Debian DSA-3843-1 : tomcat8 - security update

Two vulnerabilities were discovered in tomcat8, a servlet and JSP engine. - CVE-2017-5647 Pipelined requests were processed incorrectly, which could result in some responses appearing to be sent for the wrong request. - CVE-2017-5648 Some application listeners calls were issued against the wrong...

[SECURITY] [DSA 3843-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3843-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 03, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3843-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3843-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 03, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3842-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3842-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 03, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3842-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3842-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 03, 2017 https://www.debian.org/security/faq -...

Fedora Update for tomcat FEDORA-2017-d5aa7c77d6

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 924-1] tomcat7 security update

Package : tomcat7 Version : 7.0.28-4+deb7u12 CVE ID : CVE-2017-5647 CVE-2017-5648 Debian Bug : 860068 Two security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. CVE-2017-5647 A bug in the handling of the pipelined requests when send file was used resulted in the...

Fedora 24 : 1:tomcat (2017-d5aa7c77d6)

This updates includes a rebase from tomcat 8.0.42 up to 8.0.43 which resolves multiple CVEs : - rhbz1441242 CVE-2017-5647 CVE-2017-5648 CVE-2017-5650 CVE-2017-5651 tomcat: various flaws Note that Tenable Network Security has extracted the preceding description block directly from the Fedora updat...

MGASA-2017-0117 Updated tomcat packages fix security vulnerability

A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests...

Updated tomcat packages fix security vulnerability

A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests...

Amazon Linux AMI : tomcat7 / tomcat8 (ALAS-2017-822)

Incorrect handling of pipelined requests when send file was used A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost...

Apache Tomcat 'SecurityManager' Information Disclosure Vulnerability (Apr 2017) - Windows

Apache Tomcat is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"...

Important: tomcat7, tomcat8

Issue Overview: Incorrect handling of pipelined requests when send file was used A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined...

com.amazonaws:aws-dynamodb-session-tomcat (2.0.4), com.att.nsa:msgrtr (0.0.5) +80 more potentially affected by CVE-2017-5648 via org.apache.tomcat:tomcat-catalina (>=8.0.1, <=8.0.41)

org.apache.tomcat:tomcat-catalina MAVEN version =8.0.1, =2.2.0, =0.9.1-beta3, =0.9.1-beta3, =1.7, =1.8.2, =2.1, =1.2, =16, =16, =16.3.0 and more Source cves: CVE-2017-5648 Source advisory: MEND:CVE-2017-5648...

com.aol.microservices:micro-tomcat (>=0.83, <=0.91.11), com.aol.microservices:micro-tomcat-with-jersey (>=0.83, <=0.91.11) +9 more potentially affected by CVE-2017-5648 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.0.m17)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =0.83, =0.83, =0.1.0, =1.0.0, =1.0.0, =1.6-beta.2, =0.9.4, =9.0.0.m1, =9.0.0.m1, =9.0.0.m17 Source cves: CVE-2017-5648 Source advisory: MEND:CVE-2017-5648...

com.github.dblock.waffle:waffle-tomcat9 (1.8.1), com.github.waffle:waffle-tomcat9 (>=1.8.2, <=1.8.3) +13 more potentially affected by CVE-2017-5648 via org.apache.tomcat:tomcat-catalina (>=9.0.0.m1, <=9.0.0.m17)

org.apache.tomcat:tomcat-catalina MAVEN version =9.0.0.m1, =1.8.2, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =9.0.0.m1, =9.0.0.m1, =9.0.0.m1, =9.0.0.m1, =9.0.0.m17 Source cves: CVE-2017-5648 Source advisory: MEND:CVE-2017-5648...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.27) +277 more potentially affected by CVE-2017-5648 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.75)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 - com.definesys.mpaas:query-weblogic 1.0.0 and more Source cves: CVE-2017-5648 Source advisory: MEND:CVE-2017-5648...

CVE-2017-5648

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was...

am.ik.home:uaa-server (>=1.0.0, <=1.9.0), au.com.cybernostics:theme-tree (0.9.0) +970 more potentially affected by CVE-2017-5648 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.12)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =1.0.0, =1, =1, =1, =1, =1, =0.1.0, =1.0.0-rc, =0.2.1, =0.1.1, =0.1.1, =0.0.26, =0.9.6 and more Source cves: CVE-2017-5648 Source advisory: MEND:CVE-2017-5648...

com.cloudera.oryx:oryx-lambda-serving (2.3.0), com.collaborne.operations:tomcat-remoteip-aws-valve (>=1.0.0, <=1.1.5) +53 more potentially affected by CVE-2017-5648 via org.apache.tomcat:tomcat-catalina (>=8.5.0, <=8.5.12)

org.apache.tomcat:tomcat-catalina MAVEN version =8.5.0, =1.0.0, =1.0.4, =1.8.2, =2.1, =1.9.5, =1.2.0, =0.5.0, =0.0.3, =0.0.5 and more Source cves: CVE-2017-5648 Source advisory: MEND:CVE-2017-5648...