Important: tomcat

Issue Overview:

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88. (CVE-2018-8034)

The URL pattern of “” (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected. (CVE-2018-1304)

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them. (CVE-2018-1305)

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable ‘supportsCredentials’ for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. (CVE-2018-8014)

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations. (CVE-2020-1938)

As part of our fix for this CVE, we are disabling Tomcat 2019 AJP connector in the default configuration in alignment with the upstream changes. This change will require customers who use the default Tomcat configuration (in which the AJP connector was previously enabled) to explicitly re-enable the connector if they need it. Also take note that a connector configured without an explicit address will only bind to the loopback address.

Examples of output from netstat before and after updating tomcat8 and tomcat7 are below (note that it is the same on AL1 and AL2 with both tomcat7 and tomcat8).

AL2 tomcat8.5:
before:
tcp6 0 0 :::8009 :::* LISTEN 25772/java
tcp6 0 0 :::8080 :::* LISTEN 25772/java
tcp6 0 0 127.0.0.1:8005 :::* LISTEN 25772/java

After:
tcp6 0 0 :::8080 :::* LISTEN 25772/java
tcp6 0 0 127.0.0.1:8005 :::* LISTEN 25772/java

To re-enable the AJP port in Tomcat, users can follow the steps below:

1. For AL2 Core (tomcat7): Uncomment the following line in /etc/tomcat/server.xml and restart the service
   <!–
   <Connector port=“8009” protocol=“AJP/1.3” redirectPort=“8443” />
   -->
2. For AL2 Tomcat8.5 extra: Uncomment the following line in /etc/tomcat/server.xml and restart the service

<!–
<Connector protocol=“AJP/1.3”
address=“::1”
port=“8009”
redirectPort=“8443” />
-->

See also:

Apache Tomcat release notes
Tomcat 7: http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100
Tomcat 8: http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51

Affected Packages:

tomcat

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update tomcat to update your system.

New Packages:

noarch:  
    tomcat-7.0.76-10.amzn2.0.1.noarch  
    tomcat-admin-webapps-7.0.76-10.amzn2.0.1.noarch  
    tomcat-docs-webapp-7.0.76-10.amzn2.0.1.noarch  
    tomcat-javadoc-7.0.76-10.amzn2.0.1.noarch  
    tomcat-jsvc-7.0.76-10.amzn2.0.1.noarch  
    tomcat-jsp-2.2-api-7.0.76-10.amzn2.0.1.noarch  
    tomcat-lib-7.0.76-10.amzn2.0.1.noarch  
    tomcat-servlet-3.0-api-7.0.76-10.amzn2.0.1.noarch  
    tomcat-el-2.2-api-7.0.76-10.amzn2.0.1.noarch  
    tomcat-webapps-7.0.76-10.amzn2.0.1.noarch  
  
src:  
    tomcat-7.0.76-10.amzn2.0.1.src  

Additional References

Red Hat: CVE-2018-1304, CVE-2018-1305, CVE-2018-8014, CVE-2018-8034, CVE-2020-1938

Mitre: CVE-2018-1304, CVE-2018-1305, CVE-2018-8014, CVE-2018-8034, CVE-2020-1938