Loading story…
Red Hat released updates for Apache Tomcat and JBoss Web Server deployments on RHEL 6 and RHEL 7 to remediate vulnerabilities spanning local privilege escalation, SecurityManager bypass, directory traversal and disclosure, sensitive-data exposure, and denial of service. On RHEL 6, writable Tomcat configuration files could allow the tomcat user—or a compromised web application—to gain root-level code execution through service lifecycle actions; older Tomcat code also allowed authenticated malicious applications to bypass SecurityManager isolation and list parent deployment directories.
The updates also address a Commons FileUpload flaw, CVE-2016-3092, in which crafted multipart boundaries near the 4,096-byte buffer length could severely slow processing or crash affected Tomcat 7 and 8 applications. Later packages fixed username enumeration through Realm timing differences, SecurityManager bypasses, protected system-property exposure, and unauthorized access to global JNDI resources via ResourceLinkFactory; affected organizations should deploy the supported Red Hat Tomcat or JBoss Web Server package updates for their platform.
Get the actors, campaigns, and ATT&CK mapping behind it.
38 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued low-severity RHSA-2017:2247 for RHEL 7, supplying Tomcat 7.0.76 packages. The update fixed five vulnerabilities, including username enumeration via CVE-2016-0762 and SecurityManager or JNDI-access flaws in CVE-2016-5018, CVE-2016-6794, CVE-2016-6796, and CVE-2016-6797.
Red Hat updated RHSA-2017:0455, providing JBoss Web Server 3.1.0 packages for RHEL 6 to replace version 3.0.3. The update remediated eleven Tomcat and Commons FileUpload vulnerabilities, including CVE-2016-6325, CVE-2016-3092, and several SecurityManager bypasses.
Red Hat issued Important advisory RHSA-2016:2808, upgrading JBoss Web Server from 2.1.1 to 2.1.2 for deployments using its Tomcat 7 component. The update fixed six flaws, including CSRF token disclosure, session fixation, SecurityManager bypasses, information disclosure, and the CVE-2016-3092 denial-of-service issue.
Red Hat issued moderate-severity RHSA-2016:2599, updating RHEL 7 Tomcat to 7.0.69-10.el7. The advisory addressed CVE-2016-3092, CVE-2015-5174, SecurityManager bypasses, information-disclosure issues, and other flaws.
Red Hat released RHSA-2016:2070 and RHSA-2016:2071 to remediate CVE-2016-3092 in JBoss Enterprise Application Platform 6.4 and its RHEL 5 components.
Red Hat issued Important advisory RHSA-2016:2046 for RHEL 7, updating Tomcat to 7.0.54-8.el7_2. The update fixed local privilege-escalation flaws CVE-2016-5425 and CVE-2016-6325, CVE-2014-7810 SecurityManager bypass, CVE-2016-5388 CGI proxy-environment injection, and CVE-2015-5346 session fixation.
Red Hat issued RHSA-2016:2045 for RHEL 6 tomcat6, remediating CVE-2016-5388. The CGI handling flaw allowed a user-controlled Proxy header to set HTTP_PROXY and potentially route CGI-script outbound requests through an attacker-controlled proxy.
Red Hat issued RHSA-2016:2045 for RHEL 6 Tomcat 6, updating packages to 6.0.24-98.el6_8. The update addressed CVE-2016-6325 privilege escalation, CVE-2015-5174 directory traversal, and other security flaws.
CVE-2016-5425 was publicly disclosed through the OSS Security mailing list. A tomcat-group user could modify /usr/lib/tmpfiles.d/tomcat.conf, causing the root-run systemd-tmpfiles service to create files with attacker-controlled permissions in arbitrary system directories and potentially obtain root privileges.
Fedora released fixed Tomcat 8 packages for Fedora 23, 24, and 25, while EPEL 6 received tomcat-7.0.70-2.el6, addressing the multipart-boundary denial-of-service flaw.
Red Hat issued RHSA-2016:1432, RHSA-2016:1433, and RHSA-2016:1435 to fix CVE-2015-5174 in affected JBoss Enterprise Application Platform 6.4 products and components.
Red Hat published its record for CVE-2016-3092, a moderate-severity Apache Commons FileUpload denial-of-service flaw exploitable with crafted multipart upload boundaries near the 4,096-byte input-buffer size.
Red Hat released RHSA-2016:1087, RHSA-2016:1088, and RHSA-2016:1089 to remediate CVE-2015-5351 in JBoss Web Server 3 components. The Tomcat Manager and Host Manager flaw could leak a valid CSRF token in a redirect, enabling CSRF actions using a victim's privileges.
Red Hat issued RHSA-2016:1087, RHSA-2016:1088, and RHSA-2016:1089 to remediate the CVE-2015-5345 protected-directory disclosure flaw in JBoss Web Server 3 products for RHEL 6 and RHEL 7, including affected Tomcat components.
Red Hat released RHSA-2016:0599 to remediate CVE-2014-0230 in JBoss Enterprise Application Platform 6.4. The Tomcat flaw allowed unauthenticated remote attackers to exhaust available connections using large request bodies.
Red Hat released RHSA-2016:0492 for Red Hat Enterprise Linux 6 tomcat6 to remediate CVE-2014-7810. The expression-language resolver flaw could let a malicious web application bypass Java Security Manager protections because expressions were evaluated in a privileged code section.
Andrej Nemec reported CVE-2015-5351, in which unauthenticated redirects from Tomcat Manager and Host Manager root pages could expose valid CSRF tokens. An attacker could use a disclosed token to construct a cross-site request-forgery attack.
Andrej Nemec reported that Tomcat's publicly accessible ResourceLinkFactory.setGlobalContext() method lacked authorization checks under a Java SecurityManager. A malicious web application could inject a global context, disrupting co-hosted applications or reading and writing their data.
Andrej Nemec documented CVE-2016-0706, in which a web application could load Tomcat's StatusManagerServlet despite a configured SecurityManager. The servlet could expose deployed applications and active HTTP request lines from other applications, potentially including session IDs.
The CVE-2015-5174 directory-traversal vulnerability in Tomcat's ServletContext resource-access methods was publicly disclosed through Bugtraq. Apache had corrected affected Tomcat 6, 7, and 8 versions.
Red Hat published its record for CVE-2015-5346, a Tomcat session-fixation flaw caused by recycling the requestedSessionSSL field. Under configurations that use SSL session IDs as HTTP session IDs, an unauthenticated remote attacker could reuse a previously used session ID.
Red Hat published its CVE record for CVE-2015-5174, a low-severity Tomcat RequestUtil directory-traversal issue that could let an authenticated user bypass intended SecurityManager restrictions and list a parent directory.
Red Hat issued moderate-severity RHSA-2015:1622 for JBoss Web Server 2.1.0 on RHEL 5, 6, and 7. Updated Tomcat 6 and 7 packages fixed the CVE-2014-7810 SecurityManager bypass and CVE-2014-0230 remote connection-pool exhaustion denial of service.
Martin Prpič reported Red Hat Bug 1222573 for CVE-2014-7810, an Apache Tomcat and JBoss Web flaw in which Expression Language expressions were evaluated in a privileged code section. A malicious web application could exploit the issue to bypass Java Security Manager protections.
Red Hat remediated CVE-2014-0093 in JBoss EAP 6.2 and its RHEL 5 components through RHSA-2014:0345 and RHSA-2014:0343 on March 31, 2014. It later issued RHSA-2014:1290 and RHSA-2014:1291 for JBoss BRMS 6.0 and JBoss BPMS 6.0 on September 23, 2014.
Arun Babu Neelicattu reported CVE-2014-0093, discovered by Josef Cacek, involving Java Security Manager policy permissions not being enforced for deployed Red Hat JBoss applications. The flaw granted deployed applications java.security.AllPermission, potentially allowing security restrictions to be bypassed.
Red Hat addressed CVE-2016-5388 in JBoss Web Server 3.0.3 and JBoss Web Server 3 packages for RHEL 6 and 7 through RHSA-2016:1624, RHSA-2016:1635, and RHSA-2016:1636. The Tomcat CGI flaw allowed an untrusted Proxy request header to populate HTTP_PROXY and redirect outbound CGI application requests through an attacker-controlled proxy.
Red Hat remediated the Tomcat unread-request-body denial-of-service flaw, CVE-2014-0230, in JBoss Web Server 2.1.0, JWS 3.0 for RHEL 6 and 7, and JBoss EAP 6.4.z through RHSA-2015:1621, RHSA-2015:2659 through RHSA-2015:2661, and RHSA-2016:0595 through RHSA-2016:0598. The issue allowed clients to retain a Tomcat processing thread by continuously sending unread request-body data on an open connection.
Apache Tomcat was found to redirect requests for security-constrained directories lacking a trailing slash before enforcing access controls, allowing unauthorized users to determine whether protected directories or web applications existed. Upstream issued fixes for Tomcat 6, 7, and 8, and Red Hat remediated the issue in JBoss Web Server, JWS, and RHEL advisories.
Red Hat issued updates for JBoss Web Server 3.0/JWS 3.0 and JBoss Enterprise Web Server 2 to address CVE-2016-0714, a Tomcat session-persistence flaw that could allow a malicious web application to bypass the Java Security Manager and execute code with Tomcat internal permissions.
Red Hat released RHSA-2016:2807 for JBoss Enterprise Web Server 2 on RHEL 6 and RHEL 7, remediating the CVE-2016-0706 StatusManagerServlet SecurityManager-bypass flaw. The flaw could allow a web application to enumerate deployed applications and expose information such as session IDs.
Red Hat closed Bugzilla 1327326 as ERRATA after correcting Tomcat packaging so normal runtime changes to catalina.out and tomcat.pid would not cause RPM verification failures. Red Hat directed users to RHSA-2016:2599 for the updated files.
Red Hat closed Bugzilla 1347860 as ERRATA, stating that RHSA-2016:2599 resolved a RHEL 7 Tomcat systemd unit defect that terminated Tomcat before active sessions could be persisted. The issue could cause session-data loss after restart when sessions were not replicated in a cluster.
Red Hat resolved Bugzilla 1208402 through RHSA-2016:2599, changing RHEL 7 tomcat-admin-webapps handling of customized manager and host-manager web.xml files. The files were marked as %config so updated security-relevant versions are installed while locally modified versions are retained as .rpmsave files.
Red Hat closed Bugzilla 1221896 as ERRATA after addressing a RHEL 7 Tomcat regression where systemd-loaded configuration files did not expand shell variables in JAVA_OPTS or CATALINA_OPTS, potentially causing tomcat.service to fail. The resolution associated with RHSA-2016:2599 added /etc/tomcat/conf.d for configuration files that require shell-variable expansion.
Red Hat resolved Bugzilla 1133070 through RHSA-2016:2599, adding the full tomcat-juli.jar and tomcat-juli-adapters.jar implementations missing from RHEL 7 Tomcat 7. The packaging defect had prevented Tomcat from using Log4j; the fix also required the symlinks utility to expose the JAR files in the extras directory.
Red Hat closed Bugzilla 1201409 as ERRATA after RHSA-2016:2599 corrected the RHEL 7 tomcat-jsvc systemd unit. The defects caused PID-file collisions between independent instances and left the unit referencing removed tooling; the update also corrected hard-coded TOMCAT_USER handling.
Apache disclosed CVE-2016-0714, in which a malicious web application could use crafted session objects processed by Tomcat session-persistence or clustering mechanisms to execute code with Tomcat internal permissions and bypass the Java Security Manager. Apache advised upgrading to Tomcat 6.0.45, 7.0.68, 8.0.32, or 9.0.0.M3 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
50 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcerhn.redhat.com
Open sourceaccess.redhat.com
Open sourcerhn.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat issued Moderate-security updates for JBoss Enterprise Application Platform (EAP) 6.2.2, JBoss Web Server 2.0.1, and RHEL `tomcat6` packages to address **CVE-2013-4286**, an HTTP request-processing flaw involving conflicting `Content-Length` and chunked-transfer headers. Successful exploitation could cause web-cache poisoning, cross-site scripting, or disclosure of data from other requests. The related Tomcat updates also remediate **CVE-2013-4322**, a resource-exhaustion denial of service in chunked-request processing, and **CVE-2014-0050**, an infinite-loop denial of service in embedded Apache Commons FileUpload; Tomcat 6 updates additionally address **CVE-2014-0033**, a URL-rewriting issue that could facilitate session hijacking. Red Hat instructed affected EAP, JBoss Web Server, and Tomcat administrators to install the supplied backported packages and restart the relevant server processes, preserving and merging local configuration changes where necessary. Separate JBoss middleware releases also delivered broader security fixes: JBoss Fuse 6.1.0 addressed issues including XML signature spoofing, XXE, authentication downgrade, denial of service, and credential exposure, while JBoss BRMS 6.0.3 corrected Important-severity flaws including potential remote code execution through Xalan-Java secure-processing bypasses, OpenSAML XXE, excessive Java Security Manager permissions, and plaintext request-parameter logging.
Aug 31, 2026
Red Hat released JBoss Web Server `3.1.0` to replace version `3.0.3`, remediating 11 vulnerabilities in Apache Tomcat and Commons FileUpload. The most severe issue, **CVE-2016-8735**, could enable remote code execution through `JmxRemoteLifecycleListener` in Tomcat instances built from EWS 2.x or JWS 3.x source distributions; Red Hat noted that standard RHEL Tomcat binary packages were not affected. The update also fixes **CVE-2016-1240**, an unsafe Tomcat init-script file-handling flaw that could allow local privilege escalation via a symlink attack on `catalina.out`. Other fixes address writable Tomcat initialization configuration that could enable privilege escalation (`CVE-2016-6325`), SecurityManager bypasses and system-property disclosure (`CVE-2016-6794`), unauthorized access to global JNDI resources (`CVE-2016-6797`), username enumeration through timing differences (`CVE-2016-0762`), denial-of-service conditions, request or response manipulation, and information disclosure. Organizations running affected JBoss Web Server deployments should back up installations, applications, and configuration before upgrading; on RHEL 7, the `httpd` service restarts automatically after installation.
Aug 29, 2026
Red Hat released Moderate-impact updates for Apache Tomcat, JBoss Web Server, JBoss EAP 6.2.4, and JBoss Data Grid to remediate **CVE-2014-0075**, **CVE-2014-0099**, and **CVE-2014-0096**. The flaws could permit remote denial of service through unbounded chunked-transfer input, HTTP request smuggling via integer overflow while parsing `Content-Length` headers—particularly where a vulnerable server sits behind a reverse proxy—and XML external entity (XXE) processing in Tomcat DefaultServlet handling of user-supplied XSLTs. JBoss EAP and Data Grid updates additionally addressed XML parser abuse that could bypass XXE restrictions and expose XML files belonging to other applications on the same instance. Affected RHEL 6 and 7 Tomcat deployments, JBoss Web Server 2.0.1 installations, and EAP 6.2.4 environments should install the applicable vendor packages or upgrades and restart Tomcat or the JBoss server process. Red Hat supplied patched builds including `tomcat-7.0.42-6.el7_0` for RHEL 7 and `tomcat6-6.0.24-72.el6_5` for RHEL 6; JBoss Data Grid 6.2.1 users were directed to upgrade to 6.3.0. Administrators should back up JBoss installations, applications, and configurations before applying updates, and prioritize externally reachable services deployed behind reverse proxies.
Aug 29, 2026