CVE-2016-6797: Apache Tomcat

High severity, CVSS 7.5. EPSS: 8.1% chance of exploitation in the next 30 days.

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

Affected products

• Apache Tomcat: from 6.0.0, up to and including 6.0.45; from 7.0.0, up to and including 7.0.70; from 8.0, up to and including 8.0.36; from 8.5.0, up to and including 8.5.4; version 9.0.0 only
• Canonical Ubuntu Linux: version 16.04 only
• Debian Debian Linux: version 8.0 only
• Netapp Oncommand Insight: affected versions not specified
• Netapp Oncommand Shift: affected versions not specified
• Netapp Snap Creator Framework: affected versions not specified
• Oracle Tekelec Platform Distribution: from 7.4.0, up to and including 7.7.1
• Red Hat Enterprise Linux Desktop: version 7.0 only
• Red Hat Enterprise Linux Eus: version 7.4 only; version 7.5 only; version 7.6 only; version 7.7 only
• Red Hat Enterprise Linux Server: version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.4 only; version 7.6 only; version 7.7 only
• Red Hat Enterprise Linux Server Tus: version 7.6 only; version 7.7 only
• Red Hat Enterprise Linux Workstation: version 7.0 only
• Red Hat JBoss Enterprise Web Server: version 3.0.0 only

Published 2017-08-10. Last modified 2026-10-08.