REDHAT-BUG-2457038: Low severity Apache Tomcat vulnerability
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcat (cloud membership for clustering component)to a version that resolves this vulnerability.Fixed in 11.0.21 - Upgrade
Upgrade
Apache Tomcat (cloud membership for clustering component)to a version that resolves this vulnerability.Fixed in 10.1.54 - Upgrade
Upgrade
Apache Tomcat (cloud membership for clustering component)to a version that resolves this vulnerability.Fixed in 9.0.117
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2457038?
The severity of REDHAT-BUG-2457038 is classified as low.
How do I fix REDHAT-BUG-2457038?
To fix REDHAT-BUG-2457038, update Apache Tomcat to a version that is not affected by the vulnerability.
What components are affected by REDHAT-BUG-2457038?
REDHAT-BUG-2457038 affects the cloud membership for clustering component of Apache Tomcat.
What information is exposed by REDHAT-BUG-2457038?
REDHAT-BUG-2457038 exposes the Kubernetes bearer token in log files.
Which versions of Apache Tomcat are impacted by REDHAT-BUG-2457038?
The impacted versions of Apache Tomcat are from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, and from 9.0.13 through 9.0.116.