VDB
RHSA-2020%3A2509
RHSA-2020%3A2509
PUBLISHED
CVSS 7 HIGH
Record from redhat · Published June 10, 2020
A deserialization flaw was discovered in Apache Tomcat's use of a FileStore. Under specific circumstances, an attacker can use a specially crafted request to trigger Remote Code Execution through deserialization of the file under their control. The highest threat from the vulnerability is to data confidentiality and integrity as well as system availability.
Risk scores
CVSS 3.1
7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat JBoss Web Server (JWS) 5.3 |
Timeline
- Jun 10, 2020 CVE Published
- May 1, 2026 Distribution Patch (2 in total, the first dated here)
- May 14, 2026 CVE Updated
- May 15, 2026 Security Advisory (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln RHSA-2020%3A2509
vulnetix vdb fixes RHSA-2020%3A2509Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/RHSA-2020%253A2509/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.3/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2509.json advisory
- http://mail-archives.apache.org/mod_mbox/tomcat-announce/202005.mbox/%3Ce3a0a517-bf82-ba62-0af6-24b83ea0e4e2%40apache.org%3E advisory
- http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M5 advisory
- http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.104 advisory
- https://access.redhat.com/errata/RHSA-2020:2509 advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=5.3 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1838332 issue
- https://access.redhat.com/security/cve/CVE-2020-9484 advisory
- https://www.cve.org/CVERecord?id=CVE-2020-9484 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-9484 advisory
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.55 advisory
- http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.35 advisory