{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat Fuse.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Fuse enables integration experts, application developers, and business users to collaborate and independently develop connected solutions.\n\nFuse is part of an agile integration solution. Its distributed approach allows teams to deploy integrated services where required. The API-centric, container-based architecture decouples services so they can be created, extended, and deployed independently.\n\nThis release of Red Hat Fuse 7.2 serves as a replacement for Red Hat Fuse 7.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* xmlrpc: Deserialization of untrusted Java object through \u003cex:serializable\u003e tag (CVE-2016-5003)\n\n* tomcat: A bug in the UTF-8 decoder can lead to DoS (CVE-2018-1336)\n\n* ignite: Improper deserialization allows for code execution via GridClientJdkMarshaller endpoint (CVE-2018-8018)\n\n* apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)\n\n* xmlrpc: XML external entity vulnerability SSRF via a crafted DTD (CVE-2016-5002)\n\n* undertow: Client can use bogus uri in Digest authentication (CVE-2017-12196)\n\n* spring-data-commons: XXE with Spring Data\u2019s XMLBeam integration (CVE-2018-1259)\n\n* kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass (CVE-2018-1288)\n\n* tomcat: Insecure defaults in CORS filter enable \u0027supportsCredentials\u0027 for all origins (CVE-2018-8014)\n\n* camel-mail: path traversal vulnerability (CVE-2018-8041)\n\n* vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers (CVE-2018-12537)\n\n* spring-framework: ReDoS Attack with spring-messaging (CVE-2018-1257)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank Eedo Shapira (GE Digital) for reporting CVE-2018-8041. The CVE-2017-12196 issue was discovered by Jan Stourac (Red Hat).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2018:3768",
        "url": "https://access.redhat.com/errata/RHSA-2018:3768"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=distributions\u0026version=7.2.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=distributions\u0026version=7.2.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.2/",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.2/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/2939351",
        "url": "https://access.redhat.com/articles/2939351"
      },
      {
        "category": "external",
        "summary": "1503055",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1503055"
      },
      {
        "category": "external",
        "summary": "1508110",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1508110"
      },
      {
        "category": "external",
        "summary": "1508123",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1508123"
      },
      {
        "category": "external",
        "summary": "1578578",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1578578"
      },
      {
        "category": "external",
        "summary": "1578902",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1578902"
      },
      {
        "category": "external",
        "summary": "1579611",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1579611"
      },
      {
        "category": "external",
        "summary": "1591072",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1591072"
      },
      {
        "category": "external",
        "summary": "1595332",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595332"
      },
      {
        "category": "external",
        "summary": "1607591",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1607591"
      },
      {
        "category": "external",
        "summary": "1607731",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1607731"
      },
      {
        "category": "external",
        "summary": "1611059",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1611059"
      },
      {
        "category": "external",
        "summary": "1612644",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1612644"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3768.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Fuse 7.2 security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:24:27+00:00",
      "generator": {
        "date": "2026-05-14T22:24:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2018:3768",
      "initial_release_date": "2018-12-04T16:00:23+00:00",
      "revision_history": [
        {
          "date": "2018-12-04T16:00:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2018-12-04T16:00:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:24:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Fuse 7.2",
                "product": {
                  "name": "Red Hat Fuse 7.2",
                  "product_id": "Red Hat Fuse 7.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-5002",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2016-05-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1508110"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xmlrpc: XML external entity vulnerability SSRF via a crafted DTD",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-5002"
        },
        {
          "category": "external",
          "summary": "RHBZ#1508110",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1508110"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-5002",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-5002"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-5002",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5002"
        }
      ],
      "release_date": "2016-05-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-12-04T16:00:23+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:3768"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "xmlrpc: XML external entity vulnerability SSRF via a crafted DTD"
    },
    {
      "cve": "CVE-2016-5003",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2016-05-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1508123"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in the Apache XML-RPC (ws-xmlrpc) library that deserializes untrusted data when enabledForExtensions setting is enabled. A remote attacker could use this vulnerability to execute arbitrary code via a crafted serialized Java object in a \u003cex:serializable\u003e element.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xmlrpc: Deserialization of untrusted Java object through \u003cex:serializable\u003e tag",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-5003"
        },
        {
          "category": "external",
          "summary": "RHBZ#1508123",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1508123"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-5003",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-5003"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-5003",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5003"
        }
      ],
      "release_date": "2016-05-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-12-04T16:00:23+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:3768"
        },
        {
          "category": "workaround",
          "details": "Setting enabledForExtensions is false by default, thus \u003cex:serializable\u003e elements are not automatically deserialized. However, if you have it enabled and you don\u0027t need any of the provided functions (https://ws.apache.org/xmlrpc/extensions.html) we suggest you disable it.",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "xmlrpc: Deserialization of untrusted Java object through \u003cex:serializable\u003e tag"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jan Stourac"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2017-12196",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2017-10-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1503055"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that when using Digest authentication, the server does not ensure that the value of the URI in the authorization header matches the URI in the HTTP request line. This allows the attacker to execute a MITM attack and access the desired content on the server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow: Client can use bogus uri in Digest authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-12196"
        },
        {
          "category": "external",
          "summary": "RHBZ#1503055",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1503055"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-12196",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-12196"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-12196",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12196"
        }
      ],
      "release_date": "2018-03-12T15:56:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-12-04T16:00:23+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:3768"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undertow: Client can use bogus uri in Digest authentication"
    },
    {
      "cve": "CVE-2018-1257",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2018-05-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1578578"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "spring-framework: ReDoS Attack with spring-messaging",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-1257"
        },
        {
          "category": "external",
          "summary": "RHBZ#1578578",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1578578"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1257",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-1257"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1257"
        }
      ],
      "release_date": "2018-05-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-12-04T16:00:23+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:3768"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "spring-framework: ReDoS Attack with spring-messaging"
    },
    {
      "cve": "CVE-2018-1259",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2018-05-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1578902"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data\u0027s projection-based request payload binding to access arbitrary files on the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "spring-data-commons: XXE with Spring Data\u2019s XMLBeam integration",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-1259"
        },
        {
          "category": "external",
          "summary": "RHBZ#1578902",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1578902"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1259",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-1259"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1259",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1259"
        }
      ],
      "release_date": "2018-05-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-12-04T16:00:23+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:3768"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "spring-data-commons: XXE with Spring Data\u2019s XMLBeam integration"
    },
    {
      "cve": "CVE-2018-1288",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2018-07-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1611059"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-1288"
        },
        {
          "category": "external",
          "summary": "RHBZ#1611059",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1611059"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1288",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-1288"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1288",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1288"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread.html/29f61337323f48c47d4b41d74b9e452bd60e65d0e5103af9a6bb2fef@%3Cusers.kafka.apache.org%3E",
          "url": "https://lists.apache.org/thread.html/29f61337323f48c47d4b41d74b9e452bd60e65d0e5103af9a6bb2fef@%3Cusers.kafka.apache.org%3E"
        }
      ],
      "release_date": "2018-07-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-12-04T16:00:23+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:3768"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass"
    },
    {
      "cve": "CVE-2018-1336",
      "discovery_date": "2018-07-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1607591"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: A bug in the UTF-8 decoder can lead to DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Fuse 6.3 and 7 standalone distributions ship but do not use tomcat, and as such are not affected by this flaw; however, Fuse Integration Services 2.0 and Fuse 7 on OpenShift provide the affected artifacts via their respective maven repositories, and will provide fixes for this issue in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-1336"
        },
        {
          "category": "external",
          "summary": "RHBZ#1607591",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1607591"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1336",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-1336"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1336"
        }
      ],
      "release_date": "2018-07-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-12-04T16:00:23+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:3768"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tomcat: A bug in the UTF-8 decoder can lead to DoS"
    },
    {
      "cve": "CVE-2018-8014",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2018-05-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1579611"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable \u0027supportsCredentials\u0027 for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat: Insecure defaults in CORS filter enable \u0027supportsCredentials\u0027 for all origins",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-8014"
        },
        {
          "category": "external",
          "summary": "RHBZ#1579611",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1579611"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-8014",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-8014"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-8014",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8014"
        },
        {
          "category": "external",
          "summary": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.89",
          "url": "http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.89"
        },
        {
          "category": "external",
          "summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.53",
          "url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.53"
        },
        {
          "category": "external",
          "summary": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32",
          "url": "http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32"
        },
        {
          "category": "external",
          "summary": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.9",
          "url": "http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.9"
        }
      ],
      "release_date": "2018-05-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-12-04T16:00:23+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:3768"
        },
        {
          "category": "workaround",
          "details": "When using the CORS filter, it is recommended to configure it explicitly for your environment.  In particular, the combination of `cors.allowed.origins = *` and `cors.support.credentials = True` should be avoided as this  can leave your application vulnerable to cross-site scripting (XSS). For details on configuring CORS filter, please refer to https://tomcat.apache.org/tomcat-7.0-doc/config/filter.html#CORS_Filter",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat: Insecure defaults in CORS filter enable \u0027supportsCredentials\u0027 for all origins"
    },
    {
      "cve": "CVE-2018-8018",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2018-07-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1607731"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to GridClientJdkMarshaller deserialization endpoint.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ignite: Improper deserialization allows for code execution via GridClientJdkMarshaller endpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-8018"
        },
        {
          "category": "external",
          "summary": "RHBZ#1607731",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1607731"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-8018",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-8018"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-8018",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8018"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread.html/e0fdf53114a321142ecfa5cfa17658090f0b4e1677de431e329b37ab@%3Cdev.ignite.apache.org%3E",
          "url": "https://lists.apache.org/thread.html/e0fdf53114a321142ecfa5cfa17658090f0b4e1677de431e329b37ab@%3Cdev.ignite.apache.org%3E"
        }
      ],
      "release_date": "2018-07-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-12-04T16:00:23+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:3768"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ignite: Improper deserialization allows for code execution via GridClientJdkMarshaller endpoint"
    },
    {
      "cve": "CVE-2018-8039",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2018-06-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1595332"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that when Apache CXF is configured to use the system property com.sun.net.ssl.internal.www.protocol ,it uses reflection to make the HostnameVerifier work with old com.sun.net.ssl.HostnameVerifier interface. Although the CXF implementation throws an exception, which is caught in the reflection code but it is not properly propagated, this can lead to a man-in-the-middle attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Logging the openshift-logging/elasticsearch6-rhel8 container bundles the vulnerable version of apache-cxf, but the vulnerable class is not shipped, hence this component is not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-8039"
        },
        {
          "category": "external",
          "summary": "RHBZ#1595332",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595332"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-8039",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-8039"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-8039",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8039"
        },
        {
          "category": "external",
          "summary": "http://cxf.apache.org/security-advisories.data/CVE-2018-8039.txt.asc?version=1\u0026modificationDate=1530184663000\u0026api=v2",
          "url": "http://cxf.apache.org/security-advisories.data/CVE-2018-8039.txt.asc?version=1\u0026modificationDate=1530184663000\u0026api=v2"
        }
      ],
      "release_date": "2018-06-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-12-04T16:00:23+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:3768"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Eedo Shapira"
          ],
          "organization": "GE Digital"
        }
      ],
      "cve": "CVE-2018-8041",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2018-07-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1612644"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache Camel\u0027s Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "camel-mail: path traversal vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-8041"
        },
        {
          "category": "external",
          "summary": "RHBZ#1612644",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1612644"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-8041",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-8041"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-8041",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8041"
        }
      ],
      "release_date": "2018-06-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-12-04T16:00:23+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:3768"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "camel-mail: path traversal vulnerability"
    },
    {
      "cve": "CVE-2018-12537",
      "cwe": {
        "id": "CWE-113",
        "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)"
      },
      "discovery_date": "2018-06-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1591072"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While the affected artifact is being shipped in Fuse 6.3 via camel-vertx component, the vulnerable code is not being used, therefore Fuse 6.3 is not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Fuse 7.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-12537"
        },
        {
          "category": "external",
          "summary": "RHBZ#1591072",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1591072"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12537",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-12537"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12537",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12537"
        },
        {
          "category": "external",
          "summary": "https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-021_vertx.txt",
          "url": "https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-021_vertx.txt"
        }
      ],
      "release_date": "2018-06-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2018-12-04T16:00:23+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nInstallation instructions are located in the download section of the customer portal.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Fuse 7.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2018:3768"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat Fuse 7.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for tomcat",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for tomcat to 8.0.53 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with\n  supplementary characters could have lead to an infinite loop in the decoder\n  causing a Denial of Service (bsc#1102400).\n- CVE-2018-8034: The host name verification when using TLS with the WebSocket\n  client was missing. It is now enabled by default (bsc#1102379).\n- CVE-2018-8037: If an async request was completed by the application at the\n  same time as the container triggered the async timeout, a race condition\n  existed that could have resulted in a user seeing a response intended for a\n  different user. An additional issue was present in the NIO and NIO2 connectors\n  that did not correctly track the closure of the connection when an async\n  request was completed by the application and timed out by the container at the\n  same time. This could also have resulted in a user seeing a response intended\n  for another user (bsc#1102410).\n- CVE-2018-8014: Fix insecure default CORS filter settings (bsc#1093697).\n\nBug fixes:\n\n- bsc#1067720: Avoid overwriting of customer\u0027s configuration during update.\n- bsc#1095472: Add Obsoletes for tomcat6 packages.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-SERVER-12-SP3-2018-1890",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_2699-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2018:2699-1",
        "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20182699-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2018:2699-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-September/004557.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1067720",
        "url": "https://bugzilla.suse.com/1067720"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1093697",
        "url": "https://bugzilla.suse.com/1093697"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1095472",
        "url": "https://bugzilla.suse.com/1095472"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1102379",
        "url": "https://bugzilla.suse.com/1102379"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1102400",
        "url": "https://bugzilla.suse.com/1102400"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1102410",
        "url": "https://bugzilla.suse.com/1102410"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1336 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1336/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8014 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8014/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8034 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8034/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8037 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8037/"
      }
    ],
    "title": "Security update for tomcat",
    "tracking": {
      "current_release_date": "2018-09-13T05:57:00Z",
      "generator": {
        "date": "2018-09-13T05:57:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2018:2699-1",
      "initial_release_date": "2018-09-13T05:57:00Z",
      "revision_history": [
        {
          "date": "2018-09-13T05:57:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-8.0.53-29.13.1.noarch",
                "product": {
                  "name": "tomcat-8.0.53-29.13.1.noarch",
                  "product_id": "tomcat-8.0.53-29.13.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-8.0.53-29.13.1.noarch",
                "product": {
                  "name": "tomcat-admin-webapps-8.0.53-29.13.1.noarch",
                  "product_id": "tomcat-admin-webapps-8.0.53-29.13.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-8.0.53-29.13.1.noarch",
                "product": {
                  "name": "tomcat-docs-webapp-8.0.53-29.13.1.noarch",
                  "product_id": "tomcat-docs-webapp-8.0.53-29.13.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
                "product": {
                  "name": "tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
                  "product_id": "tomcat-el-3_0-api-8.0.53-29.13.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-javadoc-8.0.53-29.13.1.noarch",
                "product": {
                  "name": "tomcat-javadoc-8.0.53-29.13.1.noarch",
                  "product_id": "tomcat-javadoc-8.0.53-29.13.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
                "product": {
                  "name": "tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
                  "product_id": "tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-8.0.53-29.13.1.noarch",
                "product": {
                  "name": "tomcat-lib-8.0.53-29.13.1.noarch",
                  "product_id": "tomcat-lib-8.0.53-29.13.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
                "product": {
                  "name": "tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
                  "product_id": "tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-8.0.53-29.13.1.noarch",
                "product": {
                  "name": "tomcat-webapps-8.0.53-29.13.1.noarch",
                  "product_id": "tomcat-webapps-8.0.53-29.13.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP3",
                  "product_id": "SUSE Linux Enterprise Server 12 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-docs-webapp-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-javadoc-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-lib-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server 12 SP3",
          "product_id": "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-webapps-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-docs-webapp-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-javadoc-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-lib-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-8.0.53-29.13.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
        },
        "product_reference": "tomcat-webapps-8.0.53-29.13.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-1336",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1336"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1336",
          "url": "https://www.suse.com/security/cve/CVE-2018-1336"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1102400 for CVE-2018-1336",
          "url": "https://bugzilla.suse.com/1102400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-09-13T05:57:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-1336"
    },
    {
      "cve": "CVE-2018-8014",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8014"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable \u0027supportsCredentials\u0027 for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8014",
          "url": "https://www.suse.com/security/cve/CVE-2018-8014"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1093697 for CVE-2018-8014",
          "url": "https://bugzilla.suse.com/1093697"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-09-13T05:57:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-8014"
    },
    {
      "cve": "CVE-2018-8034",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8034"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8034",
          "url": "https://www.suse.com/security/cve/CVE-2018-8034"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1102379 for CVE-2018-8034",
          "url": "https://bugzilla.suse.com/1102379"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-09-13T05:57:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-8034"
    },
    {
      "cve": "CVE-2018-8037",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8037"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8037",
          "url": "https://www.suse.com/security/cve/CVE-2018-8037"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1003579 for CVE-2018-8037",
          "url": "https://bugzilla.suse.com/1003579"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1102410 for CVE-2018-8037",
          "url": "https://bugzilla.suse.com/1102410"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-admin-webapps-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-docs-webapp-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-el-3_0-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-javadoc-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-jsp-2_3-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-lib-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-servlet-3_1-api-8.0.53-29.13.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP3:tomcat-webapps-8.0.53-29.13.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-09-13T05:57:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2018-8037"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for tomcat",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for tomcat to version 9.0.10 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with\n  supplementary characters could have lead to an infinite loop in the decoder\n  causing a Denial of Service (bsc#1102400).\n- CVE-2018-8014: Fix insecure default CORS filter settings (bsc#1093697).\n- CVE-2018-8034: The host name verification when using TLS with the WebSocket\n  client was missing. It is now enabled by default (bsc#1102379).\n- CVE-2018-8037: If an async request was completed by the application at the\n  same time as the container triggered the async timeout, a race condition\n  existed that could have resulted in a user seeing a response intended for a\n  different user. An additional issue was present in the NIO and NIO2 connectors\n  that did not correctly track the closure of the connection when an async\n  request was completed by the application and timed out by the container at the\n  same time. This could also have resulted in a user seeing a response intended\n  for another user (bsc#1102410).\n\nBug fixes:\n\n- Avoid overwriting of customer\u0027s configuration during update (bsc#1067720)\n- Disable adding OSGi metadata to JAR files\n\n- See changelog at http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.10_(markt)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Module-Web-Scripting-15-2018-2145",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_3011-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2018:3011-1",
        "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183011-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2018:3011-1",
        "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183011-1.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1067720",
        "url": "https://bugzilla.suse.com/1067720"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1093697",
        "url": "https://bugzilla.suse.com/1093697"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1102379",
        "url": "https://bugzilla.suse.com/1102379"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1102400",
        "url": "https://bugzilla.suse.com/1102400"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1102410",
        "url": "https://bugzilla.suse.com/1102410"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1336 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1336/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8014 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8014/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8034 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8034/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8037 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8037/"
      }
    ],
    "title": "Security update for tomcat",
    "tracking": {
      "current_release_date": "2018-11-28T08:58:40Z",
      "generator": {
        "date": "2018-11-28T08:58:40Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2018:3011-1",
      "initial_release_date": "2018-11-28T08:58:40Z",
      "revision_history": [
        {
          "date": "2018-11-28T08:58:40Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-9.0.10-3.7.1.noarch",
                "product": {
                  "name": "tomcat-9.0.10-3.7.1.noarch",
                  "product_id": "tomcat-9.0.10-3.7.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-9.0.10-3.7.1.noarch",
                "product": {
                  "name": "tomcat-admin-webapps-9.0.10-3.7.1.noarch",
                  "product_id": "tomcat-admin-webapps-9.0.10-3.7.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
                "product": {
                  "name": "tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
                  "product_id": "tomcat-el-3_0-api-9.0.10-3.7.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
                "product": {
                  "name": "tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
                  "product_id": "tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-9.0.10-3.7.1.noarch",
                "product": {
                  "name": "tomcat-lib-9.0.10-3.7.1.noarch",
                  "product_id": "tomcat-lib-9.0.10-3.7.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
                "product": {
                  "name": "tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
                  "product_id": "tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-9.0.10-3.7.1.noarch",
                "product": {
                  "name": "tomcat-webapps-9.0.10-3.7.1.noarch",
                  "product_id": "tomcat-webapps-9.0.10-3.7.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Web and Scripting 15",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Web and Scripting 15",
                  "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-web-scripting:15"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-9.0.10-3.7.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch"
        },
        "product_reference": "tomcat-9.0.10-3.7.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-9.0.10-3.7.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-9.0.10-3.7.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-9.0.10-3.7.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-9.0.10-3.7.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch"
        },
        "product_reference": "tomcat-lib-9.0.10-3.7.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch"
        },
        "product_reference": "tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-9.0.10-3.7.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15",
          "product_id": "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
        },
        "product_reference": "tomcat-webapps-9.0.10-3.7.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Web and Scripting 15"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-1336",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1336"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1336",
          "url": "https://www.suse.com/security/cve/CVE-2018-1336"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1102400 for CVE-2018-1336",
          "url": "https://bugzilla.suse.com/1102400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-11-28T08:58:40Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-1336"
    },
    {
      "cve": "CVE-2018-8014",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8014"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable \u0027supportsCredentials\u0027 for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8014",
          "url": "https://www.suse.com/security/cve/CVE-2018-8014"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1093697 for CVE-2018-8014",
          "url": "https://bugzilla.suse.com/1093697"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-11-28T08:58:40Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-8014"
    },
    {
      "cve": "CVE-2018-8034",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8034"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8034",
          "url": "https://www.suse.com/security/cve/CVE-2018-8034"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1102379 for CVE-2018-8034",
          "url": "https://bugzilla.suse.com/1102379"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-11-28T08:58:40Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-8034"
    },
    {
      "cve": "CVE-2018-8037",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8037"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
          "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8037",
          "url": "https://www.suse.com/security/cve/CVE-2018-8037"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1003579 for CVE-2018-8037",
          "url": "https://bugzilla.suse.com/1003579"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1102410 for CVE-2018-8037",
          "url": "https://bugzilla.suse.com/1102410"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-admin-webapps-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-el-3_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-jsp-2_3-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-lib-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-servlet-4_0-api-9.0.10-3.7.1.noarch",
            "SUSE Linux Enterprise Module for Web and Scripting 15:tomcat-webapps-9.0.10-3.7.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-11-28T08:58:40Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2018-8037"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for tomcat",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for tomcat fixes the following issues:\n\nVersion update to 7.0.90:\n\n- Another bugfix release, for full details see:\n  https://tomcat.apache.org/tomcat-7.0-doc/changelog.html\n\nSecurity issues fixed:\n\n- CVE-2018-11784: When the default servlet in Apache Tomcat returned\n  a redirect to a directory (e.g. redirecting to \u0027/foo/\u0027 when the user\n  requested \u0027/foo\u0027) a specially crafted URL could be used to cause the\n  redirect to be generated to any URI of the attackers choice. (bsc#1110850)\n- CVE-2017-15706: As part of the fix for bug 61201, the documentation\n  for Apache Tomcat included an updated description of the search algorithm\n  used by the CGI Servlet to identify which script to execute.  The update\n  was not correct. As a result, some scripts may have failed to execute as\n  expected and other scripts may have been executed unexpectedly. Note that\n  the behaviour of the CGI servlet has remained unchanged in this regard.\n  It is only the documentation of the behaviour that was wrong and has\n  been corrected.(bsc#1078677)\n- CVE-2018-1304: The URL pattern of \\\u0027\\\u0027 (the empty string) which exactly\n  maps to the context root was not correctly handled in Apache Tomcat\n  when used as part of a security constraint definition. This caused the\n  constraint to be ignored. It was, therefore, possible for unauthorised\n  users to gain access to web application resources that should have\n  been protected.  Only security constraints with a URL pattern of the\n  empty string were affected. (bsc#1082480)\n- CVE-2018-1305: Security constraints defined by annotations of Servlets\n  in Apache Tomcat were only applied once a Servlet had been loaded. Because\n  security constraints defined in this way apply to the URL pattern and\n  any URLs below that point, it was possible - depending on the order\n  Servlets were loaded - for some security constraints not to be applied.\n  This could have exposed resources to users who were not authorised to\n  access them.(bsc#1082481)\n- CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with\n  supplementary characters can lead to an infinite loop in the decoder causing\n  a Denial of Service. (bsc#1102400)\n- CVE-2018-8014: Fixed default settings for the CORS filter, which were\n  insecure and enabled \u0027supportsCredentials\u0027 for all origins. (bsc#1093697)\n- CVE-2018-8034: Fixed the host name verification when using TLS with the\n  WebSocket client, which was not enabled by default. (bsc#1102379)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-SERVER-12-2018-2339",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_3261-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2018:3261-1",
        "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183261-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2018:3261-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-October/004749.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1078677",
        "url": "https://bugzilla.suse.com/1078677"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1082480",
        "url": "https://bugzilla.suse.com/1082480"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1082481",
        "url": "https://bugzilla.suse.com/1082481"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1093697",
        "url": "https://bugzilla.suse.com/1093697"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1102379",
        "url": "https://bugzilla.suse.com/1102379"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1102400",
        "url": "https://bugzilla.suse.com/1102400"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1110850",
        "url": "https://bugzilla.suse.com/1110850"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-15706 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-15706/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-11784 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-11784/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1304 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1304/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1305 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1305/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1336 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1336/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8014 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8014/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8034 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8034/"
      }
    ],
    "title": "Security update for tomcat",
    "tracking": {
      "current_release_date": "2018-10-19T14:05:42Z",
      "generator": {
        "date": "2018-10-19T14:05:42Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2018:3261-1",
      "initial_release_date": "2018-10-19T14:05:42Z",
      "revision_history": [
        {
          "date": "2018-10-19T14:05:42Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-7.0.90-7.23.1.noarch",
                "product": {
                  "name": "tomcat-7.0.90-7.23.1.noarch",
                  "product_id": "tomcat-7.0.90-7.23.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-7.0.90-7.23.1.noarch",
                "product": {
                  "name": "tomcat-admin-webapps-7.0.90-7.23.1.noarch",
                  "product_id": "tomcat-admin-webapps-7.0.90-7.23.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-7.0.90-7.23.1.noarch",
                "product": {
                  "name": "tomcat-docs-webapp-7.0.90-7.23.1.noarch",
                  "product_id": "tomcat-docs-webapp-7.0.90-7.23.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
                "product": {
                  "name": "tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
                  "product_id": "tomcat-el-2_2-api-7.0.90-7.23.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-javadoc-7.0.90-7.23.1.noarch",
                "product": {
                  "name": "tomcat-javadoc-7.0.90-7.23.1.noarch",
                  "product_id": "tomcat-javadoc-7.0.90-7.23.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
                "product": {
                  "name": "tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
                  "product_id": "tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-7.0.90-7.23.1.noarch",
                "product": {
                  "name": "tomcat-lib-7.0.90-7.23.1.noarch",
                  "product_id": "tomcat-lib-7.0.90-7.23.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
                "product": {
                  "name": "tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
                  "product_id": "tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-7.0.90-7.23.1.noarch",
                "product": {
                  "name": "tomcat-webapps-7.0.90-7.23.1.noarch",
                  "product_id": "tomcat-webapps-7.0.90-7.23.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-7.0.90-7.23.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch"
        },
        "product_reference": "tomcat-7.0.90-7.23.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-7.0.90-7.23.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-7.0.90-7.23.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-7.0.90-7.23.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch"
        },
        "product_reference": "tomcat-docs-webapp-7.0.90-7.23.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-2_2-api-7.0.90-7.23.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch"
        },
        "product_reference": "tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-7.0.90-7.23.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch"
        },
        "product_reference": "tomcat-javadoc-7.0.90-7.23.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-7.0.90-7.23.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch"
        },
        "product_reference": "tomcat-lib-7.0.90-7.23.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch"
        },
        "product_reference": "tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-7.0.90-7.23.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
        },
        "product_reference": "tomcat-webapps-7.0.90-7.23.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-15706",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-15706"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-15706",
          "url": "https://www.suse.com/security/cve/CVE-2017-15706"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1078677 for CVE-2017-15706",
          "url": "https://bugzilla.suse.com/1078677"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 0,
            "baseSeverity": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-19T14:05:42Z",
          "details": "low"
        }
      ],
      "title": "CVE-2017-15706"
    },
    {
      "cve": "CVE-2018-11784",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-11784"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to \u0027/foo/\u0027 when the user requested \u0027/foo\u0027) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-11784",
          "url": "https://www.suse.com/security/cve/CVE-2018-11784"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1110850 for CVE-2018-11784",
          "url": "https://bugzilla.suse.com/1110850"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1122212 for CVE-2018-11784",
          "url": "https://bugzilla.suse.com/1122212"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-19T14:05:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-11784"
    },
    {
      "cve": "CVE-2018-1304",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1304"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1304",
          "url": "https://www.suse.com/security/cve/CVE-2018-1304"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1082480 for CVE-2018-1304",
          "url": "https://bugzilla.suse.com/1082480"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-19T14:05:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-1304"
    },
    {
      "cve": "CVE-2018-1305",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1305"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1305",
          "url": "https://www.suse.com/security/cve/CVE-2018-1305"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1082481 for CVE-2018-1305",
          "url": "https://bugzilla.suse.com/1082481"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1112097 for CVE-2018-1305",
          "url": "https://bugzilla.suse.com/1112097"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-19T14:05:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-1305"
    },
    {
      "cve": "CVE-2018-1336",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1336"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1336",
          "url": "https://www.suse.com/security/cve/CVE-2018-1336"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1102400 for CVE-2018-1336",
          "url": "https://bugzilla.suse.com/1102400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-19T14:05:42Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-1336"
    },
    {
      "cve": "CVE-2018-8014",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8014"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable \u0027supportsCredentials\u0027 for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8014",
          "url": "https://www.suse.com/security/cve/CVE-2018-8014"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1093697 for CVE-2018-8014",
          "url": "https://bugzilla.suse.com/1093697"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-19T14:05:42Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-8014"
    },
    {
      "cve": "CVE-2018-8034",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8034"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
          "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8034",
          "url": "https://www.suse.com/security/cve/CVE-2018-8034"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1102379 for CVE-2018-8034",
          "url": "https://bugzilla.suse.com/1102379"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-admin-webapps-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-docs-webapp-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-el-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-javadoc-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-jsp-2_2-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-lib-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-servlet-3_0-api-7.0.90-7.23.1.noarch",
            "SUSE Linux Enterprise Server 12-LTSS:tomcat-webapps-7.0.90-7.23.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-19T14:05:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-8034"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for tomcat",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for tomcat to version 8.0.53 fixes the following security issues:\n\n- CVE-2018-11784: When the default servlet in Apache Tomcat returned\n  a redirect to a directory (e.g. redirecting to \u0027/foo/\u0027 when the user\n  requested \u0027/foo\u0027) a specially crafted URL could be used to cause the\n  redirect to be generated to any URI of the attackers choice. (bsc#1110850)\n- CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with\n  supplementary characters could have lead to an infinite loop in the decoder\n  causing a Denial of Service (bsc#1102400)\n- CVE-2018-8034: The host name verification when using TLS with the WebSocket\n  client was missing. It is now enabled by default (bsc#1102379)\n- CVE-2018-8037: If an async request was completed by the application at the\n  same time as the container triggered the async timeout, a race condition\n  existed that could have resulted in a user seeing a response intended for a\n  different user. An additional issue was present in the NIO and NIO2 connectors\n  that did not correctly track the closure of the connection when an async\n  request was completed by the application and timed out by the container at the\n  same time. This could also have resulted in a user seeing a response intended\n  for another user (bsc#1102410)\n- CVE-2018-1305: Fixed late application of security constraints that can lead\n  to resource exposure for unauthorised users (bsc#1082481).\n- CVE-2018-1304: Fixed incorrect handling of empty string URL in security\n  constraints that can lead to unitended exposure of resources (bsc#1082480).\n- CVE-2017-15706: Fixed incorrect documentation of CGI Servlet search algorithm\n  that may lead to misconfiguration (bsc#1078677).\n- CVE-2018-8014: The defaults settings for the CORS filter were insecure and\n  enable \u0027supportsCredentials\u0027 for all origins (bsc#1093697).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-SAP-12-SP1-2018-2433,SUSE-SLE-SERVER-12-SP1-2018-2433",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_3388-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2018:3388-1",
        "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183388-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2018:3388-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-October/004782.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1078677",
        "url": "https://bugzilla.suse.com/1078677"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1082480",
        "url": "https://bugzilla.suse.com/1082480"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1082481",
        "url": "https://bugzilla.suse.com/1082481"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1093697",
        "url": "https://bugzilla.suse.com/1093697"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1102379",
        "url": "https://bugzilla.suse.com/1102379"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1102400",
        "url": "https://bugzilla.suse.com/1102400"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1102410",
        "url": "https://bugzilla.suse.com/1102410"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1110850",
        "url": "https://bugzilla.suse.com/1110850"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-15706 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-15706/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-11784 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-11784/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1304 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1304/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1305 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1305/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1336 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1336/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8014 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8014/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8034 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8034/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-8037 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-8037/"
      }
    ],
    "title": "Security update for tomcat",
    "tracking": {
      "current_release_date": "2018-10-24T11:48:05Z",
      "generator": {
        "date": "2018-10-24T11:48:05Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2018:3388-1",
      "initial_release_date": "2018-10-24T11:48:05Z",
      "revision_history": [
        {
          "date": "2018-10-24T11:48:05Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat-8.0.53-10.35.1.noarch",
                "product": {
                  "name": "tomcat-8.0.53-10.35.1.noarch",
                  "product_id": "tomcat-8.0.53-10.35.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-admin-webapps-8.0.53-10.35.1.noarch",
                "product": {
                  "name": "tomcat-admin-webapps-8.0.53-10.35.1.noarch",
                  "product_id": "tomcat-admin-webapps-8.0.53-10.35.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-docs-webapp-8.0.53-10.35.1.noarch",
                "product": {
                  "name": "tomcat-docs-webapp-8.0.53-10.35.1.noarch",
                  "product_id": "tomcat-docs-webapp-8.0.53-10.35.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
                "product": {
                  "name": "tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
                  "product_id": "tomcat-el-3_0-api-8.0.53-10.35.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-javadoc-8.0.53-10.35.1.noarch",
                "product": {
                  "name": "tomcat-javadoc-8.0.53-10.35.1.noarch",
                  "product_id": "tomcat-javadoc-8.0.53-10.35.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
                "product": {
                  "name": "tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
                  "product_id": "tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-lib-8.0.53-10.35.1.noarch",
                "product": {
                  "name": "tomcat-lib-8.0.53-10.35.1.noarch",
                  "product_id": "tomcat-lib-8.0.53-10.35.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
                "product": {
                  "name": "tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
                  "product_id": "tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "tomcat-webapps-8.0.53-10.35.1.noarch",
                "product": {
                  "name": "tomcat-webapps-8.0.53-10.35.1.noarch",
                  "product_id": "tomcat-webapps-8.0.53-10.35.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP1-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP1-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12:sp1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-docs-webapp-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-javadoc-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-lib-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-webapps-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-admin-webapps-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-admin-webapps-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-docs-webapp-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-docs-webapp-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-el-3_0-api-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-javadoc-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-javadoc-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-lib-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-lib-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat-webapps-8.0.53-10.35.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch"
        },
        "product_reference": "tomcat-webapps-8.0.53-10.35.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-15706",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-15706"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-15706",
          "url": "https://www.suse.com/security/cve/CVE-2017-15706"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1078677 for CVE-2017-15706",
          "url": "https://bugzilla.suse.com/1078677"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 0,
            "baseSeverity": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-24T11:48:05Z",
          "details": "low"
        }
      ],
      "title": "CVE-2017-15706"
    },
    {
      "cve": "CVE-2018-11784",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-11784"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to \u0027/foo/\u0027 when the user requested \u0027/foo\u0027) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-11784",
          "url": "https://www.suse.com/security/cve/CVE-2018-11784"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1110850 for CVE-2018-11784",
          "url": "https://bugzilla.suse.com/1110850"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1122212 for CVE-2018-11784",
          "url": "https://bugzilla.suse.com/1122212"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-24T11:48:05Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-11784"
    },
    {
      "cve": "CVE-2018-1304",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1304"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1304",
          "url": "https://www.suse.com/security/cve/CVE-2018-1304"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1082480 for CVE-2018-1304",
          "url": "https://bugzilla.suse.com/1082480"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-24T11:48:05Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-1304"
    },
    {
      "cve": "CVE-2018-1305",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1305"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1305",
          "url": "https://www.suse.com/security/cve/CVE-2018-1305"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1082481 for CVE-2018-1305",
          "url": "https://bugzilla.suse.com/1082481"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1112097 for CVE-2018-1305",
          "url": "https://bugzilla.suse.com/1112097"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-24T11:48:05Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-1305"
    },
    {
      "cve": "CVE-2018-1336",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1336"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1336",
          "url": "https://www.suse.com/security/cve/CVE-2018-1336"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1102400 for CVE-2018-1336",
          "url": "https://bugzilla.suse.com/1102400"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-24T11:48:05Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-1336"
    },
    {
      "cve": "CVE-2018-8014",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8014"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable \u0027supportsCredentials\u0027 for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8014",
          "url": "https://www.suse.com/security/cve/CVE-2018-8014"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1093697 for CVE-2018-8014",
          "url": "https://bugzilla.suse.com/1093697"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-24T11:48:05Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-8014"
    },
    {
      "cve": "CVE-2018-8034",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8034"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8034",
          "url": "https://www.suse.com/security/cve/CVE-2018-8034"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1102379 for CVE-2018-8034",
          "url": "https://bugzilla.suse.com/1102379"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-24T11:48:05Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-8034"
    },
    {
      "cve": "CVE-2018-8037",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-8037"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-8037",
          "url": "https://www.suse.com/security/cve/CVE-2018-8037"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1003579 for CVE-2018-8037",
          "url": "https://bugzilla.suse.com/1003579"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1102410 for CVE-2018-8037",
          "url": "https://bugzilla.suse.com/1102410"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server 12 SP1-LTSS:tomcat-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.53-10.35.1.noarch",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.53-10.35.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-10-24T11:48:05Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2018-8037"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Data Protection Advisor ist eine Monitoring L\u00f6sung. Der Collector ist der lokale Agent.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Berechtigungen zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-0528 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0528.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-0528 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0528"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2024-107 vom 2024-02-29",
        "url": "https://www.dell.com/support/kbdoc/000222618/dsa-2024-="
      }
    ],
    "source_lang": "en-US",
    "title": "Dell Data Protection Advisor: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-02-29T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:05:58.480+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-0528",
      "initial_release_date": "2024-02-29T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-02-29T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 19.10",
                "product": {
                  "name": "Dell Data Protection Advisor \u003c 19.10",
                  "product_id": "T033198"
                }
              }
            ],
            "category": "product_name",
            "name": "Data Protection Advisor"
          }
        ],
        "category": "vendor",
        "name": "Dell"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-45648",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-45648"
    },
    {
      "cve": "CVE-2023-42795",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-42795"
    },
    {
      "cve": "CVE-2023-41080",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-41080"
    },
    {
      "cve": "CVE-2023-34055",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-34055"
    },
    {
      "cve": "CVE-2023-28708",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-28708"
    },
    {
      "cve": "CVE-2023-28154",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-28154"
    },
    {
      "cve": "CVE-2023-22081",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-22081"
    },
    {
      "cve": "CVE-2023-22067",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-22067"
    },
    {
      "cve": "CVE-2023-22025",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-22025"
    },
    {
      "cve": "CVE-2023-20883",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-20883"
    },
    {
      "cve": "CVE-2023-20873",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-20873"
    },
    {
      "cve": "CVE-2023-20863",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-20863"
    },
    {
      "cve": "CVE-2023-20861",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2023-20861"
    },
    {
      "cve": "CVE-2022-46175",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-46175"
    },
    {
      "cve": "CVE-2022-41854",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-41854"
    },
    {
      "cve": "CVE-2022-38752",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-38752"
    },
    {
      "cve": "CVE-2022-38751",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-38751"
    },
    {
      "cve": "CVE-2022-38750",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-38750"
    },
    {
      "cve": "CVE-2022-38749",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-38749"
    },
    {
      "cve": "CVE-2022-37603",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-37603"
    },
    {
      "cve": "CVE-2022-37601",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-37601"
    },
    {
      "cve": "CVE-2022-37599",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-37599"
    },
    {
      "cve": "CVE-2022-31129",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-31129"
    },
    {
      "cve": "CVE-2022-27772",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-27772"
    },
    {
      "cve": "CVE-2022-25881",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-25881"
    },
    {
      "cve": "CVE-2022-25858",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-25858"
    },
    {
      "cve": "CVE-2022-22971",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-22971"
    },
    {
      "cve": "CVE-2022-22970",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-22970"
    },
    {
      "cve": "CVE-2022-22968",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-22968"
    },
    {
      "cve": "CVE-2022-22965",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-22965"
    },
    {
      "cve": "CVE-2022-22950",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2022-22950"
    },
    {
      "cve": "CVE-2021-43980",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2021-43980"
    },
    {
      "cve": "CVE-2021-33037",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2021-33037"
    },
    {
      "cve": "CVE-2021-30640",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2021-30640"
    },
    {
      "cve": "CVE-2020-5421",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2020-5421"
    },
    {
      "cve": "CVE-2020-1938",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2020-1938"
    },
    {
      "cve": "CVE-2020-1935",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2020-1935"
    },
    {
      "cve": "CVE-2020-13943",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2020-13943"
    },
    {
      "cve": "CVE-2020-13935",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2020-13935"
    },
    {
      "cve": "CVE-2020-13934",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2020-13934"
    },
    {
      "cve": "CVE-2020-11996",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2020-11996"
    },
    {
      "cve": "CVE-2019-2684",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2019-2684"
    },
    {
      "cve": "CVE-2019-17563",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2019-17563"
    },
    {
      "cve": "CVE-2019-12418",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2019-12418"
    },
    {
      "cve": "CVE-2019-10072",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2019-10072"
    },
    {
      "cve": "CVE-2019-0232",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2019-0232"
    },
    {
      "cve": "CVE-2019-0221",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2019-0221"
    },
    {
      "cve": "CVE-2019-0199",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2019-0199"
    },
    {
      "cve": "CVE-2018-8037",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-8037"
    },
    {
      "cve": "CVE-2018-8034",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-8034"
    },
    {
      "cve": "CVE-2018-8014",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-8014"
    },
    {
      "cve": "CVE-2018-15756",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-15756"
    },
    {
      "cve": "CVE-2018-1336",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-1336"
    },
    {
      "cve": "CVE-2018-1305",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-1305"
    },
    {
      "cve": "CVE-2018-1304",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-1304"
    },
    {
      "cve": "CVE-2018-1275",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-1275"
    },
    {
      "cve": "CVE-2018-1272",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-1272"
    },
    {
      "cve": "CVE-2018-1271",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-1271"
    },
    {
      "cve": "CVE-2018-1270",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-1270"
    },
    {
      "cve": "CVE-2018-1257",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-1257"
    },
    {
      "cve": "CVE-2018-1199",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-1199"
    },
    {
      "cve": "CVE-2018-1196",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-1196"
    },
    {
      "cve": "CVE-2018-11784",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-11784"
    },
    {
      "cve": "CVE-2018-11040",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-11040"
    },
    {
      "cve": "CVE-2018-11039",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2018-11039"
    },
    {
      "cve": "CVE-2017-8046",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2017-8046"
    },
    {
      "cve": "CVE-2017-7675",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2017-7675"
    },
    {
      "cve": "CVE-2017-7674",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2017-7674"
    },
    {
      "cve": "CVE-2017-5664",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2017-5664"
    },
    {
      "cve": "CVE-2017-5651",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2017-5651"
    },
    {
      "cve": "CVE-2017-5650",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2017-5650"
    },
    {
      "cve": "CVE-2017-5648",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2017-5648"
    },
    {
      "cve": "CVE-2017-5647",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2017-5647"
    },
    {
      "cve": "CVE-2017-18640",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2017-18640"
    },
    {
      "cve": "CVE-2017-12617",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2017-12617"
    },
    {
      "cve": "CVE-2016-9878",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2016-9878"
    },
    {
      "cve": "CVE-2016-8745",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2016-8745"
    },
    {
      "cve": "CVE-2016-8735",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2016-8735"
    },
    {
      "cve": "CVE-2016-6817",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2016-6817"
    },
    {
      "cve": "CVE-2016-6816",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Dell Data Protection Advisor. Diese Fehler bestehen in den Komponenten von Drittanbietern wie Apache Tomcat, Java SE oder Spring Framework und anderen aufgrund mehrerer sicherheitsrelevanter Probleme. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, einen Denial-of-Service-Zustand herbeizuf\u00fchren, Dateien zu manipulieren, vertrauliche Informationen offenzulegen, seine Rechte zu erweitern oder einen nicht spezifizierten Angriff durchzuf\u00fchren."
        }
      ],
      "release_date": "2024-02-29T23:00:00.000+00:00",
      "title": "CVE-2016-6816"
    }
  ]
}