Lucene search

DebianDEBIAN:DLA-2217-1:0ED90

HistoryMay 23, 2020 - 5:27 p.m.

[SECURITY] [DLA 2217-1] tomcat7 security update

2020-05-2317:27:59

lists.debian.org

118

4.4 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.922 High

EPSS

Percentile

99.0%

JSON

Package : tomcat7
Version : 7.0.56-3+really7.0.100-1+deb8u1
CVE ID : CVE-2020-9484
Debian Bug : #961209

It was discovered that there was a potential remote code execution
via deserialization in tomcat7, a server for HTTP and Java "servlets".

For Debian 8 "Jessie", this issue has been fixed in tomcat7 version
7.0.56-3+really7.0.100-1+deb8u1.

We recommend that you upgrade your tomcat7 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian8alltomcat7-user< 7.0.56-3+really7.0.100-1+deb8u1tomcat7-user_7.0.56-3+really7.0.100-1+deb8u1_all.deb
Debian9alllibtomcat8-embed-java< 8.5.54-0+deb9u2libtomcat8-embed-java_8.5.54-0+deb9u2_all.deb
Debian8alltomcat7< 7.0.56-3+really7.0.100-1+deb8u1tomcat7_7.0.56-3+really7.0.100-1+deb8u1_all.deb
Debian10alltomcat9-docs< 9.0.31-1~deb10u2tomcat9-docs_9.0.31-1~deb10u2_all.deb
Debian9alltomcat8-examples< 8.5.54-0+deb9u2tomcat8-examples_8.5.54-0+deb9u2_all.deb
Debian10alltomcat9-user< 9.0.31-1~deb10u2tomcat9-user_9.0.31-1~deb10u2_all.deb
Debian8alltomcat7-docs< 7.0.56-3+really7.0.100-1+deb8u1tomcat7-docs_7.0.56-3+really7.0.100-1+deb8u1_all.deb
Debian8alllibservlet3.1-java-doc< 8.0.14-1+deb8u17libservlet3.1-java-doc_8.0.14-1+deb8u17_all.deb
Debian9alltomcat8-common< 8.5.54-0+deb9u2tomcat8-common_8.5.54-0+deb9u2_all.deb
Debian8alltomcat8-user< 8.0.14-1+deb8u17tomcat8-user_8.0.14-1+deb8u17_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	all	tomcat7-user	< 7.0.56-3+really7.0.100-1+deb8u1	tomcat7-user_7.0.56-3+really7.0.100-1+deb8u1_all.deb
Debian	9	all	libtomcat8-embed-java	< 8.5.54-0+deb9u2	libtomcat8-embed-java_8.5.54-0+deb9u2_all.deb
Debian	8	all	tomcat7	< 7.0.56-3+really7.0.100-1+deb8u1	tomcat7_7.0.56-3+really7.0.100-1+deb8u1_all.deb
Debian	10	all	tomcat9-docs	< 9.0.31-1~deb10u2	tomcat9-docs_9.0.31-1~deb10u2_all.deb
Debian	9	all	tomcat8-examples	< 8.5.54-0+deb9u2	tomcat8-examples_8.5.54-0+deb9u2_all.deb
Debian	10	all	tomcat9-user	< 9.0.31-1~deb10u2	tomcat9-user_9.0.31-1~deb10u2_all.deb
Debian	8	all	tomcat7-docs	< 7.0.56-3+really7.0.100-1+deb8u1	tomcat7-docs_7.0.56-3+really7.0.100-1+deb8u1_all.deb
Debian	8	all	libservlet3.1-java-doc	< 8.0.14-1+deb8u17	libservlet3.1-java-doc_8.0.14-1+deb8u17_all.deb
Debian	9	all	tomcat8-common	< 8.5.54-0+deb9u2	tomcat8-common_8.5.54-0+deb9u2_all.deb
Debian	8	all	tomcat8-user	< 8.0.14-1+deb8u17	tomcat8-user_8.0.14-1+deb8u17_all.deb