Important: Red Hat Security Advisory: tomcat6 security and bug fix update

An update for tomcat6 is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

tomcat6 security and bug fix update

0:6.0.24-98 - Resolves: rhbz1362210 CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header - Resolves: rhbz1368119 0:6.0.24-97 - Resolves: rhbz1367051 CVE-2015-5174 URL Normalization issue - Resolves: rhbz1367054 CVE-2016-0706 Security Manager bypass via...

CVE-2016-1000106

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5388. Reason: This candidate is a duplicate of CVE-2016-5388. Notes: All CVE users should reference CVE-2016-5388 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2016-1000106

CVE-2016-1000106 is a duplicate of CVE-2016-5388; the connected records confirm CVE-2016-5388 is the httpoxy proxy-injection issue in Apache Tomcat CGI handling. Affected Tomcat versions require upgrading: Tomcat 6.x to at least 6.0.47, Tomcat 7.x to at least 7.0.72, and Tomcat 8.x to at least 8....

[ASA-201609-21] tomcat7: proxy injection

Arch Linux Security Advisory ASA-201609-21 ========================================== Severity: Medium Date : 2016-09-22 CVE-ID : CVE-2016-5388 Package : tomcat7 Type : proxy injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package tomcat7 before version...

MGASA-2016-0312 Updated tomcat packages fix security vulnerability

Apache Tomcat through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP...

openSUSE Security Update : tomcat (openSUSE-2016-1056) (httpoxy)

This update for tomcat fixes the following issues : - CVE-2016-3092: Usage of vulnerable FileUpload package can result in denial of service. bsc986359 - CVE-2016-5388: Setting HTTPPROXY environment variable via Proxy header. bsc988489 This update was imported from the SUSE:SLE-12-SP1:Update...

SUSE-SU-2016:2229-1 Security update for tomcat6

This update for tomcat6 fixes the following issue: - CVE-2016-5388 Setting HTTPPROXY environment variable via Proxy header bsc988489...

SUSE-SU-2016:2188-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2016-3092: Usage of vulnerable FileUpload package can result in denial of service. bsc986359 - CVE-2016-5388: Setting HTTPPROXY environment variable via Proxy header. bsc988489...

RHEL 6 : Red Hat JBoss Web Server 3.0.3 Service Pack 1 (RHSA-2016:1636) (httpoxy)

Updated packages that provide Red Hat JBoss Web Server 3.0.3 Service Pack 1 and fixes two security issues and a bug with ajp processors are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

RHEL 7 : Red Hat JBoss Web Server 3.0.3 Service Pack 1 (RHSA-2016:1635) (httpoxy)

Updated packages that provide Red Hat JBoss Web Server 3.0.3 Service Pack 1 and fixes two security issues and a bug with ajp processors are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 Service Pack 1 security update

Updated packages that provide Red Hat JBoss Web Server 3.0.3 Service Pack 1 and fixes two security issues and a bug with ajp processors are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 Service Pack 1 security update

Updated packages that provide Red Hat JBoss Web Server 3.0.3 Service Pack 1 and fixes two security issues and a bug with ajp processors are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 Service Pack 1 security update

Updated packages that provide Red Hat JBoss Web Server 3.0.3 Service Pack 1 and fixes two security issues and a bug with ajp processors are now available for Solaris, and Microsoft Windows from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of...

SOL51663510 - Apache Tomcat vulnerability CVE-2016-5388

Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...

CVE-2016-5388

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an...

Design/Logic Flaw

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an...

CVE-2016-5388

The CVE-2016-5388 issue affects Apache Tomcat (CGI Servlet enabled) where Proxy header handling exposes HTTP_PROXY data to CGI scripts, enabling redirection of outbound requests to a attacker-controlled proxy (httpoxy). Public advisories across multiple distributions confirm Tomcat 7.x up to 7.0....

CGI Namespace Conflict Man-In-The-Middle (httpoxy; CVE-2016-1000109; CVE-2016-1000110; CVE-2016-5385; CVE-2016-5386; CVE-2016-5387; CVE-2016-5388)

Namespace conflict related to HTTP proxy headers allows an attacker to configure the HTTPPROXY environment variable. A successful exploitation might allow an attacker to launch a man-in-the-middle attack and redirect traffic to an arbitrary host...

Gentoo Security Advisory GLSA 201412-01

Gentoo Linux Local Security Checks GLSA 201412-01 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...