| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | ≥ 10.0.0-M1, < 10.0.2≥ 7.0.0, < 7.0.108≥ 8.0.0, < 8.5.61≥ 9.0.0, < 9.0.41 | 10.0.27.0.1088.5.619.0.41 |
| tomcat | = 10.0.0= 9.0.0≥ 7.0.0, ≤ 7.0.107≥ 8.5.0, ≤ 8.5.61≥ 9.0.0, ≤ 9.0.41 | |
| agile product lifecycle management | = 9.3.3= 9.3.6 | |
| communications cloud native core policy | = 1.14.0 | |
| communications cloud native core security edge protection proxy | = 1.6.0 | |
| communications instant messaging server | = 10.0.1.5.0 | |
| database | = 12.2.0.1= 19c= 21c | |
| graph server and client | < 21.3.0 | 21.3.0 |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| managed file transfer | = 12.2.1.3.0= 12.2.1.4.0 | |
| mysql enterprise monitor | ≤ 8.0.23 | |
| siebel ui framework | = 21.9< 21.9 | 21.9 |
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free