What’s Vulnerable › Vulnerabilities

CVE-2016-6797

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-08-10 · updated 2026-10-08
• Weakness: CWE-863

Description

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

Affected products

• Apache Tomcat: from 6.0.0 through 6.0.45; from 7.0.0 through 7.0.70; from 8.0 through 8.0.36; from 8.5.0 through 8.5.4; 9.0.0-milestone1, 9.0.0-milestone2, 9.0.0-milestone3, 9.0.0-milestone4, 9.0.0-milestone5, 9.0.0-milestone6 (+3)
• Canonical Ubuntu Linux: 16.04
• Debian Linux: 8.0
• OnCommand Insight: all versions
• NetApp Oncommand Shift: all versions
• NetApp Snap Creator Framework: all versions
• Oracle Tekelec Platform Distribution: from 7.4.0 through 7.7.1
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Eus: 7.4, 7.5, 7.6, 7.7
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Server Aus: 7.4, 7.6, 7.7
• RedHat Enterprise Linux Server Tus: 7.6, 7.7
• RedHat Enterprise Linux Workstation: 7.0
• Red Hat JBoss Enterprise Web Server: 3.0.0

References

• http://rhn.redhat.com/errata/RHSA-2017-0457.html
• http://www.debian.org/security/2016/dsa-3720
• http://www.securityfocus.com/bid/93940
• http://www.securitytracker.com/id/1037145
• https://access.redhat.com/errata/RHSA-2017:0455
• https://access.redhat.com/errata/RHSA-2017:0456
• https://access.redhat.com/errata/RHSA-2017:2247
• https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E

Get alerted when CVE-2016-6797 or the next vulnerability affects your stack