tomcat security update

2017-07-2715:49:22

CentOS Project

lists.centos.org

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.009 Low

EPSS

Percentile

82.4%

JSON

CentOS Errata and Security Advisory CESA-2017:1809

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

A vulnerability was discovered in the error page mechanism in Tomcat’s DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664)
A vulnerability was discovered in Tomcat. When running an untrusted application under a SecurityManager it was possible, under some circumstances, for that application to retain references to the request or response objects and thereby access and/or modify information associated with another web application. (CVE-2017-5648)

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2017-July/084673.html

Affected packages:
tomcat
tomcat-admin-webapps
tomcat-docs-webapp
tomcat-el-2.2-api
tomcat-javadoc
tomcat-jsp-2.2-api
tomcat-jsvc
tomcat-lib
tomcat-servlet-3.0-api
tomcat-webapps

Upstream details at:
https://access.redhat.com/errata/RHSA-2017:1809

OSVersionArchitecturePackageVersionFilename
CentOS7noarchtomcat< 7.0.69-12.el7_3tomcat-7.0.69-12.el7_3.noarch.rpm
CentOS7noarchtomcat-admin-webapps< 7.0.69-12.el7_3tomcat-admin-webapps-7.0.69-12.el7_3.noarch.rpm
CentOS7noarchtomcat-docs-webapp< 7.0.69-12.el7_3tomcat-docs-webapp-7.0.69-12.el7_3.noarch.rpm
CentOS7noarchtomcat-el-2.2-api< 7.0.69-12.el7_3tomcat-el-2.2-api-7.0.69-12.el7_3.noarch.rpm
CentOS7noarchtomcat-javadoc< 7.0.69-12.el7_3tomcat-javadoc-7.0.69-12.el7_3.noarch.rpm
CentOS7noarchtomcat-jsp-2.2-api< 7.0.69-12.el7_3tomcat-jsp-2.2-api-7.0.69-12.el7_3.noarch.rpm
CentOS7noarchtomcat-jsvc< 7.0.69-12.el7_3tomcat-jsvc-7.0.69-12.el7_3.noarch.rpm
CentOS7noarchtomcat-lib< 7.0.69-12.el7_3tomcat-lib-7.0.69-12.el7_3.noarch.rpm
CentOS7noarchtomcat-servlet-3.0-api< 7.0.69-12.el7_3tomcat-servlet-3.0-api-7.0.69-12.el7_3.noarch.rpm
CentOS7noarchtomcat-webapps< 7.0.69-12.el7_3tomcat-webapps-7.0.69-12.el7_3.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	7	noarch	tomcat	< 7.0.69-12.el7_3	tomcat-7.0.69-12.el7_3.noarch.rpm
CentOS	7	noarch	tomcat-admin-webapps	< 7.0.69-12.el7_3	tomcat-admin-webapps-7.0.69-12.el7_3.noarch.rpm
CentOS	7	noarch	tomcat-docs-webapp	< 7.0.69-12.el7_3	tomcat-docs-webapp-7.0.69-12.el7_3.noarch.rpm
CentOS	7	noarch	tomcat-el-2.2-api	< 7.0.69-12.el7_3	tomcat-el-2.2-api-7.0.69-12.el7_3.noarch.rpm
CentOS	7	noarch	tomcat-javadoc	< 7.0.69-12.el7_3	tomcat-javadoc-7.0.69-12.el7_3.noarch.rpm
CentOS	7	noarch	tomcat-jsp-2.2-api	< 7.0.69-12.el7_3	tomcat-jsp-2.2-api-7.0.69-12.el7_3.noarch.rpm
CentOS	7	noarch	tomcat-jsvc	< 7.0.69-12.el7_3	tomcat-jsvc-7.0.69-12.el7_3.noarch.rpm
CentOS	7	noarch	tomcat-lib	< 7.0.69-12.el7_3	tomcat-lib-7.0.69-12.el7_3.noarch.rpm
CentOS	7	noarch	tomcat-servlet-3.0-api	< 7.0.69-12.el7_3	tomcat-servlet-3.0-api-7.0.69-12.el7_3.noarch.rpm
CentOS	7	noarch	tomcat-webapps	< 7.0.69-12.el7_3	tomcat-webapps-7.0.69-12.el7_3.noarch.rpm