critical
CVE-2018-8014
tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.7CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Photon OS. Rated lower by AlmaLinux (high), Amazon (high), Rocky Linux (high), Red Hat (medium), Oracle (medium), Ubuntu (low).
Description
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.9, 8.5.32, 8.0.53, 7.0.88 |
| Photon OS 1.0 | apache-tomcat | 8.5.31-2.ph1 |
| Photon OS 2.0 | apache-tomcat | 8.5.31-3.ph2 |
| Photon OS 3.0 | apache-tomcat | 8.5.37-1.ph3 |
| alma 8 | pki-deps:10.6::apache-commons-collections, pki-deps:10.6::apache-commons-lang, pki-deps:10.6::bea-stax-api and 22 more | 3.2.2-10.module_el8.5.0+150+5f0dbea0 and 20 more |
| amazon linux 1 | tomcat7, tomcat7-admin-webapps, tomcat7-docs-webapp and 27 more | 7.0.90-1.33.amzn1 and 2 more |
| amazon linux 2 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 7 more | 7.0.76-10.amzn2.0.1 |
| debian 8 | tomcat7, tomcat8 | 7.0.56-3+really7.0.88-1 and 1 more |
| debian 9 | tomcat8 | 8.5.50-0+deb9u1 |
| Oracle Linux 7 | tomcat, tomcat-admin-webapps, tomcat-docs-webapp and 7 more | 7.0.76-9.el7 |
| Oracle Linux 8 | apache-commons-collections, apache-commons-lang, bea-stax-api and 30 more | 3.2.2-10.module+el8.0.0+5231+3e842911 and 22 more |
| Red Hat | jws5-tomcat, tomcat7, tomcat7-admin-webapps and 10 more | no fix listed |
Show all 163 entries from 21 sources
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.9, 8.5.32, 8.0.53, 7.0.88 |
| Photon OS 1.0 | apache-tomcat | 8.5.31-2.ph1 |
| Photon OS 2.0 | apache-tomcat | 8.5.31-3.ph2 |
| Photon OS 3.0 | apache-tomcat | 8.5.37-1.ph3 |
| alma 8 | pki-deps:10.6::apache-commons-collections | 3.2.2-10.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::apache-commons-lang | 2.6-21.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::bea-stax-api | 1.2.0-16.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-fastinfoset | 1.2.13-9.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-api | 2.2.12-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-core | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-runtime | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::glassfish-jaxb-txw2 | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::jackson-module-jaxb-annotations | 2.7.6-4.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::jakarta-commons-httpclient | 1:3.1-28.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::javassist | 3.18.1-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::javassist-javadoc | 3.18.1-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::python-nss-doc | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma |
| alma 8 | pki-deps:10.6::python3-nss | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma |
| alma 8 | pki-deps:10.6::relaxngDatatype | 2011.1-7.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::slf4j | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
| alma 8 | pki-deps:10.6::slf4j-jdk14 | 1.7.25-4.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::stax-ex | 1.7.7-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::velocity | 1.7-24.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xalan-j2 | 2.7.1-38.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xerces-j2 | 2.11.0-34.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xml-commons-apis | 1.4.01-25.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xml-commons-resolver | 1.2-26.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xmlstreambuffer | 1.5.4-8.module_el8.5.0+150+5f0dbea0 |
| alma 8 | pki-deps:10.6::xsom | 0-19.20110809svn.module_el8.5.0+150+5f0dbea0 |
| amazon linux 1 | tomcat7 | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-admin-webapps | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-docs-webapp | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-el-2.2-api | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-javadoc | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-jsp-2.2-api | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-lib | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-log4j | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-servlet-3.0-api | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat7-webapps | 7.0.90-1.33.amzn1 |
| amazon linux 1 | tomcat8 | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-admin-webapps | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-docs-webapp | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-el-3.0-api | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-javadoc | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-jsp-2.3-api | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-lib | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-log4j | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-servlet-3.1-api | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat8-webapps | 8.5.32-1.78.amzn1 |
| amazon linux 1 | tomcat80 | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-admin-webapps | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-docs-webapp | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-el-3.0-api | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-javadoc | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-jsp-2.3-api | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-lib | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-log4j | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-servlet-3.1-api | 8.0.53-1.80.amzn1 |
| amazon linux 1 | tomcat80-webapps | 8.0.53-1.80.amzn1 |
| amazon linux 2 | tomcat | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-admin-webapps | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-docs-webapp | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-el-2.2-api | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-javadoc | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-jsp-2.2-api | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-jsvc | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-lib | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-servlet-3.0-api | 7.0.76-10.amzn2.0.1 |
| amazon linux 2 | tomcat-webapps | 7.0.76-10.amzn2.0.1 |
| debian 8 | tomcat7 | 7.0.56-3+really7.0.88-1 |
| debian 8 | tomcat8 | 8.0.14-1+deb8u15 |
| debian 9 | tomcat8 | 8.5.50-0+deb9u1 |
| Oracle Linux 7 | tomcat | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-admin-webapps | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-docs-webapp | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-el-2.2-api | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-javadoc | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-jsp-2.2-api | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-jsvc | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-lib | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-servlet-3.0-api | 7.0.76-9.el7 |
| Oracle Linux 7 | tomcat-webapps | 7.0.76-9.el7 |
| Oracle Linux 8 | apache-commons-collections | 3.2.2-10.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | apache-commons-lang | 2.6-21.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | bea-stax-api | 1.2.0-16.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-fastinfoset | 1.2.13-9.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-api | 2.2.12-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-core | 2.2.11-11.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-runtime | 2.2.11-11.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | glassfish-jaxb-txw2 | 2.2.11-11.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-annotations | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-core | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-databind | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-jaxrs-json-provider | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-jaxrs-providers | 2.9.8-1.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jackson-module-jaxb-annotations | 2.7.6-4.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | jakarta-commons-httpclient | 1:3.1-28.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | javassist | 3.18.1-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | javassist-javadoc | 3.18.1-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | pki-servlet-4.0-api | 1:9.0.7-14.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | pki-servlet-container | 1:9.0.7-14.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | python-nss-doc | 1.0.1-10.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | python3-nss | 1.0.1-10.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | relaxngDatatype | 2011.1-7.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | resteasy | 3.0.26-3.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | slf4j | 1.7.25-4.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | slf4j-jdk14 | 1.7.25-4.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | stax-ex | 1.7.7-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | velocity | 1.7-24.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xalan-j2 | 2.7.1-38.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xerces-j2 | 2.11.0-34.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xml-commons-apis | 1.4.01-25.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xml-commons-resolver | 1.2-26.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xmlstreambuffer | 1.5.4-8.module+el8.0.0+5231+3e842911 |
| Oracle Linux 8 | xsom | 0-19.20110809svn.module+el8.0.0+5231+3e842911 |
| Red Hat | jws5-tomcat | no fix listed |
| Red Hat | tomcat7 | no fix listed |
| Red Hat | tomcat7-admin-webapps | no fix listed |
| Red Hat | tomcat7-docs-webapp | no fix listed |
| Red Hat | tomcat7-el-1.0-api | no fix listed |
| Red Hat | tomcat7-el-2.2-api | no fix listed |
| Red Hat | tomcat7-javadoc | no fix listed |
| Red Hat | tomcat7-jsp-2.2-api | no fix listed |
| Red Hat | tomcat7-lib | no fix listed |
| Red Hat | tomcat7-log4j | no fix listed |
| Red Hat | tomcat7-maven-devel | no fix listed |
| Red Hat | tomcat7-servlet-3.0-api | no fix listed |
| Red Hat | tomcat7-webapps | no fix listed |
| rocky 8 | maven:3.5::slf4j | 1.7.25-4.module+el8.3.0+133+b8b54b58 |
| rocky 8 | pki-deps:10.6::apache-commons-collections | 3.2.2-10.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::apache-commons-lang | 2.6-21.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::bea-stax-api | 1.2.0-16.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-fastinfoset | 1.2.13-9.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-api | 2.2.12-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-core | 2.2.11-11.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-runtime | 2.2.11-11.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::glassfish-jaxb-txw2 | 2.2.11-11.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::jackson-module-jaxb-annotations | 2.7.6-4.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::jakarta-commons-httpclient | 1:3.1-28.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::javassist | 3.18.1-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::javassist-javadoc | 3.18.1-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::python-nss-doc | 1.0.1-10.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::python3-nss | 1.0.1-10.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::relaxngDatatype | 2011.1-7.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::resteasy | 3.0.26-3.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::slf4j | 1.7.25-4.module+el8.5.0+697+f586bb30 |
| rocky 8 | pki-deps:10.6::slf4j-jdk14 | 1.7.25-4.module+el8.5.0+697+f586bb30 |
| rocky 8 | pki-deps:10.6::stax-ex | 1.7.7-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::velocity | 1.7-24.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xalan-j2 | 2.7.1-38.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xerces-j2 | 2.11.0-34.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xml-commons-apis | 1.4.01-25.module+el8.5.0+697+f586bb30 |
| rocky 8 | pki-deps:10.6::xml-commons-resolver | 1.2-26.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xmlstreambuffer | 1.5.4-8.module+el8.3.0+53+ea062990 |
| rocky 8 | pki-deps:10.6::xsom | 0-19.20110809svn.module+el8.3.0+53+ea062990 |
| ubuntu 14.04 | tomcat7 | 7.0.52-1ubuntu0.14 |
| ubuntu 14.04-ESM | tomcat7 | 7.0.52-1ubuntu0.14 |
| ubuntu 16.04 | tomcat8 | 8.0.32-1ubuntu1.6 |
| ubuntu 16.04-ESM | tomcat8 | 8.0.32-1ubuntu1.6 |
| ubuntu 17.10 | tomcat8 | 8.5.21-1ubuntu1.1 |
| ubuntu 18.04 | tomcat8 | 8.5.30-1ubuntu1.2 |
| ubuntu 18.04-ESM | tomcat8 | 8.5.30-1ubuntu1.2 |
| ubuntu 18.10 | tomcat8 | 8.5.30-1ubuntu3 |
References
- http://tomcat.apache.org/security-7.html
- http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.89
- http://tomcat.apache.org/security-8.html
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.53
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32
- http://tomcat.apache.org/security-9.html
- http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.9
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
All 70 references
- http://www.securityfocus.com/bid/104203
- http://www.securitytracker.com/id/1040998
- http://www.securitytracker.com/id/1041888
- https://access.redhat.com/errata/RHSA-2018:2469
- https://access.redhat.com/errata/RHSA-2018:2470
- https://access.redhat.com/errata/RHSA-2018:3768
- https://access.redhat.com/errata/RHSA-2019:0450
- https://access.redhat.com/errata/RHSA-2019:0451
- https://access.redhat.com/errata/RHSA-2019:1529
- https://access.redhat.com/errata/RHSA-2019:2205
- https://access.redhat.com/security/cve/CVE-2018-8014
- https://bugzilla.redhat.com/show_bug.cgi?id=1579611
- https://bugzilla.redhat.com/show_bug.cgi?id=1607580
- https://bugzilla.redhat.com/show_bug.cgi?id=1607582
- https://bugzilla.redhat.com/show_bug.cgi?id=1636512
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11784
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8014
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8034
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8037
- https://errata.almalinux.org/8/ALSA-2019-1529.html
- https://errata.rockylinux.org/RLSA-2019:1529
- https://github.com/advisories/GHSA-r4x2-3cq5-hqvp
- https://github.com/apache/tomcat
- https://github.com/apache/tomcat/commit/5877390a9605f56d9bd6859a54ccbfb16374a78b
- https://github.com/apache/tomcat/commit/60f596a21fd6041335a3a1a4015d4512439cecb5
- https://github.com/apache/tomcat/commit/d83a76732e6804739b81d8b2056365307637b42d
- https://github.com/apache/tomcat80/commit/2c9d8433bd3247a2856d4b2555447108758e813e
- https://linux.oracle.com/cve/CVE-2018-8014.html
- https://linux.oracle.com/errata/ELSA-2019-2205.html
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html
- https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-8014
- https://seclists.org/bugtraq/2019/Dec/43
- https://security.netapp.com/advisory/ntap-20181018-0002
- https://security.netapp.com/advisory/ntap-20181018-0002/
- https://ubuntu.com/security/notices/USN-3665-1
- https://usn.ubuntu.com/3665-1
- https://usn.ubuntu.com/3665-1/
- https://web.archive.org/web/20181017143233/http://www.securityfocus.com/bid/104203
- https://web.archive.org/web/20201207080723/http://www.securitytracker.com/id/1041888
- https://web.archive.org/web/20201207101131/http://www.securitytracker.com/id/1040998
- https://www.cve.org/CVERecord?id=CVE-2018-8014
- https://www.debian.org/security/2019/dsa-4596
- https://www.oracle.com/security-alerts/cpuapr2020.html