The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - tomcat: XSS in SSI printenv (CVE-2019-0221)

  - The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and     8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an     untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and     integrity protection, it does not protect against all risks associated with running over any untrusted     network, particularly DoS risks. (CVE-2022-29885)

  - Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat     from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from     8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to     information leaking from the current request/response to the next. Users are recommended to upgrade to     version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
    (CVE-2023-42795)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Detections

Analytics

RHEL 7 : tomcat (Unpatched Vulnerability)

medium Nessus Plugin ID 202293

Version 1.2

Version 1.1

Version 1.2 Jul 13, 2024, 9:40 PM CEA reference Plugin Feed: 202407132140
Version 1.1 Jul 12, 2024, 10:18 PM New Plugin Feed: 202407122218