Security Bulletin: Security vulnerability has been identified in Jazz Reporting Service shipped with Rational Reporting for Development Intelligence (CVE-2017-7674)

Summary Jazz Reporting Service is shipped as a component of Rational Reporting for Development Intelligence RRDI. Information about a security vulnerability affecting Jazz Reporting Service has been published in a security bulletin. Vulnerability Details CVEID: CVE-2017-7674 DESCRIPTION: Apache...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Algo One - Core (CVE-2017-7674, CVE-2017-7675)

Summary Apache Tomcat could provide weaker than expected security, caused by the failure to add an HTTP Vary header CVE-2017-7674. Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by a flaw in the HTTP/2 implementation CVE-2017-7675. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Algo One - Algo Risk Application (CVE-2017-7674, CVE-2017-7675)

Summary Apache Tomcat could provide weaker than expected security, caused by the failure to add an HTTP Vary header CVE-2017-7674. Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by a flaw in the HTTP/2 implementation CVE-2017-7675. Vulnerability Details CVEID:...

CVE-2018-7674

The NetIQ Identity Manager user console, in versions prior to 4.7, is susceptible to URL redirection...

CVE-2018-7674

The CVE concerns NetIQ Identity Manager’s user console vulnerability: URL redirection in versions before 4.7. Affected element is the user console; the underlying flaw enables redirection to external sites. The documents state the impact as the ability to direct users to other Web sites, with no ...

Ubuntu 14.04 LTS / 16.04 LTS : Tomcat vulnerabilities (USN-3519-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3519-1 advisory. It was discovered that Tomcat incorrectly handled certain pipelined requests when sendfile was used. A remote attacker could use this issue t...

Ubuntu: Security Advisory (USN-3519-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3519-1: Tomcat vulnerabilities

It was discovered that Tomcat incorrectly handled certain pipelined requests when sendfile was used. A remote attacker could use this issue to obtain wrong responses possibly containing sensitive information. CVE-2017-5647 It was discovered that Tomcat incorrectly used the appropriate facade...

Security update for tomcat (important)

This update for tomcat fixes the following issues: Security issues fixed: - CVE-2017-5664: A problem in handling error pages was fixed, to avoid potential file overwrites during error page handling. bsc1042910. - CVE-2017-7674: A CORS Filter issue could lead to client and server side cache...

openSUSE: Security Advisory for tomcat (openSUSE-SU-2017:3069-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CentOS 7 : tomcat (CESA-2017:3081)

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

tomcat security update

0:7.0.76-3 - Resolves: rhbz1498344 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws - Resolves: rhbz1495654 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning - Resolves: rhbz1470596 CVE-2017-5647 Add follow up revision...

Oracle Linux 7 : tomcat (ELSA-2017-3081)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3081 advisory. - Resolves: rhbz1498344 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws - Resolves: rhbz1495654 CVE-2017-7674 tomcat: Vary header not added by CORS...

RedHat Update for tomcat RHSA-2017:3081-01

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Debian DSA-3974-1 : tomcat8 - security update

Two issues were discovered in the Tomcat servlet and JSP engine. - CVE-2017-7674 Rick Riemer discovered that the Cross-Origin Resource Sharing filter did not add a Vary header indicating possible different responses, which could lead to cache poisoning. - CVE-2017-7675 stretch only Markus...

[SECURITY] [DSA 3974-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3974-1 [email protected] https://www.debian.org/security/ Sebastien Delafond September 15, 2017 https://www.debian.org/security/faq -...

Fedora 25 : 1:tomcat (2017-a00a087fd4)

This update includes a rebase from 8.0.44 up to 8.0.46 which resolves a single CVE along with various other bugs/features : - rh1480620 CVE-2017-7674 tomcat: Cache Poisoning Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Fedora 26 : 1:tomcat (2017-ab0def38cd)

This update includes a rebase from 8.0.44 up to 8.0.46 which resolves a single CVE along with various other bugs/features : - rh1480620 CVE-2017-7674 tomcat: Cache Poisoning Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

CVE-2017-7674

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

CVE-2017-7674

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...