title: Red Hat Security Advisory: tomcat security, bug fix, and enhancement update
description: tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources tomcat: Late application of security constraints can lead to resource exposure for unauthorised users tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins tomcat: Host name verification missing in WebSocket client
cpes: cpe:/o:redhat:enterprise_linux:7::client cpe:/o:redhat:enterprise_linux:7::computenode cpe:/o:redhat:enterprise_linux:7::server cpe:/o:redhat:enterprise_linux:7::workstation