Skip to main content

Apache TomEE 9.1.x Support

Common Vulnerabilities & Exposures (CVE)

First release: 2023-06-06
Support Lifecycle: Full Support
CVEs: 10
Namespace: javax
Get Support

What Versions do we cover?


9.1.0

9.1.1

9.1.2

9.1.3

Latest Apache TomEE 9.1.x CVEs

CVE
Severity
Description
Category
Affected
CVE-2023-51775
2023-12-25
0.0
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
data
n/a
Details
CVE-2023-46589
2023-10-23
7.5
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.
dataoperational
CWE-444
Details
CVE-2023-46604
2023-10-24
10.0
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
dataoperational
CWE-502:
Details
CVE-2023-44483
2023-09-29
7.4
All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.
configurationfunctional
CWE-532
Details
CVE-2023-42795
2023-09-14
5.9
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
dataoperational
CWE-459
Details

Most Critical Apache TomEE 9.1.x CVEs

CVE
Severity
Description
Category
Affected
CVE-2023-46604
2023-10-24
10.0
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
dataoperational
CWE-502:
Details
CVE-2023-45648
2023-10-10
7.5
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.
dataoperational
CWE-20
Details
CVE-2023-46589
2023-10-23
7.5
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.
dataoperational
CWE-444
Details
CVE-2022-45143
2022-11-10
6.5
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
dataoperational
CWE-74
Details
CVE-2021-37533
2021-07-26
6.5
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
datafunctional
CWE-20
Details

What We Deliver

Migration support

Production & Development support

1 hr response-time

Unlimited support incidents

5 languages supported

Fast bug fixes & security patch turnaround

Enterprise Support Details

Subscription Level
Bronze
Silver
Gold
Core Count
64 cores
120 cores
248 cores
Apache Tomcat
✓
✓
✓
Apache TomEE
✓
✓
✓
Apache ActiveMQ
✓
✓
✓
Tribestream API Gateway
✓
✓
✓
SLA
24x7
24x7
24x7
Response Time
1hr
1hr
1hr
Incidents
unlimited
unlimited
unlimited
CVE Patching
unlimited
unlimited
unlimited
Developer Questions
1 parallel
2 parallel
4 parallel
Admin Contacts
2
3
4
Phone, Email, Portal
✓
✓
✓
Professional Services
3 days
5 days
10 days
Training
2 days
3 days
5 days
Feature Development
10 days
17 days
25 days