Medium: tomcat7, tomcat8

Issue Overview:

1480618:
Vary header not added by CORS filter leading to cache poisoning

The CORS Filter in Apache Tomcat did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances. (CVE-2017-7674)

Affected Packages:

tomcat7, tomcat8

Issue Correction:
Run yum update tomcat7 to update your system.
Run yum update tomcat8 to update your system.

New Packages:

noarch:  
    tomcat7-7.0.81-1.29.amzn1.noarch  
    tomcat7-lib-7.0.81-1.29.amzn1.noarch  
    tomcat7-webapps-7.0.81-1.29.amzn1.noarch  
    tomcat7-javadoc-7.0.81-1.29.amzn1.noarch  
    tomcat7-servlet-3.0-api-7.0.81-1.29.amzn1.noarch  
    tomcat7-docs-webapp-7.0.81-1.29.amzn1.noarch  
    tomcat7-log4j-7.0.81-1.29.amzn1.noarch  
    tomcat7-el-2.2-api-7.0.81-1.29.amzn1.noarch  
    tomcat7-jsp-2.2-api-7.0.81-1.29.amzn1.noarch  
    tomcat7-admin-webapps-7.0.81-1.29.amzn1.noarch  
    tomcat8-servlet-3.1-api-8.0.46-1.76.amzn1.noarch  
    tomcat8-docs-webapp-8.0.46-1.76.amzn1.noarch  
    tomcat8-el-3.0-api-8.0.46-1.76.amzn1.noarch  
    tomcat8-log4j-8.0.46-1.76.amzn1.noarch  
    tomcat8-webapps-8.0.46-1.76.amzn1.noarch  
    tomcat8-8.0.46-1.76.amzn1.noarch  
    tomcat8-admin-webapps-8.0.46-1.76.amzn1.noarch  
    tomcat8-javadoc-8.0.46-1.76.amzn1.noarch  
    tomcat8-jsp-2.3-api-8.0.46-1.76.amzn1.noarch  
    tomcat8-lib-8.0.46-1.76.amzn1.noarch  
  
src:  
    tomcat7-7.0.81-1.29.amzn1.src  
    tomcat8-8.0.46-1.76.amzn1.src  

Additional References

Red Hat: CVE-2017-7674

Mitre: CVE-2017-7674