[SECURITY] [DSA 4984-1] tomcat9 security update

2021-10-1420:33:21

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.004 Low

EPSS

Percentile

74.7%

JSON

Debian Security Advisory DSA-4984-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
October 14, 2021 https://www.debian.org/security/faq

Package : tomcat9
CVE ID : CVE-2021-30640 CVE-2021-41079

Two vulnerabilities were discovered in the Tomcat servlet and JSP engine,
which could result in denial of service.

For the oldstable distribution (buster), these problems have been fixed
in version 9.0.31-1~deb10u6.

For the stable distribution (bullseye), these problems have been fixed in
version 9.0.43-2~deb11u2.

We recommend that you upgrade your tomcat9 packages.

For the detailed security status of tomcat9 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tomcat9

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian9alltomcat8-common< 8.5.54-0+deb9u8tomcat8-common_8.5.54-0+deb9u8_all.deb
Debian11amd64flatpak< 1.10.5-0+deb11u1flatpak_1.10.5-0+deb11u1_amd64.deb
Debian11mips64elgir1.2-flatpak-1.0< 1.10.5-0+deb11u1gir1.2-flatpak-1.0_1.10.5-0+deb11u1_mips64el.deb
Debian11s390xlibflatpak0< 1.10.5-0+deb11u1libflatpak0_1.10.5-0+deb11u1_s390x.deb
Debian11alltomcat9< 9.0.43-2~deb11u2tomcat9_9.0.43-2~deb11u2_all.deb
Debian11arm64libflatpak-dev< 1.10.5-0+deb11u1libflatpak-dev_1.10.5-0+deb11u1_arm64.deb
Debian11ppc64elflatpak-tests-dbgsym< 1.10.5-0+deb11u1flatpak-tests-dbgsym_1.10.5-0+deb11u1_ppc64el.deb
Debian11amd64flatpak-tests< 1.10.5-0+deb11u1flatpak-tests_1.10.5-0+deb11u1_amd64.deb
Debian11armhfflatpak-tests-dbgsym< 1.10.5-0+deb11u1flatpak-tests-dbgsym_1.10.5-0+deb11u1_armhf.deb
Debian11ppc64ellibflatpak0-dbgsym< 1.10.5-0+deb11u1libflatpak0-dbgsym_1.10.5-0+deb11u1_ppc64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	all	tomcat8-common	< 8.5.54-0+deb9u8	tomcat8-common_8.5.54-0+deb9u8_all.deb
Debian	11	amd64	flatpak	< 1.10.5-0+deb11u1	flatpak_1.10.5-0+deb11u1_amd64.deb
Debian	11	mips64el	gir1.2-flatpak-1.0	< 1.10.5-0+deb11u1	gir1.2-flatpak-1.0_1.10.5-0+deb11u1_mips64el.deb
Debian	11	s390x	libflatpak0	< 1.10.5-0+deb11u1	libflatpak0_1.10.5-0+deb11u1_s390x.deb
Debian	11	all	tomcat9	< 9.0.43-2~deb11u2	tomcat9_9.0.43-2~deb11u2_all.deb
Debian	11	arm64	libflatpak-dev	< 1.10.5-0+deb11u1	libflatpak-dev_1.10.5-0+deb11u1_arm64.deb
Debian	11	ppc64el	flatpak-tests-dbgsym	< 1.10.5-0+deb11u1	flatpak-tests-dbgsym_1.10.5-0+deb11u1_ppc64el.deb
Debian	11	amd64	flatpak-tests	< 1.10.5-0+deb11u1	flatpak-tests_1.10.5-0+deb11u1_amd64.deb
Debian	11	armhf	flatpak-tests-dbgsym	< 1.10.5-0+deb11u1	flatpak-tests-dbgsym_1.10.5-0+deb11u1_armhf.deb
Debian	11	ppc64el	libflatpak0-dbgsym	< 1.10.5-0+deb11u1	libflatpak0-dbgsym_1.10.5-0+deb11u1_ppc64el.deb