critique
CVE-2016-8735
tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Red Hat8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA. Plus basse selon Red Hat (élevée), Amazon (élevée), Ubuntu (élevée).
Description
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-catalina-jmx-remote | 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12 |
| amazon linux 1 | tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp et 26 autres | 6.0.48-1.8.amzn1 et 2 autres |
| debian 7 | tomcat6, tomcat7 | 6.0.45+dfsg-1~deb7u3 et 1 autres |
| debian 8 | tomcat7, tomcat8 | 7.0.56-3+deb8u6 et 1 autres |
| Red Hat | tomcat6, tomcat6-admin-webapps, tomcat6-docs-webapp et 21 autres | pas de correctif indiqué |
| ubuntu 12.04 | tomcat6 | 6.0.35-1ubuntu3.9 |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 16.04 | tomcat6, tomcat7, tomcat8 | 6.0.45+dfsg-1ubuntu0.1 et 2 autres |
| ubuntu 16.04-ESM | tomcat6, tomcat7, tomcat8 | 6.0.45+dfsg-1ubuntu0.1 et 2 autres |
| ubuntu 16.10 | tomcat8 | 8.0.37-1ubuntu0.1 |
| ubuntu 17.04 | tomcat8 | 8.0.38-2ubuntu1 |
Afficher les 74 entrées de 16 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina | 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12 |
| maven::GitHub Security Advisory Maven | org.apache.tomcat:tomcat-catalina-jmx-remote | 6.0.48, 7.0.73, 8.0.39, 8.5.7, 9.0.0.M12 |
| amazon linux 1 | tomcat6 | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-admin-webapps | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-docs-webapp | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-el-2.1-api | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-javadoc | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-jsp-2.1-api | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-lib | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-servlet-2.5-api | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat6-webapps | 6.0.48-1.8.amzn1 |
| amazon linux 1 | tomcat7 | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-admin-webapps | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-docs-webapp | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-el-2.2-api | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-javadoc | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-jsp-2.2-api | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-lib | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-log4j | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-servlet-3.0-api | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat7-webapps | 7.0.73-1.23.amzn1 |
| amazon linux 1 | tomcat8 | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-admin-webapps | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-docs-webapp | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-el-3.0-api | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-javadoc | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-jsp-2.3-api | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-lib | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-log4j | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-servlet-3.1-api | 8.0.39-1.67.amzn1 |
| amazon linux 1 | tomcat8-webapps | 8.0.39-1.67.amzn1 |
| debian 7 | tomcat6 | 6.0.45+dfsg-1~deb7u3 |
| debian 7 | tomcat7 | 7.0.28-4+deb7u7 |
| debian 8 | tomcat7 | 7.0.56-3+deb8u6 |
| debian 8 | tomcat8 | 8.0.14-1+deb8u5 |
| Red Hat | tomcat6 | pas de correctif indiqué |
| Red Hat | tomcat6-admin-webapps | pas de correctif indiqué |
| Red Hat | tomcat6-docs-webapp | pas de correctif indiqué |
| Red Hat | tomcat6-el-1.0-api | pas de correctif indiqué |
| Red Hat | tomcat6-el-2.1-api | pas de correctif indiqué |
| Red Hat | tomcat6-javadoc | pas de correctif indiqué |
| Red Hat | tomcat6-jsp-2.1-api | pas de correctif indiqué |
| Red Hat | tomcat6-lib | pas de correctif indiqué |
| Red Hat | tomcat6-log4j | pas de correctif indiqué |
| Red Hat | tomcat6-maven-devel | pas de correctif indiqué |
| Red Hat | tomcat6-servlet-2.5-api | pas de correctif indiqué |
| Red Hat | tomcat6-webapps | pas de correctif indiqué |
| Red Hat | tomcat7 | pas de correctif indiqué |
| Red Hat | tomcat7-admin-webapps | pas de correctif indiqué |
| Red Hat | tomcat7-docs-webapp | pas de correctif indiqué |
| Red Hat | tomcat7-el-1.0-api | pas de correctif indiqué |
| Red Hat | tomcat7-el-2.2-api | pas de correctif indiqué |
| Red Hat | tomcat7-javadoc | pas de correctif indiqué |
| Red Hat | tomcat7-jsp-2.2-api | pas de correctif indiqué |
| Red Hat | tomcat7-lib | pas de correctif indiqué |
| Red Hat | tomcat7-log4j | pas de correctif indiqué |
| Red Hat | tomcat7-maven-devel | pas de correctif indiqué |
| Red Hat | tomcat7-servlet-3.0-api | pas de correctif indiqué |
| Red Hat | tomcat7-webapps | pas de correctif indiqué |
| ubuntu 12.04 | tomcat6 | 6.0.35-1ubuntu3.9 |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.8 |
| ubuntu 16.04 | tomcat6 | 6.0.45+dfsg-1ubuntu0.1 |
| ubuntu 16.04 | tomcat7 | 7.0.68-1ubuntu0.3 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.3 |
| ubuntu 16.04-ESM | tomcat6 | 6.0.45+dfsg-1ubuntu0.1 |
| ubuntu 16.04-ESM | tomcat7 | 7.0.68-1ubuntu0.3 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.3 |
| ubuntu 16.10 | tomcat8 | 8.0.37-1ubuntu0.1 |
| ubuntu 17.04 | tomcat8 | 8.0.38-2ubuntu1 |
| ubuntu 17.10 | tomcat8 | 8.0.38-2ubuntu1 |
| ubuntu 18.04 | tomcat8 | 8.0.38-2ubuntu1 |
| ubuntu 18.04-ESM | tomcat8 | 8.0.38-2ubuntu1 |
| ubuntu 18.10 | tomcat8 | 8.0.38-2ubuntu1 |
Références
- http://rhn.redhat.com/errata/RHSA-2017-0457.html
- http://seclists.org/oss-sec/2016/q4/502
- http://svn.apache.org/viewvc?view=revision&revision=1767644
- http://svn.apache.org/viewvc?view=revision&revision=1767656
- http://svn.apache.org/viewvc?view=revision&revision=1767676
- http://svn.apache.org/viewvc?view=revision&revision=1767684
- http://tomcat.apache.org/security-6.html
- http://tomcat.apache.org/security-7.html
Les 59 références
- http://tomcat.apache.org/security-8.html
- http://tomcat.apache.org/security-9.html
- http://www.debian.org/security/2016/dsa-3738
- http://www.openwall.com/lists/oss-security/2016/11/22/16
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securityfocus.com/bid/94463
- http://www.securitytracker.com/id/1037331
- https://access.redhat.com/errata/RHSA-2017:0455
- https://access.redhat.com/errata/RHSA-2017:0456
- https://access.redhat.com/security/cve/CVE-2016-8735
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/0e83ad3e547fc9a75a258799ef581249b40a82a6
- https://github.com/apache/tomcat/commit/292d6ccdc9edbf80859929b0af070b2ea99fa688
- https://github.com/apache/tomcat/commit/7e3a037055cca4a17e90b49399fb1bab4dd7c821
- https://github.com/apache/tomcat80/commit/0f76016a4ec45635e450ada9c84ff7ee0c5f3799
- https://github.com/search?q=repo%3Aapache%2Ftomcat+catalina.mbeans+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=code
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-8735
- https://security.netapp.com/advisory/ntap-20180607-0001
- https://security.netapp.com/advisory/ntap-20180607-0001/
- https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
- https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
- https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
- https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8
- https://ubuntu.com/security/notices/USN-3177-1
- https://ubuntu.com/security/notices/USN-4557-1
- https://ubuntu.com/security/notices/USN-7242-1
- https://usn.ubuntu.com/4557-1
- https://usn.ubuntu.com/4557-1/
- https://web.archive.org/web/20170423095340/http://www.securityfocus.com/bid/94463
- https://web.archive.org/web/20170928203901/http://www.securitytracker.com/id/1037331
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-8735
- https://www.cve.org/CVERecord?id=CVE-2016-8735
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html