CVE:CVE-2013-4590
CNNVD:CNNVD-201402-401
Apache Tomcat是美国阿帕奇（Apache）软件基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。
Apache Tomcat中存在XML外部实体信息泄露漏洞，该漏洞源于当解析XML数据时，程序没有正确配置XML解析器。攻击者可借助特制的XML文档（如web.xml，context.xml，*.tld，*.tagx，*.jspx）利用该漏洞获取内部信息。以下版本受到影响：Apache Tomcat 6.0.37及之前的版本，7.0.47之前的7.x版本，8.0.0-RC3之前的8.x版本。
solution:Upgrade apache tomcat to a higher version than 8.0.0:rc1,8.0.0:rc2,8.0.0:rc3,8.0.0:rc4,8.0.0:rc5,8.0.0:rc6,8.0.0:rc7,8.0.0:rc8,8.0.0:rc9,6.0.37,1.1.3,3.0,3.1,3.1.1,3.2,3.2.1,3.2.2,3.2.2:beta2,3.2.3,3.2.4,3.3,3.3.1,3.3.1a,3.3.2,4,4.0.0,4.0.1,4.0.2,4.0.3,4.0.4,4.0.5,4.0.6,4.1.0,4.1.1,4.1.2,4.1.3,4.1.3:beta,4.1.9:beta,4.1.10,4.1.12,4.1.15,4.1.24,4.1.28,4.1.29,4.1.31,4.1.36,5,5.0.0,5.0.1,5.0.2,5.0.3,5.0.4,5.0.5,5.0.6,5.0.7,5.0.8,5.0.9,5.0.10,5.0.11,5.0.12,5.0.13,5.0.14,5.0.15,5.0.16,5.0.17,5.0.18,5.0.19,5.0.21,5.0.22,5.0.23,5.0.24,5.0.25,5.0.26,5.0.27,5.0.28,5.0.29,5.0.30,5.5.0,5.5.1,5.5.2,5.5.3,5.5.4,5.5.5,5.5.6,5.5.7,5.5.8,5.5.9,5.5.10,5.5.11,5.5.12,5.5.13,5.5.14,5.5.15,5.5.16,5.5.17,5.5.18,5.5.19,5.5.20,5.5.21,5.5.22,5.5.23,5.5.24,5.5.25,5.5.26,5.5.27,5.5.28,5.5.29,5.5.30,5.5.31,5.5.32,5.5.33,5.5.34,5.5.35,6,6.0,6.0.0,6.0.0:alpha,6.0.1,6.0.1:alpha,6.0.2,6.0.2:alpha,6.0.2:beta,6.0.3,6.0.10,6.0.11,6.0.12,6.0.13,6.0.14,6.0.15,6.0.16,6.0.17,6.0.18,6.0.19,6.0.20,6.0.24,6.0.26,6.0.27,6.0.28,6.0.29,6.0.30,6.0.31,6.0.32,6.0.33,6.0.35,6.0.36,7.0.0,7.0.0:beta,7.0.1,7.0.2,7.0.2:beta,7.0.3,7.0.4,7.0.4:beta,7.0.10,7.0.11,7.0.12,7.0.13,7.0.14,7.0.15,7.0.16,7.0.17,7.0.18,7.0.19,7.0.20,7.0.21,7.0.22,7.0.23,7.0.24,7.0.25,7.0.26,7.0.27,7.0.28,7.0.29,7.0.30,7.0.31,7.0.32,7.0.33,7.0.34,7.0.35,7.0.36,7.0.37,7.0.38,7.0.39,7.0.40,7.0.41,7.0.42,7.0.43,7.0.44,7.0.45,7.0.46,7.0.50,and avoid the version 8.0.0:rc1,8.0.0:rc2,8.0.0:rc3,8.0.0:rc4,8.0.0:rc5,8.0.0:rc6,8.0.0:rc7,8.0.0:rc8,8.0.0:rc9,(,6.0.37],1.1.3,3.0,3.1,3.1.1,3.2,3.2.1,3.2.2,3.2.2:beta2,3.2.3,3.2.4,3.3,3.3.1,3.3.1a,3.3.2,4,4.0.0,4.0.1,4.0.2,4.0.3,4.0.4,4.0.5,4.0.6,4.1.0,4.1.1,4.1.2,4.1.3,4.1.3:beta,4.1.9:beta,4.1.10,4.1.12,4.1.15,4.1.24,4.1.28,4.1.29,4.1.31,4.1.36,5,5.0.0,5.0.1,5.0.2,5.0.3,5.0.4,5.0.5,5.0.6,5.0.7,5.0.8,5.0.9,5.0.10,5.0.11,5.0.12,5.0.13,5.0.14,5.0.15,5.0.16,5.0.17,5.0.18,5.0.19,5.0.21,5.0.22,5.0.23,5.0.24,5.0.25,5.0.26,5.0.27,5.0.28,5.0.29,5.0.30,5.5.0,5.5.1,5.5.2,5.5.3,5.5.4,5.5.5,5.5.6,5.5.7,5.5.8,5.5.9,5.5.10,5.5.11,5.5.12,5.5.13,5.5.14,5.5.15,5.5.16,5.5.17,5.5.18,5.5.19,5.5.20,5.5.21,5.5.22,5.5.23,5.5.24,5.5.25,5.5.26,5.5.27,5.5.28,5.5.29,5.5.30,5.5.31,5.5.32,5.5.33,5.5.34,5.5.35,6,6.0,6.0.0,6.0.0:alpha,6.0.1,6.0.1:alpha,6.0.2,6.0.2:alpha,6.0.2:beta,6.0.3,6.0.10,6.0.11,6.0.12,6.0.13,6.0.14,6.0.15,6.0.16,6.0.17,6.0.18,6.0.19,6.0.20,6.0.24,6.0.26,6.0.27,6.0.28,6.0.29,6.0.30,6.0.31,6.0.32,6.0.33,6.0.35,6.0.36,7.0.0,7.0.0:beta,7.0.1,7.0.2,7.0.2:beta,7.0.3,7.0.4,7.0.4:beta,7.0.10,7.0.11,7.0.12,7.0.13,7.0.14,7.0.15,7.0.16,7.0.17,7.0.18,7.0.19,7.0.20,7.0.21,7.0.22,7.0.23,7.0.24,7.0.25,7.0.26,7.0.27,7.0.28,7.0.29,7.0.30,7.0.31,7.0.32,7.0.33,7.0.34,7.0.35,7.0.36,7.0.37,7.0.38,7.0.39,7.0.40,7.0.41,7.0.42,7.0.43,7.0.44,7.0.45,7.0.46,7.0.50; Upgrade debian debian_linux to a higher version than 7.0,and avoid the version 7.0; Upgrade oracle solaris to a higher version than 11.2,and avoid the version 11.2