Patchfirst
Patchfirst
ChainApache Traffic ServerMaven:org.apache.tomcat:tomcat

Apache Traffic Server: incomplete fixes (2009–2021)

7 CVEs over 3 generations, 28 Jan 2010 to 1 Mar 2021.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2009-269328 Jan 2010 First in the chain
  2. CVE-2009-290128 Jan 2010 No direct link to an earlier CVE
  3. CVE-2009-290228 Jan 2010 No direct link to an earlier CVE
  4. CVE-2014-009631 May 2014 No direct link to an earlier CVE
  5. CVE-2020-948420 May 2020 related to CVE-2009-2693related to CVE-2009-2901and 2 more
  6. CVE-2020-949424 Jun 2020 No direct link to an earlier CVE
  7. CVE-2021-253291 Mar 2021 incomplete fix for CVE-2020-9484incomplete fix for CVE-2020-9494and 4 more
201020112012201320142016201820202021 CVE-2020-9484 → CVE-2021-25329: incomplete fix (high confidence)CVE-2020-9494 → CVE-2021-25329: incomplete fix (high confidence)CVE-2009-2693 → CVE-2020-9484: related (medium confidence)CVE-2009-2693 → CVE-2021-25329: related (medium confidence)CVE-2009-2901 → CVE-2020-9484: related (medium confidence)CVE-2009-2901 → CVE-2021-25329: related (medium confidence)CVE-2009-2902 → CVE-2020-9484: related (medium confidence)CVE-2009-2902 → CVE-2021-25329: related (medium confidence)CVE-2014-0096 → CVE-2020-9484: related (medium confidence)CVE-2014-0096 → CVE-2021-25329: related (medium confidence) CVE-2009-2693 28 Jan 2010 CVE-2009-2901 28 Jan 2010 CVE-2009-2902 28 Jan 2010 CVE-2014-0096 31 May 2014 CVE-2020-9484 20 May 2020 CVE-2020-9494 24 Jun 2020 CVE-2021-25329 1 Mar 2021 201020112012201320142015201620172018201920202021 CVE-2020-9484 → CVE-2021-25329: incomplete fix (high confidence)CVE-2020-9494 → CVE-2021-25329: incomplete fix (high confidence)CVE-2009-2693 → CVE-2020-9484: related (medium confidence)CVE-2009-2693 → CVE-2021-25329: related (medium confidence)CVE-2009-2901 → CVE-2020-9484: related (medium confidence)CVE-2009-2901 → CVE-2021-25329: related (medium confidence)CVE-2009-2902 → CVE-2020-9484: related (medium confidence)CVE-2009-2902 → CVE-2021-25329: related (medium confidence)CVE-2014-0096 → CVE-2020-9484: related (medium confidence)CVE-2014-0096 → CVE-2021-25329: related (medium confidence) CVE-2009-2693 28 Jan 2010 CVE-2009-2901 28 Jan 2010 CVE-2009-2902 28 Jan 2010 CVE-2014-0096 31 May 2014 CVE-2020-9484 20 May 2020 CVE-2020-9494 24 Jun 2020 CVE-2021-25329 1 Mar 2021
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2009-2693 28 Jan 2010 Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote… · fixed in 6.0.24 First in chain 19.1
CVE-2009-2901 28 Jan 2010 The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled… · fixed in 6.0.24 First in chain 19.0
CVE-2009-2902 28 Jan 2010 Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote… · fixed in 6.0.24 First in chain 19.2
CVE-2014-0096 31 May 2014 java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x… · fixed in 8.0.6 First in chain 18.8
CVE-2020-9484 20 May 2020 When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if… · fixed in 10.0.0-M5 CVE-2009-2693 · related · Medium 27.1
CVE-2020-9494 24 Jun 2020 Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2… First in chain 17.9
CVE-2021-25329 1 Mar 2021 Incomplete fix for CVE-2020-9484 · fixed in 10.0.2 CVE-2020-9484 · incomplete fix · High 19.1
↑ ↓ chooseEnter openEsc close