CVE-2008-2938

Publication date 13 August 2008

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

Status

Package Ubuntu Release Status
tomcat5.5 8.10 intrepid
Fixed 5.5.26-3ubuntu1
8.04 LTS hardy
Fixed 5.5.25-5ubuntu1.1
7.10 gutsy Ignored end of life, was needed
7.04 feisty Ignored end of life, was needed
6.06 LTS dapper Not in release
tomcat6 8.10 intrepid
Not affected
8.04 LTS hardy Not in release
7.10 gutsy Not in release
7.04 feisty Not in release
6.06 LTS dapper Not in release