kritisch
CVE-2018-8014
tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.7CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, Photon OS. Niedriger laut AlmaLinux (hoch), Amazon (hoch), Rocky Linux (hoch), Red Hat (mittel), Oracle (mittel), Ubuntu (niedrig).
Beschreibung
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.9, 8.5.32, 8.0.53, 7.0.88 |
| Photon OS 1.0 | apache-tomcat | 8.5.31-2.ph1 |
| Photon OS 2.0 | apache-tomcat | 8.5.31-3.ph2 |
| Photon OS 3.0 | apache-tomcat | 8.5.37-1.ph3 |
| alma 8 | pki-deps:10.6::apache-commons-collections, pki-deps:10.6::apache-commons-lang, pki-deps:10.6::bea-stax-api und 22 weitere | 3.2.2-10.module_el8.5.0+150+5f0dbea0 und 20 weitere |
| amazon linux 1 | tomcat7, tomcat7-admin-webapps, tomcat7-docs-webapp und 27 weitere | 7.0.90-1.33.amzn1 und 2 weitere |
| amazon linux 2 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp und 7 weitere | 7.0.76-10.amzn2.0.1 |
| debian 8 | tomcat7, tomcat8 | 7.0.56-3+really7.0.88-1 und 1 weitere |
| debian 9 | tomcat8 | 8.5.50-0+deb9u1 |
| Oracle Linux 7 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp und 7 weitere | 7.0.76-9.el7 |
| Oracle Linux 8 | apache-commons-collections, apache-commons-lang, bea-stax-api und 30 weitere | 3.2.2-10.module+el8.0.0+5231+3e842911 und 22 weitere |
| Red Hat | jws5-tomcat, tomcat7, tomcat7-admin-webapps und 10 weitere | kein Fix angegeben |
Alle 163 Einträge aus 21 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.9, 8.5.32, 8.0.53, 7.0.88 |
| Photon OS 1.0 | apache-tomcat | 8.5.31-2.ph1 |
| Photon OS 2.0 | apache-tomcat | 8.5.31-3.ph2 |
| Photon OS 3.0 | apache-tomcat | 8.5.37-1.ph3 |
| alma 8 | pki-deps:10.6::apache-commons-collections | 3.2.2-10.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::apache-commons-lang | 2.6-21.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::bea-stax-api | 1.2.0-16.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-fastinfoset | 1.2.13-9.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-api | 2.2.12-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-core | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-runtime | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-txw2 | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::jackson-module-jaxb-annotations | 2.7.6-4.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::jakarta-commons-httpclient | 1:3.1-28.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::javassist | 3.18.1-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::javassist-javadoc | 3.18.1-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::python-nss-doc | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma |
| alma 8 | pki-deps:10.6::python3-nss | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma |
| alma 8 | pki-deps:10.6::relaxngDatatype | 2011.1-7.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::slf4j | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
| alma 8 | pki-deps:10.6::slf4j-jdk14 | 1.7.25-4.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::stax-ex | 1.7.7-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::velocity | 1.7-24.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xalan-j2 | 2.7.1-38.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xerces-j2 | 2.11.0-34.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xml-commons-apis | 1.4.01-25.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xml-commons-resolver | 1.2-26.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xmlstreambuffer | 1.5.4-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xsom | 0-19.20110809svn.module_el8.5.0+150+5f0dbea0 |
| amazon linux 1 | tomcat7 | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-admin-webapps | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-docs-webapp | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-el-2.2-api | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-javadoc | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-jsp-2.2-api | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-lib | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-log4j | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-servlet-3.0-api | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-webapps | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat8 | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-admin-webapps | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-docs-webapp | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-el-3.0-api | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-javadoc | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-jsp-2.3-api | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-lib | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-log4j | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-servlet-3.1-api | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-webapps | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat80 | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-admin-webapps | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-docs-webapp | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-el-3.0-api | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-javadoc | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-jsp-2.3-api | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-lib | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-log4j | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-servlet-3.1-api | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-webapps | 8.0.53-1.80.amzn1 |
| amazon linux 2 | tomcat | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-admin-webapps | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-docs-webapp | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-el-2.2-api | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-javadoc | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-jsp-2.2-api | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-jsvc | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-lib | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-servlet-3.0-api | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-webapps | 7.0.76-10.amzn2.0.1 |
| debian 8 | tomcat7 | 7.0.56-3+really7.0.88-1 |
| debian 8 | tomcat8 | 8.0.14-1+deb8u15 |
| debian 9 | tomcat8 | 8.5.50-0+deb9u1 |
| Oracle Linux 7 | tomcat | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-admin-webapps | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-docs-webapp | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-el-2.2-api | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-javadoc | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-jsp-2.2-api | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-jsvc | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-lib | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-servlet-3.0-api | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-webapps | 7.0.76-9.el7 |
| Oracle Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | apache-commons-lang | 2.6-21.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | bea-stax-api | 1.2.0-16.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-core | 2.2.11-11.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-runtime | 2.2.11-11.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-txw2 | 2.2.11-11.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-annotations | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-core | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-databind | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-jaxrs-json-provider | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-jaxrs-providers | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | javassist | 3.18.1-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | javassist-javadoc | 3.18.1-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | pki-servlet-4.0-api | 1:9.0.7-14.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | pki-servlet-container | 1:9.0.7-14.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | python-nss-doc | 1.0.1-10.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | python3-nss | 1.0.1-10.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | relaxngDatatype | 2011.1-7.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | resteasy | 3.0.26-3.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | slf4j | 1.7.25-4.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | slf4j-jdk14 | 1.7.25-4.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | stax-ex | 1.7.7-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | velocity | 1.7-24.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xalan-j2 | 2.7.1-38.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xerces-j2 | 2.11.0-34.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xml-commons-resolver | 1.2-26.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xsom | 0-19.20110809svn.module+el8.0.0+5231+3e842911 |
| Red Hat | jws5-tomcat | kein Fix angegeben |
| Red Hat | tomcat7 | kein Fix angegeben |
| Red Hat | tomcat7-admin-webapps | kein Fix angegeben |
| Red Hat | tomcat7-docs-webapp | kein Fix angegeben |
| Red Hat | tomcat7-el-1.0-api | kein Fix angegeben |
| Red Hat | tomcat7-el-2.2-api | kein Fix angegeben |
| Red Hat | tomcat7-javadoc | kein Fix angegeben |
| Red Hat | tomcat7-jsp-2.2-api | kein Fix angegeben |
| Red Hat | tomcat7-lib | kein Fix angegeben |
| Red Hat | tomcat7-log4j | kein Fix angegeben |
| Red Hat | tomcat7-maven-devel | kein Fix angegeben |
| Red Hat | tomcat7-servlet-3.0-api | kein Fix angegeben |
| Red Hat | tomcat7-webapps | kein Fix angegeben |
| rocky 8 | maven:3.5::slf4j | 1.7.25-4.module+el8.3.0+133+b8b54b58 |
| rocky 8 | pki-deps:10.6::apache-commons-collections | 3.2.2-10.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::apache-commons-lang | 2.6-21.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::bea-stax-api | 1.2.0-16.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-core | 2.2.11-11.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-runtime | 2.2.11-11.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-txw2 | 2.2.11-11.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::javassist | 3.18.1-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::javassist-javadoc | 3.18.1-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::python-nss-doc | 1.0.1-10.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::python3-nss | 1.0.1-10.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::relaxngDatatype | 2011.1-7.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::resteasy | 3.0.26-3.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::slf4j | 1.7.25-4.module+el8.5.0+697+f586bb30 |
| rocky 8 | pki-deps:10.6::slf4j-jdk14 | 1.7.25-4.module+el8.5.0+697+f586bb30 |
| rocky 8 | pki-deps:10.6::stax-ex | 1.7.7-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::velocity | 1.7-24.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xalan-j2 | 2.7.1-38.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xerces-j2 | 2.11.0-34.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xml-commons-apis | 1.4.01-25.module+el8.5.0+697+f586bb30 |
| rocky 8 | pki-deps:10.6::xml-commons-resolver | 1.2-26.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xmlstreambuffer | 1.5.4-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xsom | 0-19.20110809svn.module+el8.3.0+53+ea062990 |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.14 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.14 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.6 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.6 |
| ubuntu 17.10 | tomcat8 | 8.5.21-1ubuntu1.1 |
| ubuntu 18.04 | tomcat8 | 8.5.30-1ubuntu1.2 |
| ubuntu 18.04-ESM | tomcat8 | 8.5.30-1ubuntu1.2 |
| ubuntu 18.10 | tomcat8 | 8.5.30-1ubuntu3 |
Referenzen
- http://tomcat.apache.org/security-7.html
- http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.89
- http://tomcat.apache.org/security-8.html
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.53
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32
- http://tomcat.apache.org/security-9.html
- http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.9
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Alle 70 Referenzen
- http://www.securityfocus.com/bid/104203
- http://www.securitytracker.com/id/1040998
- http://www.securitytracker.com/id/1041888
- https://access.redhat.com/errata/RHSA-2018:2469
- https://access.redhat.com/errata/RHSA-2018:2470
- https://access.redhat.com/errata/RHSA-2018:3768
- https://access.redhat.com/errata/RHSA-2019:0450
- https://access.redhat.com/errata/RHSA-2019:0451
- https://access.redhat.com/errata/RHSA-2019:1529
- https://access.redhat.com/errata/RHSA-2019:2205
- https://access.redhat.com/security/cve/CVE-2018-8014
- https://bugzilla.redhat.com/show_bug.cgi?id=1579611
- https://bugzilla.redhat.com/show_bug.cgi?id=1607580
- https://bugzilla.redhat.com/show_bug.cgi?id=1607582
- https://bugzilla.redhat.com/show_bug.cgi?id=1636512
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11784
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8014
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8034
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8037
- https://errata.almalinux.org/8/ALSA-2019-1529.html
- https://errata.rockylinux.org/RLSA-2019:1529
- https://github.com/advisories/GHSA-r4x2-3cq5-hqvp
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/5877390a9605f56d9bd6859a54ccbfb16374a78b
- https://github.com/apache/tomcat/commit/60f596a21fd6041335a3a1a4015d4512439cecb5
- https://github.com/apache/tomcat/commit/d83a76732e6804739b81d8b2056365307637b42d
- https://github.com/apache/tomcat80/commit/2c9d8433bd3247a2856d4b2555447108758e813e
- https://linux.oracle.com/cve/CVE-2018-8014.html
- https://linux.oracle.com/errata/ELSA-2019-2205.html
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html
- https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-8014
- https://seclists.org/bugtraq/2019/Dec/43
- https://security.netapp.com/advisory/ntap-20181018-0002
- https://security.netapp.com/advisory/ntap-20181018-0002/
- https://ubuntu.com/security/notices/USN-3665-1
- https://usn.ubuntu.com/3665-1
- https://usn.ubuntu.com/3665-1/
- https://web.archive.org/web/20181017143233/http://www.securityfocus.com/bid/104203
- https://web.archive.org/web/20201207080723/http://www.securitytracker.com/id/1041888
- https://web.archive.org/web/20201207101131/http://www.securitytracker.com/id/1040998
- https://www.cve.org/CVERecord?id=CVE-2018-8014
- https://www.debian.org/security/2019/dsa-4596
- https://www.oracle.com/security-alerts/cpuapr2020.html