USN-3557-1 squid3 vulnerabilities

Mathias Fischer discovered that Squid incorrectly handled certain long strings in headers. A malicious remote server could possibly cause Squid to crash, resulting in a denial of service. This issue was only addressed in Ubuntu 16.04 LTS. CVE-2016-2569 William Lima discovered that Squid incorrect...

Exploit for Improper Input Validation in Squid-Cache Squid

Hello there, Thank you for reading my first blog entry. Today w...

RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 6 (Important) (RHSA-2018:0002)

"The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0002 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Re...

resteasy: Vary header not added by CORS filter leading to cache poisoning

It was discovered that the CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

Important: Red Hat Security Advisory: eap7-jboss-ec2-eap security update

An update for eap7-jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 7.0 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Application Platform 7.0 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact o...

resteasy: Vary header not added by CORS filter leading to cache poisoning

It was discovered that the CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 6

An update is now available for Red Hat JBoss Enterprise Application Platform 7.0 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

resteasy: Vary header not added by CORS filter leading to cache poisoning

It was discovered that the CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

resteasy: Vary header not added by CORS filter leading to cache poisoning

It was discovered that the CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

Scientific Linux Security Update : tomcat on SL7.x (noarch) (20171030)

Security Fixes : - A vulnerability was discovered in Tomcat's handling of pipelined requests when 'Sendfile' was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information...

tomcat: Vary header not added by CORS filter leading to cache poisoning

A vulnerability was discovered in Tomcat where the CORS Filter did not send a "Vary: Origin" HTTP header. This potentially allowed sensitive data to be leaked to other visitors through both client-side and server-side caches...

tomcat security update

0:7.0.76-3 - Resolves: rhbz1498344 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws - Resolves: rhbz1495654 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning - Resolves: rhbz1470596 CVE-2017-5647 Add follow up revision...

Medium: tomcat7, tomcat8

Issue Overview: 1480618: Vary header not added by CORS filter leading to cache poisoning The CORS Filter in Apache Tomcat did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

Debian DSA-3974-1 : tomcat8 - security update

Two issues were discovered in the Tomcat servlet and JSP engine. - CVE-2017-7674 Rick Riemer discovered that the Cross-Origin Resource Sharing filter did not add a Vary header indicating possible different responses, which could lead to cache poisoning. - CVE-2017-7675 stretch only Markus...

[SECURITY] [DSA 3974-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3974-1 [email protected] https://www.debian.org/security/ Sebastien Delafond September 15, 2017 https://www.debian.org/security/faq -...

Apache Tomcat 7.0.41 < 7.0.79

The version of Tomcat installed on the remote host is prior to 7.0.79. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.79security-7 advisory. - The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0....

Amazon Linux AMI : tomcat7 (ALAS-2017-873)

Security constrained bypass in error page mechanism : While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an...

Cache Poisoning

tomcat-catalina is vulnerable to cache poisoning. The library does not add HTTP VARY: Origin headers to it's responses, causing inaccurate caching when re-used across-origins...

Design/Logic Flaw

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...

CVE-2017-7674

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances...