Skip to main content
GARR
Servizi GARR
Contatti
FAQs
CERT
Cert Team
Contatti
RFC 2350
AUP - Regole d'uso della rete
Privacy policy
Cookies Policy
Incidents
Management procedure
Reports accidents
Vulnerability test | SCARR
Alert
Security Alerts
Alert subscription
PGP
PGP Keys info
GARR CERT PGP Keys
More Informations
News & Warning
Training
Files e Docs
Cybersecurity Month | GARRNews
Cybersecurity Café | GARRNews
Risponde Cecchini | GARRNwes
GARR
Servizi GARR
Contatti
CERT
Cert Team
Contatti
RFC 2350
AUP - Regole d'uso della rete
Privacy policy
Cookies Policy
Incidents
Management procedure
Reports accidents
Vulnerability test | SCARR
Alert
Security Alerts
Alert subscription
PGP
PGP Keys info
GARR CERT PGP Keys
More Informations
News & Warning
Training
Files e Docs
Cybersecurity Month | GARRNews
Cybersecurity Café | GARRNews
Risponde Cecchini | GARRNwes
CERT | Computer Emergency Response Team della comunità dell'istruzione e della ricerca
CERT | Computer Emergency Response Team della comunità dell'istruzione e della ricerca
GARR CERT
Alert
Security Alerts
GARR CERT Security Alert
Alert GCSA-18056 - Vulnerabilita' in Apache Tomcat
Alert GCSA-18056 - Vulnerabilita' in Apache Tomcat
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
******************************************************************
Alert ID : GCSA-18056
Data : 26 Luglio 2018
Titolo : Vulnerabilita' in Apache Tomcat
******************************************************************
:: Descrizione del problema
Sono state riscontrate alcune vulnerabilita' in Apache Tomcat
che possono consentire ad un aggressore remoto di bypassare restrizioni
di sicurezza, utilizzare la sessione di un altro utente e causare denial of service
:: Software interessato
Apache Tomcat 7.0.89
Apache Tomcat 8.0.52
Apache Tomcat 9.0.9
:: Impatto
Denial of Service
Accesso a risorse protette senza autenticazione
Accesso a sessioni di altri utenti
:: Soluzioni
Aggiornare Apache Tomcat ad una delle seguenti versioni
Apache Tomcat 7.0.90
Apache Tomcat 8.0.53
Apache Tomcat 9.0.10
:: Riferimenti
Apache Tomcat Advisory
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-8.html
http://tomcat.apache.org/security-8.html
SecurityTracker
https://www.securitytracker.com/id/1041376
https://www.securitytracker.com/id/1041375
https://www.securitytracker.com/id/1041374
Mitre's CVE ID
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8034
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1336
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8037
GARR CERT Newsletter subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAltaKlsACgkQwZxMk2USYEKDrQCeLm3ecWKMtcd6jG6qp1ZhMltU
/xcAn0ZTroCQcukORFR1SK8qS9RT/NyA
=NoFr
-----END PGP SIGNATURE-----