Lucene search

K
amazonAmazonALAS-2020-1352
HistoryMar 09, 2020 - 7:20 p.m.

Important: tomcat7

2020-03-0919:20:00
alas.aws.amazon.com
73

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.974 High

EPSS

Percentile

99.9%

Issue Overview:

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. (CVE-2020-1935)

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. (CVE-2019-17569)

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations. (CVE-2020-1938)

As part of our fix for this CVE, we are disabling Tomcat 2019 AJP connector in the default configuration in alignment with the upstream changes. This change will require customers who use the default Tomcat configuration (in which the AJP connector was previously enabled) to explicitly re-enable the connector if they need it. Also take note that a connector configured without an explicit address will only bind to the loopback address.

Examples of output from netstat before and after updating tomcat8 and tomcat7 are below (note that it is the same on AL1 and AL2 with both tomcat7 and tomcat8).

AL1 tomcat7:
before:
tcp6 0 0 :::8009 :::* LISTEN 25772/java
tcp6 0 0 :::8080 :::* LISTEN 25772/java
tcp6 0 0 127.0.0.1:8005 :::* LISTEN 25772/java

After:
tcp6 0 0 :::8080 :::* LISTEN 25772/java
tcp6 0 0 127.0.0.1:8005 :::* LISTEN 25772/java

To re-enable the AJP port in Tomcat for AL1, users can uncomment the following line in /etc/tomcat{TOMCAT_VERSION}/server.xml and restart the service:
<!–
<Connector protocol=“AJP/1.3”
address=“::1”
port=“8009”
redirectPort=“8443” />
-->

See also:

Apache Tomcat release notes
Tomcat 7: http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100
Tomcat 8: http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51
Red Hat description & solutions: https://access.redhat.com/solutions/4851251

Affected Packages:

tomcat7

Issue Correction:
Run yum update tomcat7 to update your system.

New Packages:

noarch:  
    tomcat7-jsp-2.2-api-7.0.100-1.36.amzn1.noarch  
    tomcat7-admin-webapps-7.0.100-1.36.amzn1.noarch  
    tomcat7-javadoc-7.0.100-1.36.amzn1.noarch  
    tomcat7-webapps-7.0.100-1.36.amzn1.noarch  
    tomcat7-log4j-7.0.100-1.36.amzn1.noarch  
    tomcat7-docs-webapp-7.0.100-1.36.amzn1.noarch  
    tomcat7-servlet-3.0-api-7.0.100-1.36.amzn1.noarch  
    tomcat7-lib-7.0.100-1.36.amzn1.noarch  
    tomcat7-el-2.2-api-7.0.100-1.36.amzn1.noarch  
    tomcat7-7.0.100-1.36.amzn1.noarch  
  
src:  
    tomcat7-7.0.100-1.36.amzn1.src  

Additional References

Red Hat: CVE-2019-17569, CVE-2020-1935, CVE-2020-1938

Mitre: CVE-2019-17569, CVE-2020-1935, CVE-2020-1938

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.974 High

EPSS

Percentile

99.9%