kritisch
CVE-2016-8735
tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Red Hat8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Red Hat (hoch), Amazon (hoch), Ubuntu (hoch).
Beschreibung
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina-jmx-remote | 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12 |
| amazon linux 1 | tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp und 26 weitere | 6.0.48-1.8.amzn1 und 2 weitere |
| debian 7 | tomcat6, tomcat7 | 6.0.45+dfsg-1~deb7u3 und 1 weitere |
| debian 8 | tomcat7, tomcat8 | 7.0.56-3+deb8u6 und 1 weitere |
| Red Hat | tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp und 21 weitere | kein Fix angegeben |
| ubuntu 12.04 | tomcat6 | 6.0.35-1ubuntu3.9 |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 16.04 | tomcat6, tomcat7, tomcat8 | 6.0.45+dfsg-1ubuntu0.1 und 2 weitere |
| ubuntu 16.04-ESM | tomcat6, tomcat7, tomcat8 | 6.0.45+dfsg-1ubuntu0.1 und 2 weitere |
| ubuntu 16.10 | tomcat8 | 8.0.37-1ubuntu0.1 |
| ubuntu 17.04 | tomcat8 | 8.0.38-2ubuntu1 |
Alle 74 Einträge aus 16 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina | 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina-jmx-remote | 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12 |
| amazon linux 1 | tomcat6 | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-admin-webapps | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-docs-webapp | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-el-2.1-api | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-javadoc | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-jsp-2.1-api | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-lib | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-servlet-2.5-api | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-webapps | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat7 | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-admin-webapps | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-docs-webapp | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-el-2.2-api | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-javadoc | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-jsp-2.2-api | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-lib | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-log4j | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-servlet-3.0-api | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-webapps | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat8 | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-admin-webapps | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-docs-webapp | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-el-3.0-api | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-javadoc | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-jsp-2.3-api | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-lib | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-log4j | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-servlet-3.1-api | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-webapps | 8.0.39-1.67.amzn1 |
| debian 7 | tomcat6 | 6.0.45+dfsg-1~deb7u3 |
| debian 7 | tomcat7 | 7.0.28-4+deb7u7 |
| debian 8 | tomcat7 | 7.0.56-3+deb8u6 |
| debian 8 | tomcat8 | 8.0.14-1+deb8u5 |
| Red Hat | tomcat6 | kein Fix angegeben |
| Red Hat | tomcat6-admin-webapps | kein Fix angegeben |
| Red Hat | tomcat6-docs-webapp | kein Fix angegeben |
| Red Hat | tomcat6-el-1.0-api | kein Fix angegeben |
| Red Hat | tomcat6-el-2.1-api | kein Fix angegeben |
| Red Hat | tomcat6-javadoc | kein Fix angegeben |
| Red Hat | tomcat6-jsp-2.1-api | kein Fix angegeben |
| Red Hat | tomcat6-lib | kein Fix angegeben |
| Red Hat | tomcat6-log4j | kein Fix angegeben |
| Red Hat | tomcat6-maven-devel | kein Fix angegeben |
| Red Hat | tomcat6-servlet-2.5-api | kein Fix angegeben |
| Red Hat | tomcat6-webapps | kein Fix angegeben |
| Red Hat | tomcat7 | kein Fix angegeben |
| Red Hat | tomcat7-admin-webapps | kein Fix angegeben |
| Red Hat | tomcat7-docs-webapp | kein Fix angegeben |
| Red Hat | tomcat7-el-1.0-api | kein Fix angegeben |
| Red Hat | tomcat7-el-2.2-api | kein Fix angegeben |
| Red Hat | tomcat7-javadoc | kein Fix angegeben |
| Red Hat | tomcat7-jsp-2.2-api | kein Fix angegeben |
| Red Hat | tomcat7-lib | kein Fix angegeben |
| Red Hat | tomcat7-log4j | kein Fix angegeben |
| Red Hat | tomcat7-maven-devel | kein Fix angegeben |
| Red Hat | tomcat7-servlet-3.0-api | kein Fix angegeben |
| Red Hat | tomcat7-webapps | kein Fix angegeben |
| ubuntu 12.04 | tomcat6 | 6.0.35-1ubuntu3.9 |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 16.04 | tomcat6 | 6.0.45+dfsg-1ubuntu0.1 |
| ubuntu 16.04 | tomcat7 | 7.0.68-1ubuntu0.3 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.3 |
| ubuntu 16.04-ESM | tomcat6 | 6.0.45+dfsg-1ubuntu0.1 |
| ubuntu 16.04-ESM | tomcat7 | 7.0.68-1ubuntu0.3 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.3 |
| ubuntu 16.10 | tomcat8 | 8.0.37-1ubuntu0.1 |
| ubuntu 17.04 | tomcat8 | 8.0.38-2ubuntu1 |
| ubuntu 17.10 | tomcat8 | 8.0.38-2ubuntu1 |
| ubuntu 18.04 | tomcat8 | 8.0.38-2ubuntu1 |
| ubuntu 18.04-ESM | tomcat8 | 8.0.38-2ubuntu1 |
| ubuntu 18.10 | tomcat8 | 8.0.38-2ubuntu1 |
Referenzen
- http://rhn.redhat.com/errata/RHSA-2017-0457.html
- http://seclists.org/oss-sec/2016/q4/502
- http://svn.apache.org/viewvc?view=revision&revision=1767644
- http://svn.apache.org/viewvc?view=revision&revision=1767656
- http://svn.apache.org/viewvc?view=revision&revision=1767676
- http://svn.apache.org/viewvc?view=revision&revision=1767684
- http://tomcat.apache.org/security-6.html
- http://tomcat.apache.org/security-7.html
Alle 59 Referenzen
- http://tomcat.apache.org/security-8.html
- http://tomcat.apache.org/security-9.html
- http://www.debian.org/security/2016/dsa-3738
- http://www.openwall.com/lists/oss-security/2016/11/22/16
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securityfocus.com/bid/94463
- http://www.securitytracker.com/id/1037331
- https://access.redhat.com/errata/RHSA-2017:0455
- https://access.redhat.com/errata/RHSA-2017:0456
- https://access.redhat.com/security/cve/CVE-2016-8735
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/0e83ad3e547fc9a75a258799ef581249b40a82a6
- https://github.com/apache/tomcat/commit/292d6ccdc9edbf80859929b0af070b2ea99fa688
- https://github.com/apache/tomcat/commit/7e3a037055cca4a17e90b49399fb1bab4dd7c821
- https://github.com/apache/tomcat80/commit/0f76016a4ec45635e450ada9c84ff7ee0c5f3799
- https://github.com/search?q=repo%3Aapache%2Ftomcat+catalina.mbeans+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=code
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-8735
- https://security.netapp.com/advisory/ntap-20180607-0001
- https://security.netapp.com/advisory/ntap-20180607-0001/
- https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
- https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
- https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
- https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8
- https://ubuntu.com/security/notices/USN-3177-1
- https://ubuntu.com/security/notices/USN-4557-1
- https://ubuntu.com/security/notices/USN-7242-1
- https://usn.ubuntu.com/4557-1
- https://usn.ubuntu.com/4557-1/
- https://web.archive.org/web/20170423095340/http://www.securityfocus.com/bid/94463
- https://web.archive.org/web/20170928203901/http://www.securitytracker.com/id/1037331
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-8735
- https://www.cve.org/CVERecord?id=CVE-2016-8735
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html