Patchfirst
Patchfirst
ChainMaven:org.apache.tomcat:tomcat

org.apache.tomcat:tomcat: incomplete fixes (2005–2013)

6 CVEs over 3 generations, 30 Jun 2005 to 26 Feb 2014.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2005-209030 Jun 2005 First in the chain
  2. CVE-2008-293813 Aug 2008 No direct link to an earlier CVE
  3. CVE-2010-222713 Jul 2010 No direct link to an earlier CVE
  4. CVE-2011-319031 Aug 2011 No direct link to an earlier CVE
  5. CVE-2011-337519 Jan 2012 related to CVE-2011-3190related to CVE-2008-2938and 1 more
  6. CVE-2013-428626 Feb 2014 incomplete fix for CVE-2005-2090related to CVE-2010-2227and 2 more
200520072008200920102011201220132014 CVE-2005-2090 → CVE-2013-4286: incomplete fix (high confidence)CVE-2011-3190 → CVE-2011-3375: related (high confidence)CVE-2008-2938 → CVE-2011-3375: related (medium confidence)CVE-2010-2227 → CVE-2011-3375: related (medium confidence)CVE-2010-2227 → CVE-2013-4286: related (medium confidence)CVE-2011-3190 → CVE-2013-4286: related (medium confidence)CVE-2011-3375 → CVE-2013-4286: related (medium confidence) CVE-2005-2090 30 Jun 2005 CVE-2008-2938 13 Aug 2008 CVE-2010-2227 13 Jul 2010 CVE-2011-3190 31 Aug 2011 CVE-2011-3375 19 Jan 2012 CVE-2013-4286 26 Feb 2014 2005200620072008200920102011201220132014 CVE-2005-2090 → CVE-2013-4286: incomplete fix (high confidence)CVE-2011-3190 → CVE-2011-3375: related (high confidence)CVE-2008-2938 → CVE-2011-3375: related (medium confidence)CVE-2010-2227 → CVE-2011-3375: related (medium confidence)CVE-2010-2227 → CVE-2013-4286: related (medium confidence)CVE-2011-3190 → CVE-2013-4286: related (medium confidence)CVE-2011-3375 → CVE-2013-4286: related (medium confidence) CVE-2005-2090 30 Jun 2005 CVE-2008-2938 13 Aug 2008 CVE-2010-2227 13 Jul 2010 CVE-2011-3190 31 Aug 2011 CVE-2011-3375 19 Jan 2012 CVE-2013-4286 26 Feb 2014
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2005-2090 30 Jun 2005 Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache… First in chain 19.6
CVE-2008-2938 13 Aug 2008 Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through… · fixed in 6.0.18 First in chain 27.7
CVE-2010-2227 13 Jul 2010 Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid… · fixed in 7.0.2 First in chain 24.8
CVE-2011-3190 31 Aug 2011 Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0… · fixed in 7.0.21 First in chain 19.4
CVE-2011-3375 19 Jan 2012 Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling… · fixed in 7.0.22 CVE-2011-3190 · related · High 18.7
CVE-2013-4286 26 Feb 2014 Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is… · fixed in 8.0.0-RC3 CVE-2005-2090 · incomplete fix · High 19.4
↑ ↓ chooseEnter openEsc close