Every applicability statement published about this vulnerability, kept as each source wrote it rather than merged into one verdict. Where sources disagree, both positions are shown.
A statement that names no version covers the whole product, which is not the same as your version falling inside a range. Orderings marked best effort come from schemes with no published comparison algorithm; exact ones follow a published specification.
Precedence decides which claim wins when two sources describe the same product over the same version range. It is a property of the source, not of the claim, and changing it re-ranks the data without re-reading a single document.
| Product | Status | Versions | Remediation | Source | |
|---|---|---|---|---|---|
| red_hat_amq_broker_7:tomcat tomcat as a component of Red Hat AMQ Broker 7 | affected | no version stated vendor label: tomcat | workaround fix in another branch | csaf_redhat | |
| red_hat_build_of_apache_camel_for_spring_boot_3:tomcat tomcat as a component of Red Hat build of Apache Camel for Spring Boot 3 | affected | no version stated vendor label: tomcat | no fix planned fix in another branch | csaf_redhat | |
| red_hat_build_of_optaplanner_8:tomcat tomcat as a component of Red Hat build of OptaPlanner 8 | affected | no version stated vendor label: tomcat | no fix planned fix in another branch | csaf_redhat | |
| red_hat_decision_manager_7:tomcat tomcat as a component of Red Hat Decision Manager 7 | affected | no version stated vendor label: tomcat | no fix planned fix in another branch | csaf_redhat | |
| red_hat_jboss_data_grid_7:tomcat tomcat as a component of Red Hat JBoss Data Grid 7 | affected | no version stated vendor label: tomcat | no fix planned fix in another branch | csaf_redhat | |
| red_hat_jboss_enterprise_application_platform_6:tomcat tomcat as a component of Red Hat JBoss Enterprise Application Platform 6 | affected | no version stated vendor label: tomcat | no fix planned fix in another branch | csaf_redhat | |
| red_hat_jboss_enterprise_application_platform_expansion_pack:tomcat tomcat as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack | affected | no version stated vendor label: tomcat | no fix planned fix in another branch | csaf_redhat | |
| red_hat_openshift_application_runtimes:tomcat tomcat as a component of Red Hat OpenShift Application Runtimes | affected | no version stated vendor label: tomcat | workaround fix in another branch | csaf_redhat | |
| red_hat_process_automation_7:tomcat tomcat as a component of Red Hat Process Automation 7 | affected | no version stated vendor label: tomcat | no fix planned fix in another branch | csaf_redhat | |
| streams_for_apache_kafka:tomcat tomcat as a component of streams for Apache Kafka | affected | no version stated vendor label: tomcat | no fix planned fix in another branch | csaf_redhat | |
| Red Hat Fuse 7.12.1 | fixed | no version stated | vendor fix | csaf_redhat | |
| Red Hat JBoss Web Server 5 | fixed | no version stated | vendor fix | csaf_redhat | |
| AppStream-8.9.0.Z.MAIN:tomcat-1:9.0.62-27.el8_9.2.noarch tomcat-1:9.0.62-27.el8_9.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8) | fixed | tomcat-1:9.0.62-27.el8_9.2.noarch | vendor fix → tomcat-1:9.0.62-27.el8_9.2.noarch (RHSA-2024:0125) | csaf_redhat | |
| AppStream-8.9.0.Z.MAIN:tomcat-1:9.0.62-27.el8_9.2.src tomcat-1:9.0.62-27.el8_9.2.src as a component of Red Hat Enterprise Linux AppStream (v. 8) | fixed | tomcat-1:9.0.62-27.el8_9.2.src | vendor fix → tomcat-1:9.0.62-27.el8_9.2.src (RHSA-2024:0125) | csaf_redhat | |
| AppStream-9.3.0.Z.MAIN:tomcat-1:9.0.62-37.el9_3.1.noarch tomcat-1:9.0.62-37.el9_3.1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | fixed | tomcat-1:9.0.62-37.el9_3.1.noarch | vendor fix → tomcat-1:9.0.62-37.el9_3.1.noarch (RHSA-2024:0474) | csaf_redhat | |
| AppStream-9.3.0.Z.MAIN:tomcat-1:9.0.62-37.el9_3.1.src tomcat-1:9.0.62-37.el9_3.1.src as a component of Red Hat Enterprise Linux AppStream (v. 9) | fixed | tomcat-1:9.0.62-37.el9_3.1.src | vendor fix → tomcat-1:9.0.62-37.el9_3.1.src (RHSA-2024:0474) | csaf_redhat | |
| AppStream-8.9.0.Z.MAIN:tomcat-admin-webapps-1:9.0.62-27.el8_9.2.noarch tomcat-admin-webapps-1:9.0.62-27.el8_9.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8) | fixed | tomcat-admin-webapps-1:9.0.62-27.el8_9.2.noarch | vendor fix → tomcat-admin-webapps-1:9.0.62-27.el8_9.2.noarch (RHSA-2024:0125) | csaf_redhat | |
| AppStream-9.3.0.Z.MAIN:tomcat-admin-webapps-1:9.0.62-37.el9_3.1.noarch tomcat-admin-webapps-1:9.0.62-37.el9_3.1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | fixed | tomcat-admin-webapps-1:9.0.62-37.el9_3.1.noarch | vendor fix → tomcat-admin-webapps-1:9.0.62-37.el9_3.1.noarch (RHSA-2024:0474) | csaf_redhat | |
| AppStream-8.9.0.Z.MAIN:tomcat-docs-webapp-1:9.0.62-27.el8_9.2.noarch tomcat-docs-webapp-1:9.0.62-27.el8_9.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8) | fixed | tomcat-docs-webapp-1:9.0.62-27.el8_9.2.noarch | vendor fix → tomcat-docs-webapp-1:9.0.62-27.el8_9.2.noarch (RHSA-2024:0125) | csaf_redhat | |
| AppStream-9.3.0.Z.MAIN:tomcat-docs-webapp-1:9.0.62-37.el9_3.1.noarch tomcat-docs-webapp-1:9.0.62-37.el9_3.1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | fixed | tomcat-docs-webapp-1:9.0.62-37.el9_3.1.noarch | vendor fix → tomcat-docs-webapp-1:9.0.62-37.el9_3.1.noarch (RHSA-2024:0474) | csaf_redhat | |
| AppStream-8.9.0.Z.MAIN:tomcat-el-3.0-api-1:9.0.62-27.el8_9.2.noarch tomcat-el-3.0-api-1:9.0.62-27.el8_9.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8) | fixed | tomcat-el-3.0-api-1:9.0.62-27.el8_9.2.noarch | vendor fix → tomcat-el-3.0-api-1:9.0.62-27.el8_9.2.noarch (RHSA-2024:0125) | csaf_redhat | |
| AppStream-9.3.0.Z.MAIN:tomcat-el-3.0-api-1:9.0.62-37.el9_3.1.noarch tomcat-el-3.0-api-1:9.0.62-37.el9_3.1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | fixed | tomcat-el-3.0-api-1:9.0.62-37.el9_3.1.noarch | vendor fix → tomcat-el-3.0-api-1:9.0.62-37.el9_3.1.noarch (RHSA-2024:0474) | csaf_redhat | |
| AppStream-8.9.0.Z.MAIN:tomcat-jsp-2.3-api-1:9.0.62-27.el8_9.2.noarch tomcat-jsp-2.3-api-1:9.0.62-27.el8_9.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8) | fixed | tomcat-jsp-2.3-api-1:9.0.62-27.el8_9.2.noarch | vendor fix → tomcat-jsp-2.3-api-1:9.0.62-27.el8_9.2.noarch (RHSA-2024:0125) | csaf_redhat | |
| AppStream-9.3.0.Z.MAIN:tomcat-jsp-2.3-api-1:9.0.62-37.el9_3.1.noarch tomcat-jsp-2.3-api-1:9.0.62-37.el9_3.1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | fixed | tomcat-jsp-2.3-api-1:9.0.62-37.el9_3.1.noarch | vendor fix → tomcat-jsp-2.3-api-1:9.0.62-37.el9_3.1.noarch (RHSA-2024:0474) | csaf_redhat | |
| AppStream-8.9.0.Z.MAIN:tomcat-lib-1:9.0.62-27.el8_9.2.noarch tomcat-lib-1:9.0.62-27.el8_9.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8) | fixed | tomcat-lib-1:9.0.62-27.el8_9.2.noarch | vendor fix → tomcat-lib-1:9.0.62-27.el8_9.2.noarch (RHSA-2024:0125) | csaf_redhat | |
| AppStream-9.3.0.Z.MAIN:tomcat-lib-1:9.0.62-37.el9_3.1.noarch tomcat-lib-1:9.0.62-37.el9_3.1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | fixed | tomcat-lib-1:9.0.62-37.el9_3.1.noarch | vendor fix → tomcat-lib-1:9.0.62-37.el9_3.1.noarch (RHSA-2024:0474) | csaf_redhat | |
| AppStream-8.9.0.Z.MAIN:tomcat-servlet-4.0-api-1:9.0.62-27.el8_9.2.noarch tomcat-servlet-4.0-api-1:9.0.62-27.el8_9.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8) | fixed | tomcat-servlet-4.0-api-1:9.0.62-27.el8_9.2.noarch | vendor fix → tomcat-servlet-4.0-api-1:9.0.62-27.el8_9.2.noarch (RHSA-2024:0125) | csaf_redhat | |
| AppStream-9.3.0.Z.MAIN:tomcat-servlet-4.0-api-1:9.0.62-37.el9_3.1.noarch tomcat-servlet-4.0-api-1:9.0.62-37.el9_3.1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | fixed | tomcat-servlet-4.0-api-1:9.0.62-37.el9_3.1.noarch | vendor fix → tomcat-servlet-4.0-api-1:9.0.62-37.el9_3.1.noarch (RHSA-2024:0474) | csaf_redhat | |
| AppStream-8.9.0.Z.MAIN:tomcat-webapps-1:9.0.62-27.el8_9.2.noarch tomcat-webapps-1:9.0.62-27.el8_9.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8) | fixed | tomcat-webapps-1:9.0.62-27.el8_9.2.noarch | vendor fix → tomcat-webapps-1:9.0.62-27.el8_9.2.noarch (RHSA-2024:0125) | csaf_redhat | |
| AppStream-9.3.0.Z.MAIN:tomcat-webapps-1:9.0.62-37.el9_3.1.noarch tomcat-webapps-1:9.0.62-37.el9_3.1.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | fixed | tomcat-webapps-1:9.0.62-37.el9_3.1.noarch | vendor fix → tomcat-webapps-1:9.0.62-37.el9_3.1.noarch (RHSA-2024:0474) | csaf_redhat | |
| red_hat_openshift_dev_spaces:devspaces/server-rhel8 devspaces/server-rhel8 as a component of Red Hat OpenShift Dev Spaces | not affected vulnerable code not present | devspaces/server-rhel8 | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_8:pki-servlet-4.0-api::pki-deps:10.6 pki-servlet-4.0-api (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8 | not affected vulnerable code not present | pki-servlet-4.0-api::pki-deps:10.6 | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:pki-servlet-4.0-api pki-servlet-4.0-api as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: pki-servlet-4.0-api | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_8:pki-servlet-container pki-servlet-container as a component of Red Hat Enterprise Linux 8 | not affected vulnerable code not present | no version stated vendor label: pki-servlet-container | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_8:pki-servlet-engine::pki-deps:10.6 pki-servlet-engine (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8 | not affected vulnerable code not present | pki-servlet-engine::pki-deps:10.6 | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:pki-servlet-engine pki-servlet-engine as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: pki-servlet-engine | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_8:pki-servlet-engine.src::pki-deps:10.6 pki-servlet-engine.src (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8 | not affected vulnerable code not present | pki-servlet-engine.src::pki-deps:10.6 | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:pki-servlet-engine.src pki-servlet-engine.src as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: pki-servlet-engine.src | not applicable | csaf_redhat | |
| a-mq_clients_2:tomcat tomcat as a component of A-MQ Clients 2 | not affected vulnerable code not present | no version stated vendor label: tomcat | not applicable | csaf_redhat | |
| red_hat_data_grid_8:tomcat tomcat as a component of Red Hat Data Grid 8 | not affected vulnerable code not present | no version stated vendor label: tomcat | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_7:tomcat tomcat as a component of Red Hat Enterprise Linux 7 | not affected vulnerable code not present | no version stated vendor label: tomcat | not applicable | csaf_redhat | |
| red_hat_jboss_enterprise_application_platform_7:tomcat tomcat as a component of Red Hat JBoss Enterprise Application Platform 7 | not affected vulnerable code not present | no version stated vendor label: tomcat | not applicable | csaf_redhat | |
| red_hat_jboss_enterprise_application_platform_8:tomcat tomcat as a component of Red Hat JBoss Enterprise Application Platform 8 | not affected vulnerable code not present | no version stated vendor label: tomcat | not applicable | csaf_redhat | |
| red_hat_jboss_web_server_5:tomcat tomcat as a component of Red Hat JBoss Web Server 5 | not affected vulnerable code not present | no version stated vendor label: tomcat | not applicable | csaf_redhat | |
| red_hat_single_sign-on_7:tomcat tomcat as a component of Red Hat Single Sign-On 7 | not affected vulnerable code not present | no version stated vendor label: tomcat | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_7:tomcat-admin-webapps tomcat-admin-webapps as a component of Red Hat Enterprise Linux 7 | not affected vulnerable code not present | no version stated vendor label: tomcat-admin-webapps | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_7:tomcat-docs-webapp tomcat-docs-webapp as a component of Red Hat Enterprise Linux 7 | not affected vulnerable code not present | no version stated vendor label: tomcat-docs-webapp | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_7:tomcat-el-2.2-api tomcat-el-2.2-api as a component of Red Hat Enterprise Linux 7 | not affected vulnerable code not present | no version stated vendor label: tomcat-el-2.2-api | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_7:tomcat-javadoc tomcat-javadoc as a component of Red Hat Enterprise Linux 7 | not affected vulnerable code not present | no version stated vendor label: tomcat-javadoc | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_7:tomcat-jsp-2.2-api tomcat-jsp-2.2-api as a component of Red Hat Enterprise Linux 7 | not affected vulnerable code not present | no version stated vendor label: tomcat-jsp-2.2-api | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_7:tomcat-jsvc tomcat-jsvc as a component of Red Hat Enterprise Linux 7 | not affected vulnerable code not present | no version stated vendor label: tomcat-jsvc | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_7:tomcat-lib tomcat-lib as a component of Red Hat Enterprise Linux 7 | not affected vulnerable code not present | no version stated vendor label: tomcat-lib | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_7:tomcat-servlet-3.0-api tomcat-servlet-3.0-api as a component of Red Hat Enterprise Linux 7 | not affected vulnerable code not present | no version stated vendor label: tomcat-servlet-3.0-api | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_7:tomcat-webapps tomcat-webapps as a component of Red Hat Enterprise Linux 7 | not affected vulnerable code not present | no version stated vendor label: tomcat-webapps | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_7:tomcat.src tomcat.src as a component of Red Hat Enterprise Linux 7 | not affected vulnerable code not present | no version stated vendor label: tomcat.src | not applicable | csaf_redhat | |
| https://github.com/apache/tomcat | affected | >= 7b1f4ce0b82641bf76a3d763bd97d5522513b57b, < 36d4f7d698f71cd322204a3b242a97c54860fb8c | vendor fix → 36d4f7d698f71cd322204a3b242a97c54860fb8c | osv | |
| https://github.com/apache/tomcat | affected | >= 55a52d8475b8b3ec8ebda739f8c6b4fdeac173d9, < 90a0120a60faf9a3a657b113a7e2cdda2112be91 | vendor fix → 90a0120a60faf9a3a657b113a7e2cdda2112be91 | osv | |
| org.apache.tomcat:tomcat-coyote | affected | >= 9.0.70, < 9.0.81 | vendor fix → 9.0.81 | osv GHSA-jm7m-8jh6-29hp | |
| org.apache.tomcat:tomcat-coyote | affected | >= 8.5.85, < 8.5.94 | vendor fix → 8.5.94 | osv GHSA-jm7m-8jh6-29hp | |
| tomcat | affected | >= 8.5.85, < 8.5.94 | vendor fix → 8.5.94 | osv BIT-tomcat-2023-42794 |
A claim with no version range is shown as written rather than expanded: a government catalog naming only a vendor and product is a real statement at zero granularity, and inventing bounds for it would put precision in the record that the source never offered.