| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | ≥ 10.0.0-M1, < 10.0.2≥ 8.5.0, < 8.5.63≥ 9.0.0-M1, < 9.0.43 | 10.0.28.5.639.0.43 |
| org.apache.tomcat:tomcat-coyote | ≥ 10.0.0-M1, < 10.0.2 | 10.0.2 |
| tomcat | = 10.0.0= 9.0.0≥ 8.5.0, ≤ 8.5.61≥ 9.0.0, ≤ 9.0.41 | |
| agile product lifecycle management | = 9.3.3= 9.3.6 | |
| communications cloud native core policy | = 1.14.0 | |
| communications cloud native core security edge protection proxy | = 1.6.0 | |
| communications instant messaging server | = 10.0.1.5.0 | |
| database | = 12.2.0.1= 19c= 21c | |
| graph server and client | = 21.3.0< 21.3.0 | 21.3.0 |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| managed file transfer | = 12.2.1.3.0= 12.2.1.4.0 | |
| mysql enterprise monitor | ≤ 8.0.23 | |
| siebel ui framework | ≤ 21.9 |
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free