critique
CVE-2016-5018
tomcat: security manager bypass via IntrospectHelper utility function
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat4.2CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA. Plus basse selon Amazon (élevée), Ubuntu (moyenne), Red Hat (faible), Oracle (faible).
Description
In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-jasper, org.apache.tomcat:jasper, org.apache.tomcat:tomcat-jasper | 9.0.0.M10, 8.5.5, 8.0.37, 7.0.72, 6.0.47 et 2 autres |
| amazon linux 1 | tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp et 26 autres | 6.0.47-1.7.amzn1 et 2 autres |
| debian 7 | tomcat6, tomcat7 | 6.0.45+dfsg-1~deb7u3 et 1 autres |
| debian 8 | tomcat7, tomcat8 | 7.0.56-3+deb8u5 et 1 autres |
| Oracle Linux 7 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp et 7 autres | 7.0.76-2.el7 |
| Red Hat | tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp et 21 autres | pas de correctif indiqué |
| ubuntu 12.04 | tomcat6 | 6.0.35-1ubuntu3.9 |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 16.04 | tomcat7, tomcat8 | 7.0.68-1ubuntu0.3 et 1 autres |
| ubuntu 16.04-ESM | tomcat7, tomcat8 | 7.0.68-1ubuntu0.3 et 1 autres |
Afficher les 77 entrées de 11 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-jasper | 9.0.0.M10, 8.5.5, 8.0.37, 7.0.72, 6.0.47 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:jasper | 6.0.47 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-jasper | 9.0.0.M10, 8.5.5, 8.0.37, 7.0.72 |
| amazon linux 1 | tomcat6 | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-admin-webapps | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-docs-webapp | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-el-2.1-api | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-javadoc | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-jsp-2.1-api | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-lib | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-servlet-2.5-api | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat6-webapps | 6.0.47-1.7.amzn1 |
| amazon linux 1 | tomcat7 | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-admin-webapps | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-docs-webapp | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-el-2.2-api | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-javadoc | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-jsp-2.2-api | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-lib | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-log4j | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-servlet-3.0-api | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat7-webapps | 7.0.72-1.21.amzn1 |
| amazon linux 1 | tomcat8 | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-admin-webapps | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-docs-webapp | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-el-3.0-api | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-javadoc | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-jsp-2.3-api | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-lib | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-log4j | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-servlet-3.1-api | 8.0.38-1.65.amzn1 |
| amazon linux 1 | tomcat8-webapps | 8.0.38-1.65.amzn1 |
| debian 7 | tomcat6 | 6.0.45+dfsg-1~deb7u3 |
| debian 7 | tomcat7 | 7.0.28-4+deb7u7 |
| debian 8 | tomcat7 | 7.0.56-3+deb8u5 |
| debian 8 | tomcat8 | 8.0.14-1+deb8u4 |
| Oracle Linux 7 | tomcat | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-admin-webapps | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-docs-webapp | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-el-2.2-api | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-javadoc | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-jsp-2.2-api | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-jsvc | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-lib | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-servlet-3.0-api | 7.0.76-2.el7 |
| Oracle Linux 7 | tomcat-webapps | 7.0.76-2.el7 |
| Red Hat | tomcat6 | pas de correctif indiqué |
| Red Hat | tomcat6-admin-webapps | pas de correctif indiqué |
| Red Hat | tomcat6-docs-webapp | pas de correctif indiqué |
| Red Hat | tomcat6-el-1.0-api | pas de correctif indiqué |
| Red Hat | tomcat6-el-2.1-api | pas de correctif indiqué |
| Red Hat | tomcat6-javadoc | pas de correctif indiqué |
| Red Hat | tomcat6-jsp-2.1-api | pas de correctif indiqué |
| Red Hat | tomcat6-lib | pas de correctif indiqué |
| Red Hat | tomcat6-log4j | pas de correctif indiqué |
| Red Hat | tomcat6-maven-devel | pas de correctif indiqué |
| Red Hat | tomcat6-servlet-2.5-api | pas de correctif indiqué |
| Red Hat | tomcat6-webapps | pas de correctif indiqué |
| Red Hat | tomcat7 | pas de correctif indiqué |
| Red Hat | tomcat7-admin-webapps | pas de correctif indiqué |
| Red Hat | tomcat7-docs-webapp | pas de correctif indiqué |
| Red Hat | tomcat7-el-1.0-api | pas de correctif indiqué |
| Red Hat | tomcat7-el-2.2-api | pas de correctif indiqué |
| Red Hat | tomcat7-javadoc | pas de correctif indiqué |
| Red Hat | tomcat7-jsp-2.2-api | pas de correctif indiqué |
| Red Hat | tomcat7-lib | pas de correctif indiqué |
| Red Hat | tomcat7-log4j | pas de correctif indiqué |
| Red Hat | tomcat7-maven-devel | pas de correctif indiqué |
| Red Hat | tomcat7-servlet-3.0-api | pas de correctif indiqué |
| Red Hat | tomcat7-webapps | pas de correctif indiqué |
| ubuntu 12.04 | tomcat6 | 6.0.35-1ubuntu3.9 |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 16.04 | tomcat7 | 7.0.68-1ubuntu0.3 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.3 |
| ubuntu 16.04-ESM | tomcat7 | 7.0.68-1ubuntu0.3 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.3 |
Références
- http://markmail.org/message/lixw6iyojoxwfizv?q=list:org.apache.tomcat.announce/
- http://packetstormsecurity.com/files/155873/Tomcat-9.0.0.M1-Sandbox-Escape.html
- http://rhn.redhat.com/errata/RHSA-2017-0457.html
- http://rhn.redhat.com/errata/RHSA-2017-1551.html
- http://www.debian.org/security/2016/dsa-3720
- http://www.securityfocus.com/bid/93942
- http://www.securitytracker.com/id/1037142
- http://www.securitytracker.com/id/1038757
Les 51 références
- https://access.redhat.com/errata/RHSA-2017:0455
- https://access.redhat.com/errata/RHSA-2017:0456
- https://access.redhat.com/errata/RHSA-2017:1548
- https://access.redhat.com/errata/RHSA-2017:1549
- https://access.redhat.com/errata/RHSA-2017:1550
- https://access.redhat.com/errata/RHSA-2017:1552
- https://access.redhat.com/errata/RHSA-2017:2247
- https://access.redhat.com/security/cve/CVE-2016-5018
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/648122fef84d3b43223e0b5ae668f84719dada0a
- https://github.com/apache/tomcat/commit/890a2f681ed2f3461b27983d7da9737375ff2ae4
- https://github.com/apache/tomcat/commit/a6b1ebc246b91b854237e5aad3dfd2b5460ea282
- https://github.com/search?q=repo%3Aapache%2Ftomcat+jasper.runtime+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=code
- https://linux.oracle.com/cve/CVE-2016-5018.html
- https://linux.oracle.com/errata/ELSA-2017-2247.html
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/9b3a63a20c87179815fdea14f6766853bafe79a0042dc0b4aa878a9e@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-5018
- https://security.netapp.com/advisory/ntap-20180605-0001
- https://security.netapp.com/advisory/ntap-20180605-0001/
- https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47
- https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72
- https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37
- https://ubuntu.com/security/notices/USN-3177-1
- https://ubuntu.com/security/notices/USN-4557-1
- https://usn.ubuntu.com/4557-1
- https://usn.ubuntu.com/4557-1/
- https://web.archive.org/web/20161125134649/http://www.securityfocus.com/bid/93942
- https://web.archive.org/web/20170908024318/http://www.securitytracker.com/id/1037142
- https://web.archive.org/web/20171012232225/http://www.securitytracker.com/id/1038757
- https://www.cve.org/CVERecord?id=CVE-2016-5018
- https://www.oracle.com/security-alerts/cpuoct2021.html