[SECURITY] [DLA 1276-1] tomcat-native security update

Package : tomcat-native
Version : 1.1.24-1+deb7u1
CVE ID : CVE-2017-15698

Jonas Klempel discovered that, when parsing the AIA-Extension field of
a client certificate, Apache Tomcat Native did not correctly handle
fields longer than 127 bytes. The result of the parsing error was to
skip the
OCSP check. It was therefore possible for client certificates that
should have been rejected (if the OCSP check had been made) to be
accepted. Users not using OCSP checks are not affected by this
vulnerability.

For Debian 7 "Wheezy", these problems have been fixed in version
1.1.24-1+deb7u1.

We recommend that you upgrade your tomcat-native packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS