[TOMEE-2909] Impact of security vulnerability(CVE-2020-9484) on TOMEE plus (7.0.7)

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 7.0.9
• Assignee: Jonathan Gallimore
• Reporter: Hariprasad tammineni
• Created: 13/Oct/20 08:57
• Updated: 22/May/21 17:33
• Resolved: 22/May/21 17:33

Description

TomEE plus (7.0.7) is using Apache Tomcat 8.5.50 version. Can you confirm if TomEE plus (7.0.7) is impacted by CVE-2020-9484 or BDSA-2020-1193?

Solution - (Copied from BDSA record)
Fixed in 10.0.0.M5 by this commit.

The latest stable releases can be found here.

http://tomcat.apache.org/security-10.html

Advisories

• http://tomcat.apache.org/security-10.html

If impacted, can you please upgrade TOMEE plus(7.0.7) with fixed versions of Tomcat ?