> Apache Tomcat 授权问题漏洞

Apache Tomcat 授权问题漏洞

CNNVD-ID编号	CNNVD-201912-927	CVE编号	CVE-2019-17563
发布时间	2019-12-19	更新时间	2021-01-27
漏洞类型	授权问题	漏洞来源	Ubuntu,Debian,Red Hat,Gentoo
危险等级	高危	威胁类型	远程
厂商	N/A

漏洞介绍

Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。

Apache Tomcat 9.0.0.M1版本至9.0.29版本、8.5.0版本至8.5.49版本和7.0.0版本至7.0.98版本中存在授权问题漏洞。攻击者可借助FORM身份验证功能利用该漏洞访问其他用户的会话。

漏洞补丁

目前厂商已发布升级了Apache Tomcat 授权问题漏洞的补丁，Apache Tomcat 授权问题漏洞的补丁获取链接：

http://tomcat.apache.org/security-9.html

参考网址

来源:GENTOO

链接：https://security.gentoo.org/glsa/202003-43

来源:CONFIRM

链接：https://security.netapp.com/advisory/ntap-20200107-0001/

来源:MLIST

链接：https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E

来源:MLIST

链接：https://lists.apache.org/thread.html/reb9a66f176df29b9a832caa95ebd9ffa3284e8f4922ec4fa3ad8eb2e@%3Cissues.cxf.apache.org%3E

来源:UBUNTU

链接：https://usn.ubuntu.com/4251-1/

来源:MLIST

链接：https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E

来源:N/A

链接：https://www.oracle.com/security-alerts/cpuapr2020.html

来源:MLIST

链接：https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E

来源:CONFIRM

链接：https://lists.apache.org/thread.html/8b4c1db8300117b28a0f3f743c0b9e3f964687a690cdf9662a884bbd%40%3Cannounce.tomcat.apache.org%3E

来源:BUGTRAQ

链接：https://seclists.org/bugtraq/2019/Dec/43

来源:MLIST

链接：https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html

来源:MLIST

链接：https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E

来源:DEBIAN

链接：https://www.debian.org/security/2020/dsa-4680

来源:MLIST

链接：https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E

来源:SUSE

链接：http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html

来源:MLIST

链接：https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html

来源:DEBIAN

链接：https://www.debian.org/security/2019/dsa-4596

来源:tomcat.apache.org

链接：http://tomcat.apache.org/security-7.html

来源:tomcat.apache.org

链接：http://tomcat.apache.org/security-8.html

来源:tomcat.apache.org

链接：http://tomcat.apache.org/security-9.html

来源:www.suse.com

链接：https://www.suse.com/support/update/announcement/2020/suse-su-20200029-1.html

来源:www.suse.com

链接：https://www.suse.com/support/update/announcement/2020/suse-su-20200226-1.html

来源:www.debian.org

链接：https://www.debian.org/security/2019/dsa-4596

来源:www.oracle.com

链接：https://www.oracle.com/security-alerts/cpujul2020.html

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-open-source-apache-tomcat-vulnerabilities-affect-ibm-tivoli-application-dependency-discovery-manager-taddmcve-2019-12418-cve-2019-17563-2/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2019.4714/

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/156094/Ubuntu-Security-Notice-USN-4251-1.html

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-ibm-websphere-cast-iron-solution-app-connect-professional-is-affected-by-apache-tomcat-vulnerabilities-2/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.2089/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.0867/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-open-source-apache-tomcat-vulnerabilities-affect-ibm-tivoli-application-dependency-discovery-manager-taddmcve-2019-12418-cve-2019-17563/

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/159373/Red-Hat-Security-Advisory-2020-4004-01.html

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.0014/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.0294.2/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.3250/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.1887/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.1388/

来源:www.nsfocus.net

链接：http://www.nsfocus.net/vulndb/46457

来源:www.oracle.com

链接：https://www.oracle.com/security-alerts/cpujan2021.html

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/156827/Gentoo-Linux-Security-Advisory-202003-43.html

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/155792/Debian-Security-Advisory-4596-1.html

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.0063/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.0963/

来源:www.ibm.com

链接：https://www.ibm.com/blogs/psirt/security-bulletin-ibm-integration-bus-affected-by-multiple-apache-tomcat-core-only-vulnerabilities/

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.0298/

来源:vigilance.fr

链接：https://vigilance.fr/vulnerability/Apache-Tomcat-privilege-escalation-via-FORM-authentication-session-fixation-31188

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/157312/Red-Hat-Security-Advisory-2020-1520-01.html

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.1608/

来源:packetstormsecurity.com

链接：https://packetstormsecurity.com/files/156781/Red-Hat-Security-Advisory-2020-0861-01.html

受影响实体

暂无

信息来源

http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201912-927