History

Apr 13, 2019

CVE Published

12:00 AM

May 23, 2019

Data Sourced

via Red Hat·10:03 AM

DescriptionSeverityAffected Software

May 28, 2019

CVE Published

via MITRE·09:01 PM

Data Sourced

via MITRE·09:01 PM

DescriptionWeakness

May 30, 2019

Advisory Published

via GitHub·03:30 AM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2019-0221?