{
  "threat_severity" : "Low",
  "public_date" : "2019-04-13T00:00:00Z",
  "bugzilla" : {
    "description" : "tomcat: XSS in SSI printenv",
    "id" : "1713275",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1713275"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.0",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-79",
  "details" : [ "The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website." ],
  "affected_release" : [ {
    "product_name" : "Red Hat JBoss Web Server 3.1",
    "release_date" : "2020-03-17T00:00:00Z",
    "advisory" : "RHSA-2020:0860",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:3.1",
    "package" : "tomcat"
  }, {
    "product_name" : "Red Hat JBoss Web Server 3 for RHEL 6",
    "release_date" : "2020-03-17T00:00:00Z",
    "advisory" : "RHSA-2020:0861",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6",
    "package" : "tomcat7-0:7.0.70-38.ep7.el6"
  }, {
    "product_name" : "Red Hat JBoss Web Server 3 for RHEL 6",
    "release_date" : "2020-03-17T00:00:00Z",
    "advisory" : "RHSA-2020:0861",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6",
    "package" : "tomcat8-0:8.0.36-42.ep7.el6"
  }, {
    "product_name" : "Red Hat JBoss Web Server 3 for RHEL 6",
    "release_date" : "2020-03-17T00:00:00Z",
    "advisory" : "RHSA-2020:0861",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6",
    "package" : "tomcat-native-0:1.2.23-21.redhat_21.ep7.el6"
  }, {
    "product_name" : "Red Hat JBoss Web Server 3 for RHEL 7",
    "release_date" : "2020-03-17T00:00:00Z",
    "advisory" : "RHSA-2020:0861",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7",
    "package" : "tomcat7-0:7.0.70-38.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Web Server 3 for RHEL 7",
    "release_date" : "2020-03-17T00:00:00Z",
    "advisory" : "RHSA-2020:0861",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7",
    "package" : "tomcat8-0:8.0.36-42.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Web Server 3 for RHEL 7",
    "release_date" : "2020-03-17T00:00:00Z",
    "advisory" : "RHSA-2020:0861",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7",
    "package" : "tomcat-native-0:1.2.23-21.redhat_21.ep7.el7"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3931",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2",
    "package" : "tomcat"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 6",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el6",
    "package" : "jws5-ecj-0:4.12.0-1.redhat_1.1.el6jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 6",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el6",
    "package" : "jws5-javapackages-tools-0:3.4.1-5.15.11.el6jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 6",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el6",
    "package" : "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el6jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 6",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el6",
    "package" : "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el6jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 6",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el6",
    "package" : "jws5-tomcat-0:9.0.21-10.redhat_4.1.el6jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 6",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el6",
    "package" : "jws5-tomcat-native-0:1.2.21-34.redhat_34.el6jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 6",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el6",
    "package" : "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el6jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 7",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el7",
    "package" : "jws5-ecj-0:4.12.0-1.redhat_1.1.el7jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 7",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el7",
    "package" : "jws5-javapackages-tools-0:3.4.1-5.15.11.el7jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 7",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el7",
    "package" : "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el7jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 7",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el7",
    "package" : "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el7jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 7",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el7",
    "package" : "jws5-tomcat-0:9.0.21-10.redhat_4.1.el7jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 7",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el7",
    "package" : "jws5-tomcat-native-0:1.2.21-34.redhat_34.el7jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 7",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el7",
    "package" : "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el7jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 8",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el8",
    "package" : "jws5-ecj-0:4.12.0-1.redhat_1.1.el8jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 8",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el8",
    "package" : "jws5-javapackages-tools-0:3.4.1-5.15.11.el8jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 8",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el8",
    "package" : "jws5-jboss-logging-0:3.3.2-1.Final_redhat_00001.1.el8jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 8",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el8",
    "package" : "jws5-mod_cluster-0:1.4.1-1.Final_redhat_00001.2.el8jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 8",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el8",
    "package" : "jws5-tomcat-0:9.0.21-10.redhat_4.1.el8jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 8",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el8",
    "package" : "jws5-tomcat-native-0:1.2.21-34.redhat_34.el8jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.2 on RHEL 8",
    "release_date" : "2019-11-20T00:00:00Z",
    "advisory" : "RHSA-2019:3929",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.2::el8",
    "package" : "jws5-tomcat-vault-0:1.1.8-1.Final_redhat_1.1.el8jws"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat BPM Suite 6",
    "fix_state" : "Out of support scope",
    "package_name" : "tomcat",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "tomcat6",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "pki-deps:10.6/pki-servlet-container",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Fuse 7",
    "fix_state" : "Not affected",
    "package_name" : "tomcat",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7"
  }, {
    "product_name" : "Red Hat JBoss BRMS 5",
    "fix_state" : "Out of support scope",
    "package_name" : "jbossweb",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:5"
  }, {
    "product_name" : "Red Hat JBoss BRMS 6",
    "fix_state" : "Out of support scope",
    "package_name" : "tomcat",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Data Grid 6",
    "fix_state" : "Out of support scope",
    "package_name" : "jbossweb",
    "cpe" : "cpe:/a:redhat:jboss_data_grid:6"
  }, {
    "product_name" : "Red Hat JBoss Data Grid 7",
    "fix_state" : "Not affected",
    "package_name" : "tomcat",
    "cpe" : "cpe:/a:redhat:jboss_data_grid:7"
  }, {
    "product_name" : "Red Hat JBoss Data Virtualization 6",
    "fix_state" : "Out of support scope",
    "package_name" : "jbossweb",
    "cpe" : "cpe:/a:redhat:jboss_data_virtualization:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 5",
    "fix_state" : "Out of support scope",
    "package_name" : "jbossweb",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:5"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Out of support scope",
    "package_name" : "jbossweb",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Fuse 6",
    "fix_state" : "Out of support scope",
    "package_name" : "tomcat",
    "cpe" : "cpe:/a:redhat:jboss_fuse:6"
  }, {
    "product_name" : "Red Hat JBoss Operations Network 3",
    "fix_state" : "Out of support scope",
    "package_name" : "jbossweb",
    "cpe" : "cpe:/a:redhat:jboss_operations_network:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-0221\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-0221" ],
  "name" : "CVE-2019-0221",
  "mitigation" : {
    "value" : "SSI is disabled in the default Tomcat configuration. The vulnerable printenv command is intended for debugging, and is recommended to not be enabled for a production website.",
    "lang" : "en:us"
  },
  "csaw" : false
}