REDHAT-BUG-2457020: High severity Apache Tomcat vulnerability
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.
Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.19 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.53 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.116
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2457020?
The severity of REDHAT-BUG-2457020 is high with a score of 7.
What is the main issue described in REDHAT-BUG-2457020?
REDHAT-BUG-2457020 describes a Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.
Which versions of Apache Tomcat are affected by REDHAT-BUG-2457020?
REDHAT-BUG-2457020 affects Apache Tomcat versions from 11.0.0-M1 through 11.0.18, 10.0.0-M1 through 10.1.52, 9.0.13 through 9.0.115, 8.5.38 through 8.5.100, and 7.0.100 through 7.0.109.
How do I fix REDHAT-BUG-2457020?
To fix REDHAT-BUG-2457020, upgrade to a patched version of Apache Tomcat as specified in the vendor's advisories.
Is REDHAT-BUG-2457020 considered critical for my systems?
Yes, REDHAT-BUG-2457020 is considered critical due to its high severity and potential impact on system security.