critique
CVE-2018-8014
tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.7CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, Photon OS. Plus basse selon AlmaLinux (élevée), Amazon (élevée), Rocky Linux (élevée), Red Hat (moyenne), Oracle (moyenne), Ubuntu (faible).
Description
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.9, 8.5.32, 8.0.53, 7.0.88 |
| Photon OS 1.0 | apache-tomcat | 8.5.31-2.ph1 |
| Photon OS 2.0 | apache-tomcat | 8.5.31-3.ph2 |
| Photon OS 3.0 | apache-tomcat | 8.5.37-1.ph3 |
| alma 8 | pki-deps:10.6::apache-commons-collections, pki-deps:10.6::apache-commons-lang, pki-deps:10.6::bea-stax-api et 22 autres | 3.2.2-10.module_el8.5.0+150+5f0dbea0 et 20 autres |
| amazon linux 1 | tomcat7, tomcat7-admin-webapps, tomcat7-docs-webapp et 27 autres | 7.0.90-1.33.amzn1 et 2 autres |
| amazon linux 2 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp et 7 autres | 7.0.76-10.amzn2.0.1 |
| debian 8 | tomcat7, tomcat8 | 7.0.56-3+really7.0.88-1 et 1 autres |
| debian 9 | tomcat8 | 8.5.50-0+deb9u1 |
| Oracle Linux 7 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp et 7 autres | 7.0.76-9.el7 |
| Oracle Linux 8 | apache-commons-collections, apache-commons-lang, bea-stax-api et 30 autres | 3.2.2-10.module+el8.0.0+5231+3e842911 et 22 autres |
| Red Hat | jws5-tomcat, tomcat7, tomcat7-admin-webapps et 10 autres | pas de correctif indiqué |
Afficher les 163 entrées de 21 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.9, 8.5.32, 8.0.53, 7.0.88 |
| Photon OS 1.0 | apache-tomcat | 8.5.31-2.ph1 |
| Photon OS 2.0 | apache-tomcat | 8.5.31-3.ph2 |
| Photon OS 3.0 | apache-tomcat | 8.5.37-1.ph3 |
| alma 8 | pki-deps:10.6::apache-commons-collections | 3.2.2-10.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::apache-commons-lang | 2.6-21.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::bea-stax-api | 1.2.0-16.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-fastinfoset | 1.2.13-9.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-api | 2.2.12-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-core | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-runtime | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-txw2 | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::jackson-module-jaxb-annotations | 2.7.6-4.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::jakarta-commons-httpclient | 1:3.1-28.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::javassist | 3.18.1-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::javassist-javadoc | 3.18.1-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::python-nss-doc | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma |
| alma 8 | pki-deps:10.6::python3-nss | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma |
| alma 8 | pki-deps:10.6::relaxngDatatype | 2011.1-7.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::slf4j | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
| alma 8 | pki-deps:10.6::slf4j-jdk14 | 1.7.25-4.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::stax-ex | 1.7.7-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::velocity | 1.7-24.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xalan-j2 | 2.7.1-38.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xerces-j2 | 2.11.0-34.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xml-commons-apis | 1.4.01-25.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xml-commons-resolver | 1.2-26.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xmlstreambuffer | 1.5.4-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xsom | 0-19.20110809svn.module_el8.5.0+150+5f0dbea0 |
| amazon linux 1 | tomcat7 | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-admin-webapps | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-docs-webapp | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-el-2.2-api | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-javadoc | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-jsp-2.2-api | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-lib | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-log4j | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-servlet-3.0-api | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-webapps | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat8 | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-admin-webapps | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-docs-webapp | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-el-3.0-api | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-javadoc | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-jsp-2.3-api | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-lib | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-log4j | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-servlet-3.1-api | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-webapps | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat80 | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-admin-webapps | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-docs-webapp | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-el-3.0-api | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-javadoc | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-jsp-2.3-api | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-lib | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-log4j | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-servlet-3.1-api | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-webapps | 8.0.53-1.80.amzn1 |
| amazon linux 2 | tomcat | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-admin-webapps | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-docs-webapp | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-el-2.2-api | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-javadoc | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-jsp-2.2-api | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-jsvc | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-lib | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-servlet-3.0-api | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-webapps | 7.0.76-10.amzn2.0.1 |
| debian 8 | tomcat7 | 7.0.56-3+really7.0.88-1 |
| debian 8 | tomcat8 | 8.0.14-1+deb8u15 |
| debian 9 | tomcat8 | 8.5.50-0+deb9u1 |
| Oracle Linux 7 | tomcat | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-admin-webapps | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-docs-webapp | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-el-2.2-api | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-javadoc | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-jsp-2.2-api | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-jsvc | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-lib | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-servlet-3.0-api | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-webapps | 7.0.76-9.el7 |
| Oracle Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | apache-commons-lang | 2.6-21.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | bea-stax-api | 1.2.0-16.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-core | 2.2.11-11.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-runtime | 2.2.11-11.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-txw2 | 2.2.11-11.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-annotations | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-core | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-databind | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-jaxrs-json-provider | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-jaxrs-providers | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | javassist | 3.18.1-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | javassist-javadoc | 3.18.1-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | pki-servlet-4.0-api | 1:9.0.7-14.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | pki-servlet-container | 1:9.0.7-14.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | python-nss-doc | 1.0.1-10.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | python3-nss | 1.0.1-10.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | relaxngDatatype | 2011.1-7.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | resteasy | 3.0.26-3.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | slf4j | 1.7.25-4.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | slf4j-jdk14 | 1.7.25-4.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | stax-ex | 1.7.7-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | velocity | 1.7-24.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xalan-j2 | 2.7.1-38.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xerces-j2 | 2.11.0-34.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xml-commons-resolver | 1.2-26.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xsom | 0-19.20110809svn.module+el8.0.0+5231+3e842911 |
| Red Hat | jws5-tomcat | pas de correctif indiqué |
| Red Hat | tomcat7 | pas de correctif indiqué |
| Red Hat | tomcat7-admin-webapps | pas de correctif indiqué |
| Red Hat | tomcat7-docs-webapp | pas de correctif indiqué |
| Red Hat | tomcat7-el-1.0-api | pas de correctif indiqué |
| Red Hat | tomcat7-el-2.2-api | pas de correctif indiqué |
| Red Hat | tomcat7-javadoc | pas de correctif indiqué |
| Red Hat | tomcat7-jsp-2.2-api | pas de correctif indiqué |
| Red Hat | tomcat7-lib | pas de correctif indiqué |
| Red Hat | tomcat7-log4j | pas de correctif indiqué |
| Red Hat | tomcat7-maven-devel | pas de correctif indiqué |
| Red Hat | tomcat7-servlet-3.0-api | pas de correctif indiqué |
| Red Hat | tomcat7-webapps | pas de correctif indiqué |
| rocky 8 | maven:3.5::slf4j | 1.7.25-4.module+el8.3.0+133+b8b54b58 |
| rocky 8 | pki-deps:10.6::apache-commons-collections | 3.2.2-10.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::apache-commons-lang | 2.6-21.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::bea-stax-api | 1.2.0-16.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-core | 2.2.11-11.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-runtime | 2.2.11-11.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-txw2 | 2.2.11-11.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::javassist | 3.18.1-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::javassist-javadoc | 3.18.1-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::python-nss-doc | 1.0.1-10.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::python3-nss | 1.0.1-10.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::relaxngDatatype | 2011.1-7.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::resteasy | 3.0.26-3.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::slf4j | 1.7.25-4.module+el8.5.0+697+f586bb30 |
| rocky 8 | pki-deps:10.6::slf4j-jdk14 | 1.7.25-4.module+el8.5.0+697+f586bb30 |
| rocky 8 | pki-deps:10.6::stax-ex | 1.7.7-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::velocity | 1.7-24.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xalan-j2 | 2.7.1-38.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xerces-j2 | 2.11.0-34.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xml-commons-apis | 1.4.01-25.module+el8.5.0+697+f586bb30 |
| rocky 8 | pki-deps:10.6::xml-commons-resolver | 1.2-26.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xmlstreambuffer | 1.5.4-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xsom | 0-19.20110809svn.module+el8.3.0+53+ea062990 |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.14 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.14 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.6 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.6 |
| ubuntu 17.10 | tomcat8 | 8.5.21-1ubuntu1.1 |
| ubuntu 18.04 | tomcat8 | 8.5.30-1ubuntu1.2 |
| ubuntu 18.04-ESM | tomcat8 | 8.5.30-1ubuntu1.2 |
| ubuntu 18.10 | tomcat8 | 8.5.30-1ubuntu3 |
Références
- http://tomcat.apache.org/security-7.html
- http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.89
- http://tomcat.apache.org/security-8.html
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.53
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32
- http://tomcat.apache.org/security-9.html
- http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.9
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Les 70 références
- http://www.securityfocus.com/bid/104203
- http://www.securitytracker.com/id/1040998
- http://www.securitytracker.com/id/1041888
- https://access.redhat.com/errata/RHSA-2018:2469
- https://access.redhat.com/errata/RHSA-2018:2470
- https://access.redhat.com/errata/RHSA-2018:3768
- https://access.redhat.com/errata/RHSA-2019:0450
- https://access.redhat.com/errata/RHSA-2019:0451
- https://access.redhat.com/errata/RHSA-2019:1529
- https://access.redhat.com/errata/RHSA-2019:2205
- https://access.redhat.com/security/cve/CVE-2018-8014
- https://bugzilla.redhat.com/show_bug.cgi?id=1579611
- https://bugzilla.redhat.com/show_bug.cgi?id=1607580
- https://bugzilla.redhat.com/show_bug.cgi?id=1607582
- https://bugzilla.redhat.com/show_bug.cgi?id=1636512
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11784
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8014
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8034
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8037
- https://errata.almalinux.org/8/ALSA-2019-1529.html
- https://errata.rockylinux.org/RLSA-2019:1529
- https://github.com/advisories/GHSA-r4x2-3cq5-hqvp
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/5877390a9605f56d9bd6859a54ccbfb16374a78b
- https://github.com/apache/tomcat/commit/60f596a21fd6041335a3a1a4015d4512439cecb5
- https://github.com/apache/tomcat/commit/d83a76732e6804739b81d8b2056365307637b42d
- https://github.com/apache/tomcat80/commit/2c9d8433bd3247a2856d4b2555447108758e813e
- https://linux.oracle.com/cve/CVE-2018-8014.html
- https://linux.oracle.com/errata/ELSA-2019-2205.html
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html
- https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-8014
- https://seclists.org/bugtraq/2019/Dec/43
- https://security.netapp.com/advisory/ntap-20181018-0002
- https://security.netapp.com/advisory/ntap-20181018-0002/
- https://ubuntu.com/security/notices/USN-3665-1
- https://usn.ubuntu.com/3665-1
- https://usn.ubuntu.com/3665-1/
- https://web.archive.org/web/20181017143233/http://www.securityfocus.com/bid/104203
- https://web.archive.org/web/20201207080723/http://www.securitytracker.com/id/1041888
- https://web.archive.org/web/20201207101131/http://www.securitytracker.com/id/1040998
- https://www.cve.org/CVERecord?id=CVE-2018-8014
- https://www.debian.org/security/2019/dsa-4596
- https://www.oracle.com/security-alerts/cpuapr2020.html