crítica
CVE-2016-5018
tomcat: security manager bypass via IntrospectHelper utility function
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat4.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Amazon (alta), Ubuntu (media), Red Hat (baja), Oracle (baja).
Descripción
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-jasper, org.apache.tomcat:jasper, org.apache.tomcat:tomcat-jasper | 9.0.0.M10, 8.5.5, 8.0.37, 7.0.72, 6.0.47 y 2 más |
| amazon linux 1 | tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp y 26 más | 6.0.47-1.7.amzn1 y 2 más |
| debian 7 | tomcat6, tomcat7 | 6.0.45+dfsg-1~deb7u3 y 1 más |
| debian 8 | tomcat7, tomcat8 | 7.0.56-3+deb8u5 y 1 más |
| Oracle Linux 7 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp y 7 más | 7.0.76-2.el7 |
| Red Hat | tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp y 21 más | sin corrección indicada |
| ubuntu 12.04 | tomcat6 | 6.0.35-1ubuntu3.9 |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 16.04 | tomcat7, tomcat8 | 7.0.68-1ubuntu0.3 y 1 más |
| ubuntu 16.04-ESM | tomcat7, tomcat8 | 7.0.68-1ubuntu0.3 y 1 más |
Mostrar las 77 entradas de 11 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 9.0.0.M10, 8.5.5, 8.0.37, 7.0.72, 6.0.47 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:jasper | 6.0.47 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-jasper | 9.0.0.M10, 8.5.5, 8.0.37, 7.0.72 |
| amazon linux 1 | tomcat6 | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-admin-webapps | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-docs-webapp | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-el-2.1-api | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-javadoc | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-jsp-2.1-api | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-lib | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-servlet-2.5-api | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-webapps | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat7 | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-admin-webapps | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-docs-webapp | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-el-2.2-api | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-javadoc | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-jsp-2.2-api | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-lib | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-log4j | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-servlet-3.0-api | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-webapps | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat8 | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-admin-webapps | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-docs-webapp | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-el-3.0-api | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-javadoc | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-jsp-2.3-api | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-lib | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-log4j | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-servlet-3.1-api | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-webapps | 8.0.38-1.65.amzn1 |
| debian 7 | tomcat6 | 6.0.45+dfsg-1~deb7u3 |
| debian 7 | tomcat7 | 7.0.28-4+deb7u7 |
| debian 8 | tomcat7 | 7.0.56-3+deb8u5 |
| debian 8 | tomcat8 | 8.0.14-1+deb8u4 |
| Oracle Linux 7 | tomcat | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-admin-webapps | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-docs-webapp | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-el-2.2-api | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-javadoc | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-jsp-2.2-api | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-jsvc | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-lib | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-servlet-3.0-api | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-webapps | 7.0.76-2.el7 |
| Red Hat | tomcat6 | sin corrección indicada |
| Red Hat | tomcat6-admin-webapps | sin corrección indicada |
| Red Hat | tomcat6-docs-webapp | sin corrección indicada |
| Red Hat | tomcat6-el-1.0-api | sin corrección indicada |
| Red Hat | tomcat6-el-2.1-api | sin corrección indicada |
| Red Hat | tomcat6-javadoc | sin corrección indicada |
| Red Hat | tomcat6-jsp-2.1-api | sin corrección indicada |
| Red Hat | tomcat6-lib | sin corrección indicada |
| Red Hat | tomcat6-log4j | sin corrección indicada |
| Red Hat | tomcat6-maven-devel | sin corrección indicada |
| Red Hat | tomcat6-servlet-2.5-api | sin corrección indicada |
| Red Hat | tomcat6-webapps | sin corrección indicada |
| Red Hat | tomcat7 | sin corrección indicada |
| Red Hat | tomcat7-admin-webapps | sin corrección indicada |
| Red Hat | tomcat7-docs-webapp | sin corrección indicada |
| Red Hat | tomcat7-el-1.0-api | sin corrección indicada |
| Red Hat | tomcat7-el-2.2-api | sin corrección indicada |
| Red Hat | tomcat7-javadoc | sin corrección indicada |
| Red Hat | tomcat7-jsp-2.2-api | sin corrección indicada |
| Red Hat | tomcat7-lib | sin corrección indicada |
| Red Hat | tomcat7-log4j | sin corrección indicada |
| Red Hat | tomcat7-maven-devel | sin corrección indicada |
| Red Hat | tomcat7-servlet-3.0-api | sin corrección indicada |
| Red Hat | tomcat7-webapps | sin corrección indicada |
| ubuntu 12.04 | tomcat6 | 6.0.35-1ubuntu3.9 |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 16.04 | tomcat7 | 7.0.68-1ubuntu0.3 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.3 |
| ubuntu 16.04-ESM | tomcat7 | 7.0.68-1ubuntu0.3 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.3 |
Referencias
- http://markmail.org/message/lixw6iyojoxwfizv?q=list:org.apache.tomcat.announce/
- http://packetstormsecurity.com/files/155873/Tomcat-9.0.0.M1-Sandbox-Escape.html
- http://rhn.redhat.com/errata/RHSA-2017-0457.html
- http://rhn.redhat.com/errata/RHSA-2017-1551.html
- http://www.debian.org/security/2016/dsa-3720
- http://www.securityfocus.com/bid/93942
- http://www.securitytracker.com/id/1037142
- http://www.securitytracker.com/id/1038757
Las 51 referencias
- https://access.redhat.com/errata/RHSA-2017:0455
- https://access.redhat.com/errata/RHSA-2017:0456
- https://access.redhat.com/errata/RHSA-2017:1548
- https://access.redhat.com/errata/RHSA-2017:1549
- https://access.redhat.com/errata/RHSA-2017:1550
- https://access.redhat.com/errata/RHSA-2017:1552
- https://access.redhat.com/errata/RHSA-2017:2247
- https://access.redhat.com/security/cve/CVE-2016-5018
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/648122fef84d3b43223e0b5ae668f84719dada0a
- https://github.com/apache/tomcat/commit/890a2f681ed2f3461b27983d7da9737375ff2ae4
- https://github.com/apache/tomcat/commit/a6b1ebc246b91b854237e5aad3dfd2b5460ea282
- https://github.com/search?q=repo%3Aapache%2Ftomcat+jasper.runtime+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=code
- https://linux.oracle.com/cve/CVE-2016-5018.html
- https://linux.oracle.com/errata/ELSA-2017-2247.html
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/9b3a63a20c87179815fdea14f6766853bafe79a0042dc0b4aa878a9e@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-5018
- https://security.netapp.com/advisory/ntap-20180605-0001
- https://security.netapp.com/advisory/ntap-20180605-0001/
- https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47
- https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72
- https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37
- https://ubuntu.com/security/notices/USN-3177-1
- https://ubuntu.com/security/notices/USN-4557-1
- https://usn.ubuntu.com/4557-1
- https://usn.ubuntu.com/4557-1/
- https://web.archive.org/web/20161125134649/http://www.securityfocus.com/bid/93942
- https://web.archive.org/web/20170908024318/http://www.securitytracker.com/id/1037142
- https://web.archive.org/web/20171012232225/http://www.securitytracker.com/id/1038757
- https://www.cve.org/CVERecord?id=CVE-2016-5018
- https://www.oracle.com/security-alerts/cpuoct2021.html