<div>
<div class="content wysiwyg-content">
Hi All,<br />
<br />
Do we have a consolidated list for mitigations for vulnerabilities released by Apache and tomcat. I have seen this only once for Apache (<a href="http://httpd.apache.org/security/CVE-2011-3192.txt" rel="ugc">http://httpd.apache.org/security/CVE-2011-3192.txt</a>). The reason being, if there are official mitigations like this released by Apache or Tomcat then we can avoid micro version upgrades.<br />
<br />
Thanks.<br />
Arun
</div>
</div>


Hi All,

Do we have a consolidated list for mitigations for vulnerabilities released by Apache and tomcat. I have seen this only once for Apache (http://httpd.apache.org/security/CVE-2011-3192.txt). The reason being, if there are official mitigations like this released by Apache or Tomcat then we can avoid micro version upgrades.

Thanks.
Arun

Apache and Tomcat Vulnerability Mitigations

A vulnerability is a weakness which allows an attacker to reduce a system's information assurance. Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw. To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness, known as the attack surface. Vulnerability management is the cyclical practice of identifying, classifying, remediating, and mitigating vulnerabilities. Other vulnerabilities include security risks, security defects and constructs in programming languages that are difficult to use properly.

Vulnerabilities

The Apache HTTP Server is a secure, efficient and extensible server that provides HTTP services in sync with the current HTTP standards. Typically Apache is run on a Unix-like operating system, but it is available for a wide variety of operating systems, including Linux, Novell NetWare, Mac OS-X and Windows. Released under the Apache License, Apache is open-source software.