crítica
CVE-2018-8014
tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.7CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Photon OS. Más baja según AlmaLinux (alta), Amazon (alta), Rocky Linux (alta), Red Hat (media), Oracle (media), Ubuntu (baja).
Descripción
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.9, 8.5.32, 8.0.53, 7.0.88 |
| Photon OS 1.0 | apache-tomcat | 8.5.31-2.ph1 |
| Photon OS 2.0 | apache-tomcat | 8.5.31-3.ph2 |
| Photon OS 3.0 | apache-tomcat | 8.5.37-1.ph3 |
| alma 8 | pki-deps:10.6::apache-commons-collections, pki-deps:10.6::apache-commons-lang, pki-deps:10.6::bea-stax-api y 22 más | 3.2.2-10.module_el8.5.0+150+5f0dbea0 y 20 más |
| amazon linux 1 | tomcat7, tomcat7-admin-webapps, tomcat7-docs-webapp y 27 más | 7.0.90-1.33.amzn1 y 2 más |
| amazon linux 2 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp y 7 más | 7.0.76-10.amzn2.0.1 |
| debian 8 | tomcat7, tomcat8 | 7.0.56-3+really7.0.88-1 y 1 más |
| debian 9 | tomcat8 | 8.5.50-0+deb9u1 |
| Oracle Linux 7 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp y 7 más | 7.0.76-9.el7 |
| Oracle Linux 8 | apache-commons-collections, apache-commons-lang, bea-stax-api y 30 más | 3.2.2-10.module+el8.0.0+5231+3e842911 y 22 más |
| Red Hat | jws5-tomcat, tomcat7, tomcat7-admin-webapps y 10 más | sin corrección indicada |
Mostrar las 163 entradas de 21 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.9, 8.5.32, 8.0.53, 7.0.88 |
| Photon OS 1.0 | apache-tomcat | 8.5.31-2.ph1 |
| Photon OS 2.0 | apache-tomcat | 8.5.31-3.ph2 |
| Photon OS 3.0 | apache-tomcat | 8.5.37-1.ph3 |
| alma 8 | pki-deps:10.6::apache-commons-collections | 3.2.2-10.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::apache-commons-lang | 2.6-21.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::bea-stax-api | 1.2.0-16.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-fastinfoset | 1.2.13-9.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-api | 2.2.12-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-core | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-runtime | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-txw2 | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::jackson-module-jaxb-annotations | 2.7.6-4.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::jakarta-commons-httpclient | 1:3.1-28.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::javassist | 3.18.1-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::javassist-javadoc | 3.18.1-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::python-nss-doc | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma |
| alma 8 | pki-deps:10.6::python3-nss | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma |
| alma 8 | pki-deps:10.6::relaxngDatatype | 2011.1-7.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::slf4j | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
| alma 8 | pki-deps:10.6::slf4j-jdk14 | 1.7.25-4.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::stax-ex | 1.7.7-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::velocity | 1.7-24.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xalan-j2 | 2.7.1-38.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xerces-j2 | 2.11.0-34.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xml-commons-apis | 1.4.01-25.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xml-commons-resolver | 1.2-26.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xmlstreambuffer | 1.5.4-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xsom | 0-19.20110809svn.module_el8.5.0+150+5f0dbea0 |
| amazon linux 1 | tomcat7 | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-admin-webapps | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-docs-webapp | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-el-2.2-api | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-javadoc | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-jsp-2.2-api | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-lib | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-log4j | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-servlet-3.0-api | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-webapps | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat8 | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-admin-webapps | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-docs-webapp | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-el-3.0-api | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-javadoc | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-jsp-2.3-api | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-lib | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-log4j | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-servlet-3.1-api | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-webapps | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat80 | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-admin-webapps | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-docs-webapp | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-el-3.0-api | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-javadoc | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-jsp-2.3-api | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-lib | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-log4j | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-servlet-3.1-api | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-webapps | 8.0.53-1.80.amzn1 |
| amazon linux 2 | tomcat | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-admin-webapps | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-docs-webapp | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-el-2.2-api | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-javadoc | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-jsp-2.2-api | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-jsvc | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-lib | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-servlet-3.0-api | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-webapps | 7.0.76-10.amzn2.0.1 |
| debian 8 | tomcat7 | 7.0.56-3+really7.0.88-1 |
| debian 8 | tomcat8 | 8.0.14-1+deb8u15 |
| debian 9 | tomcat8 | 8.5.50-0+deb9u1 |
| Oracle Linux 7 | tomcat | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-admin-webapps | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-docs-webapp | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-el-2.2-api | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-javadoc | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-jsp-2.2-api | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-jsvc | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-lib | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-servlet-3.0-api | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-webapps | 7.0.76-9.el7 |
| Oracle Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | apache-commons-lang | 2.6-21.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | bea-stax-api | 1.2.0-16.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-core | 2.2.11-11.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-runtime | 2.2.11-11.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-txw2 | 2.2.11-11.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-annotations | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-core | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-databind | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-jaxrs-json-provider | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-jaxrs-providers | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | javassist | 3.18.1-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | javassist-javadoc | 3.18.1-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | pki-servlet-4.0-api | 1:9.0.7-14.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | pki-servlet-container | 1:9.0.7-14.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | python-nss-doc | 1.0.1-10.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | python3-nss | 1.0.1-10.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | relaxngDatatype | 2011.1-7.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | resteasy | 3.0.26-3.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | slf4j | 1.7.25-4.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | slf4j-jdk14 | 1.7.25-4.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | stax-ex | 1.7.7-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | velocity | 1.7-24.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xalan-j2 | 2.7.1-38.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xerces-j2 | 2.11.0-34.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xml-commons-resolver | 1.2-26.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xsom | 0-19.20110809svn.module+el8.0.0+5231+3e842911 |
| Red Hat | jws5-tomcat | sin corrección indicada |
| Red Hat | tomcat7 | sin corrección indicada |
| Red Hat | tomcat7-admin-webapps | sin corrección indicada |
| Red Hat | tomcat7-docs-webapp | sin corrección indicada |
| Red Hat | tomcat7-el-1.0-api | sin corrección indicada |
| Red Hat | tomcat7-el-2.2-api | sin corrección indicada |
| Red Hat | tomcat7-javadoc | sin corrección indicada |
| Red Hat | tomcat7-jsp-2.2-api | sin corrección indicada |
| Red Hat | tomcat7-lib | sin corrección indicada |
| Red Hat | tomcat7-log4j | sin corrección indicada |
| Red Hat | tomcat7-maven-devel | sin corrección indicada |
| Red Hat | tomcat7-servlet-3.0-api | sin corrección indicada |
| Red Hat | tomcat7-webapps | sin corrección indicada |
| rocky 8 | maven:3.5::slf4j | 1.7.25-4.module+el8.3.0+133+b8b54b58 |
| rocky 8 | pki-deps:10.6::apache-commons-collections | 3.2.2-10.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::apache-commons-lang | 2.6-21.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::bea-stax-api | 1.2.0-16.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-core | 2.2.11-11.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-runtime | 2.2.11-11.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-txw2 | 2.2.11-11.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::javassist | 3.18.1-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::javassist-javadoc | 3.18.1-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::python-nss-doc | 1.0.1-10.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::python3-nss | 1.0.1-10.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::relaxngDatatype | 2011.1-7.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::resteasy | 3.0.26-3.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::slf4j | 1.7.25-4.module+el8.5.0+697+f586bb30 |
| rocky 8 | pki-deps:10.6::slf4j-jdk14 | 1.7.25-4.module+el8.5.0+697+f586bb30 |
| rocky 8 | pki-deps:10.6::stax-ex | 1.7.7-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::velocity | 1.7-24.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xalan-j2 | 2.7.1-38.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xerces-j2 | 2.11.0-34.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xml-commons-apis | 1.4.01-25.module+el8.5.0+697+f586bb30 |
| rocky 8 | pki-deps:10.6::xml-commons-resolver | 1.2-26.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xmlstreambuffer | 1.5.4-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xsom | 0-19.20110809svn.module+el8.3.0+53+ea062990 |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.14 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.14 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.6 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.6 |
| ubuntu 17.10 | tomcat8 | 8.5.21-1ubuntu1.1 |
| ubuntu 18.04 | tomcat8 | 8.5.30-1ubuntu1.2 |
| ubuntu 18.04-ESM | tomcat8 | 8.5.30-1ubuntu1.2 |
| ubuntu 18.10 | tomcat8 | 8.5.30-1ubuntu3 |
Referencias
- http://tomcat.apache.org/security-7.html
- http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.89
- http://tomcat.apache.org/security-8.html
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.53
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32
- http://tomcat.apache.org/security-9.html
- http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.9
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Las 70 referencias
- http://www.securityfocus.com/bid/104203
- http://www.securitytracker.com/id/1040998
- http://www.securitytracker.com/id/1041888
- https://access.redhat.com/errata/RHSA-2018:2469
- https://access.redhat.com/errata/RHSA-2018:2470
- https://access.redhat.com/errata/RHSA-2018:3768
- https://access.redhat.com/errata/RHSA-2019:0450
- https://access.redhat.com/errata/RHSA-2019:0451
- https://access.redhat.com/errata/RHSA-2019:1529
- https://access.redhat.com/errata/RHSA-2019:2205
- https://access.redhat.com/security/cve/CVE-2018-8014
- https://bugzilla.redhat.com/show_bug.cgi?id=1579611
- https://bugzilla.redhat.com/show_bug.cgi?id=1607580
- https://bugzilla.redhat.com/show_bug.cgi?id=1607582
- https://bugzilla.redhat.com/show_bug.cgi?id=1636512
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11784
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8014
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8034
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8037
- https://errata.almalinux.org/8/ALSA-2019-1529.html
- https://errata.rockylinux.org/RLSA-2019:1529
- https://github.com/advisories/GHSA-r4x2-3cq5-hqvp
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/5877390a9605f56d9bd6859a54ccbfb16374a78b
- https://github.com/apache/tomcat/commit/60f596a21fd6041335a3a1a4015d4512439cecb5
- https://github.com/apache/tomcat/commit/d83a76732e6804739b81d8b2056365307637b42d
- https://github.com/apache/tomcat80/commit/2c9d8433bd3247a2856d4b2555447108758e813e
- https://linux.oracle.com/cve/CVE-2018-8014.html
- https://linux.oracle.com/errata/ELSA-2019-2205.html
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html
- https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-8014
- https://seclists.org/bugtraq/2019/Dec/43
- https://security.netapp.com/advisory/ntap-20181018-0002
- https://security.netapp.com/advisory/ntap-20181018-0002/
- https://ubuntu.com/security/notices/USN-3665-1
- https://usn.ubuntu.com/3665-1
- https://usn.ubuntu.com/3665-1/
- https://web.archive.org/web/20181017143233/http://www.securityfocus.com/bid/104203
- https://web.archive.org/web/20201207080723/http://www.securitytracker.com/id/1041888
- https://web.archive.org/web/20201207101131/http://www.securitytracker.com/id/1040998
- https://www.cve.org/CVERecord?id=CVE-2018-8014
- https://www.debian.org/security/2019/dsa-4596
- https://www.oracle.com/security-alerts/cpuapr2020.html