Red Hat Security Advisory: Red Hat JBoss Web Server 3.1 Service Pack 9 security update
tomcat: deserialization flaw in session persistence storage leading to RCE
cpe:/a:redhat:jboss_enterprise_web_server:3.1::el6 cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7