openSUSE Security Advisory (SUSE-SU-2025:0033-1)

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.856898");
  script_cve_id("CVE-2024-50379", "CVE-2024-52317", "CVE-2024-54677", "CVE-2024-56337");
  script_tag(name:"creation_date", value:"2025-01-09 05:00:04 +0000 (Thu, 09 Jan 2025)");
  script_version("2025-08-15T15:42:26+0000");
  script_tag(name:"last_modification", value:"2025-08-15 15:42:26 +0000 (Fri, 15 Aug 2025)");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");

  script_name("openSUSE Security Advisory (SUSE-SU-2025:0033-1)");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("openSUSE Local Security Checks");
  script_dependencies("gather-package-list.nasl");
  script_mandatory_keys("ssh/login/opensuse", "ssh/login/rpms", re:"ssh/login/release=openSUSELeap15\.6");

  script_xref(name:"Advisory-ID", value:"SUSE-SU-2025:0033-1");
  script_xref(name:"URL", value:"https://www.suse.com/support/update/announcement/2025/suse-su-20250033-1.html");
  script_xref(name:"URL", value:"https://bugzilla.suse.com/1233435");
  script_xref(name:"URL", value:"https://bugzilla.suse.com/1234663");
  script_xref(name:"URL", value:"https://bugzilla.suse.com/1234664");
  script_xref(name:"URL", value:"https://bugzilla.suse.com/1236809");
  script_xref(name:"URL", value:"https://lists.suse.com/pipermail/sle-security-updates/2025-January/020069.html");

  script_tag(name:"summary", value:"The remote host is missing an update for the 'tomcat10' package(s) announced via the SUSE-SU-2025:0033-1 advisory.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");

  script_tag(name:"insight", value:"This update for tomcat10 fixes the following issues:

Update to Tomcat 10.1.34

- Fixed CVEs:
 + CVE-2024-54677: DoS in examples web application (bsc#1234664)
 + CVE-2024-50379: RCE due to TOCTOU issue in JSP compilation (bsc#1234663)
 + CVE-2024-52317: Request/response mix-up with HTTP/2 (bsc#1233435)
 + CVE-2024-56337: RCE due to TOCTOU issue in JSP compilation - mitigation was incomplete
- Catalina
 + Add: Add option to serve resources from subpath only with WebDAV Servlet
 like with DefaultServlet. (michaelo)
 + Fix: Add special handling for the protocols attribute of SSLHostConfig in
 storeconfig. (remm)
 + Fix: 69442: Fix case sensitive check on content-type when parsing request
 parameters. (remm)
 + Code: Refactor duplicate code for extracting media type and subtype from
 content-type into a single method. (markt)
 + Fix: Compatibility of generated embedded code with components where
 constructors or property related methods throw a checked exception. (remm)
 + Fix: The previous fix for inconsistent resource metadata during concurrent
 reads and writes was incomplete. (markt)
 + Fix: #780: Fix content-range header length. Submitted by Chenjp. (remm)
 + Fix: 69444: Ensure that the jakarta.servlet.error.message request
 attribute is set when an application defined error page is called. (markt)
 + Fix: Avoid quotes for numeric values in the JSON generated by the status
 servlet. (remm)
 + Add: Add strong ETag support for the WebDAV and default servlet, which can
 be enabled by using the useStrongETags init parameter with a value set to
 true. The ETag generated will be a SHA-1 checksum of the resource content.
 (remm)
 + Fix: Use client locale for directory listings. (remm)
 + Fix: 69439: Improve the handling of multiple Cache-Control headers in the
 ExpiresFilter. Based on pull request #777 by Chenjp. (markt)
 + Fix: 69447: Update the support for caching classes the web application
 class loader cannot find to take account of classes loaded from external
 repositories. Prior to this fix, these classes could be incorrectly marked
 as not found. (markt)
 + Fix: 69466: Rework handling of HEAD requests. Headers explicitly set by
 users will not be removed and any header present in a HEAD request will
 also be present in the equivalent GET request. There may be some headers,
 as per RFC 9110, section 9.3.2, that are present in a GET request that are
 not present in the equivalent HEAD request. (markt)
 + Fix: 69471: Log instances of CloseNowException caught by
 ApplicationDispatcher.invoke() at debug level rather than error level as
 they are very likely to have been caused by a client disconnection or
 similar I/O issue. (markt)
 + Add: Add a test case for the fix for 69442. Also refactor references to
 application/x-www-form-urlencoded. Based on pull request #779 by Chenjp.
 (markt)
 + Fix: 69476: Catch possible ISE when trying to report PUT failure in the
 ... [Please see the references for more information on the vulnerabilities]");

  script_tag(name:"affected", value:"'tomcat10' package(s) on openSUSE Leap 15.6.");

  script_tag(name:"solution", value:"Please install the updated package(s).");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"package");

  exit(0);
}

include("revisions-lib.inc");
include("pkg-lib-rpm.inc");

release = rpm_get_ssh_release();
if(!release)
  exit(0);

res = "";
report = "";

if(release == "openSUSELeap15.6") {

  if(!isnull(res = isrpmvuln(pkg:"tomcat10", rpm:"tomcat10~10.1.34~150200.5.31.1", rls:"openSUSELeap15.6"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"tomcat10-admin-webapps", rpm:"tomcat10-admin-webapps~10.1.34~150200.5.31.1", rls:"openSUSELeap15.6"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"tomcat10-doc", rpm:"tomcat10-doc~10.1.34~150200.5.31.1", rls:"openSUSELeap15.6"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"tomcat10-docs-webapp", rpm:"tomcat10-docs-webapp~10.1.34~150200.5.31.1", rls:"openSUSELeap15.6"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"tomcat10-el-5_0-api", rpm:"tomcat10-el-5_0-api~10.1.34~150200.5.31.1", rls:"openSUSELeap15.6"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"tomcat10-embed", rpm:"tomcat10-embed~10.1.34~150200.5.31.1", rls:"openSUSELeap15.6"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"tomcat10-jsp-3_1-api", rpm:"tomcat10-jsp-3_1-api~10.1.34~150200.5.31.1", rls:"openSUSELeap15.6"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"tomcat10-jsvc", rpm:"tomcat10-jsvc~10.1.34~150200.5.31.1", rls:"openSUSELeap15.6"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"tomcat10-lib", rpm:"tomcat10-lib~10.1.34~150200.5.31.1", rls:"openSUSELeap15.6"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"tomcat10-servlet-6_0-api", rpm:"tomcat10-servlet-6_0-api~10.1.34~150200.5.31.1", rls:"openSUSELeap15.6"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"tomcat10-webapps", rpm:"tomcat10-webapps~10.1.34~150200.5.31.1", rls:"openSUSELeap15.6"))) {
    report += res;
  }

  if(report != "") {
    security_message(data:report);
  } else if(__pkg_match) {
    exit(99);
  }
  exit(0);
}

exit(0);