This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2015-5345 →
UBUNTU-CVE-2015-5345
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before cons...
Original description
The description as published by the source.
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:14.04:LTS
tomcat6
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.39-1ubuntu0.1"}]}]
Ubuntu:14.04:LTS
tomcat7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.6"}]}]
Ubuntu:16.04:LTS
tomcat6
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.45+dfsg-1"}]}]
Ubuntu:18.04:LTS
tomcat9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3~18.04.1"}]}]
References
- advisory ubuntu.com
- report ubuntu.com
- report seclists.org
- report cve.org