CVE-2019-0232 Apache Tomcat OS Command Injection vulnerability
HighCVSS 8.1
EPSS 99.9%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 8.0.0, < 8.5.40 | 8.5.40 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 7.0.0, < 7.0.94 | 7.0.94 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | >= 9.0.0.M1, < 9.0.17 | 9.0.17 |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M1 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M10 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M13 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M15 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M17 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M18 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M19 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M22 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M25 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M26 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.0.M9 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.1 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.10 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.11 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.12 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.13 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.14 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.16 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.2 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.7 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 9.0.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.1 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.12 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.14 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.15 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.17 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.18 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.22 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.23 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.24 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.26 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.28 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.29 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.30 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.32 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.33 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.35 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.36 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.37 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.38 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.39 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.41 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.42 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.43 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.44 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.45 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.46 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.47 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.48 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.49 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.50 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.51 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.52 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.53 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.0.9 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.0 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.12 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.13 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.14 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.15 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.16 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.19 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.2 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.23 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.24 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.28 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.29 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.3 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.30 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.31 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.32 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.33 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.34 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.35 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.37 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.38 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.39 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 8.5.9 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.0 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.11 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.12 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.14 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.16 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.19 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.2 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.20 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.21 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.22 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.23 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.25 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.26 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.27 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.28 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.29 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.30 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.32 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.33 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.34 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.35 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.37 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.39 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.4 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.40 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.41 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.42 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.47 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.5 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.50 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.52 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.53 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.54 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.55 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.56 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.57 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.59 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.6 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.61 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.62 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.63 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.64 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.65 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.67 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.68 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.69 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.70 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.72 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.73 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.75 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.76 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.77 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.78 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.79 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.8 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.81 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.82 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.84 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.85 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.86 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.88 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.90 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.91 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.92 | No fix listed |
| org.apache.tomcat.embed/tomcat-embed-core(Maven) | = 7.0.93 | No fix listed |
| apache tomcat | = 9.0.0.M1 to 9.0.17 | No fix listed |
| apache tomcat | = 8.5.0 to 8.5.39 | No fix listed |
| apache tomcat | = 7.0.0 to 7.0.93 | No fix listed |
| apache tomcat | >= 7.0.0, <= 7.0.93 | No fix listed |
| apache tomcat | >= 8.5.0, <= 8.5.39 | No fix listed |
| apache tomcat | >= 9.0.1, <= 9.0.17 | No fix listed |
| apache tomcat | = 9.0.0-milestone1 | No fix listed |
| apache tomcat | = 9.0.0-milestone10 | No fix listed |
| apache tomcat | = 9.0.0-milestone11 | No fix listed |
| apache tomcat | = 9.0.0-milestone12 | No fix listed |
| apache tomcat | = 9.0.0-milestone13 | No fix listed |
| apache tomcat | = 9.0.0-milestone14 | No fix listed |
| apache tomcat | = 9.0.0-milestone15 | No fix listed |
| apache tomcat | = 9.0.0-milestone16 | No fix listed |
| apache tomcat | = 9.0.0-milestone17 | No fix listed |
| apache tomcat | = 9.0.0-milestone18 | No fix listed |
| apache tomcat | = 9.0.0-milestone19 | No fix listed |
| apache tomcat | = 9.0.0-milestone2 | No fix listed |
| apache tomcat | = 9.0.0-milestone20 | No fix listed |
| apache tomcat | = 9.0.0-milestone21 | No fix listed |
| apache tomcat | = 9.0.0-milestone22 | No fix listed |
| apache tomcat | = 9.0.0-milestone23 | No fix listed |
| apache tomcat | = 9.0.0-milestone24 | No fix listed |
| apache tomcat | = 9.0.0-milestone25 | No fix listed |
| apache tomcat | = 9.0.0-milestone26 | No fix listed |
| apache tomcat | = 9.0.0-milestone3 | No fix listed |
| apache tomcat | = 9.0.0-milestone4 | No fix listed |
| apache tomcat | = 9.0.0-milestone5 | No fix listed |
References
- Debian Security Tracker CVE-2019-0232 vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2019:1712 vendor-advisory
- blog.trendmicro.com
- codewhitesec.blogspot.com third-party-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- security.netapp.com third-party-advisory
- web.archive.org third-party-advisory
- www.broadcom.com technical-description
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.synology.com
- wwws.nightwatchcybersecurity.com
- packetstormsecurity.com exploit
- 20190504 RCE in CGI Servlet - Apache Tomcat on Windows - CVE-2019-0232 mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [ofbiz-commits] 20190415 svn commit: r1857588 - in /ofbiz: ofbiz-framework/branches/release17.12/build.gradle ofbiz-plugins/branches/release17.12/example/build.gradle mailing-list
- [tomcat-users] 20190410 [SECURITY] CVE-2019-0232 Apache Tomcat Remote Code Execution on Windows mailing-list
- [ofbiz-commits] 20190415 svn commit: r1857587 - in /ofbiz: ofbiz-framework/branches/release18.12/build.gradle ofbiz-plugins/branches/release18.12/example/build.gradle mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [ofbiz-notifications] 20190415 [jira] [Closed] (OFBIZ-10920) Update Tomcat to 9.0.18 due to CVE-2019-0232 mailing-list
- [ofbiz-commits] 20190415 svn commit: r1857586 - in /ofbiz: ofbiz-framework/trunk/build.gradle ofbiz-plugins/trunk/example/build.gradle mailing-list
- [ofbiz-notifications] 20190415 [jira] [Commented] (OFBIZ-10920) Update Tomcat to 9.0.18 due to CVE-2019-0232 mailing-list
- [tomcat-dev] 20190421 svn commit: r1857901 - in /tomcat/site/trunk: docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ mailing-list
- [announce] 20200131 Apache Software Foundation Security Report: 2019 mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ mailing-list
- web.archive.org
- github.com
- github.com product
- 107906 third-party-advisory vdb-entry