You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa tomcat

Sigurnosni nedostaci programskog paketa tomcat

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LRH

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: tomcat security, bug fix, and enhancement update
Advisory ID: RHSA-2019:2205-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2019:2205
Issue date: 2019-08-06
CVE Names: CVE-2018-1304 CVE-2018-1305 CVE-2018-8014
CVE-2018-8034
=====================================================================

1. Summary:

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) – noarch
Red Hat Enterprise Linux Client Optional (v. 7) – noarch
Red Hat Enterprise Linux ComputeNode (v. 7) – noarch
Red Hat Enterprise Linux ComputeNode Optional (v. 7) – noarch
Red Hat Enterprise Linux Server (v. 7) – noarch
Red Hat Enterprise Linux Server Optional (v. 7) – noarch
Red Hat Enterprise Linux Workstation (v. 7) – noarch
Red Hat Enterprise Linux Workstation Optional (v. 7) – noarch

3. Description:

Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.

Security Fix(es):

* tomcat: Incorrect handling of empty string URL in security constraints
can lead to unintended exposure of resources (CVE-2018-1304)

* tomcat: Late application of security constraints can lead to resource
exposure for unauthorised users (CVE-2018-1305)

* tomcat: Insecure defaults in CORS filter enable ‘supportsCredentials’ for
all origins (CVE-2018-8014)

* tomcat: Host name verification missing in WebSocket client
(CVE-2018-8034)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.7 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1472950 – shutdown_wait option is not working for Tomcat
1548282 – CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
1548289 – CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
1579611 – CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable ‘supportsCredentials’ for all origins
1588703 – Backport of Negative maxCookieCount value causes exception for Tomcat
1607580 – CVE-2018-8034 tomcat: Host name verification missing in WebSocket client

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
tomcat-7.0.76-9.el7.src.rpm

noarch:
tomcat-servlet-3.0-api-7.0.76-9.el7.noarch.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

noarch:
tomcat-7.0.76-9.el7.noarch.rpm
tomcat-admin-webapps-7.0.76-9.el7.noarch.rpm
tomcat-docs-webapp-7.0.76-9.el7.noarch.rpm
tomcat-el-2.2-api-7.0.76-9.el7.noarch.rpm
tomcat-javadoc-7.0.76-9.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.76-9.el7.noarch.rpm
tomcat-jsvc-7.0.76-9.el7.noarch.rpm
tomcat-lib-7.0.76-9.el7.noarch.rpm
tomcat-webapps-7.0.76-9.el7.noarch.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
tomcat-7.0.76-9.el7.src.rpm

noarch:
tomcat-servlet-3.0-api-7.0.76-9.el7.noarch.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

noarch:
tomcat-7.0.76-9.el7.noarch.rpm
tomcat-admin-webapps-7.0.76-9.el7.noarch.rpm
tomcat-docs-webapp-7.0.76-9.el7.noarch.rpm
tomcat-el-2.2-api-7.0.76-9.el7.noarch.rpm
tomcat-javadoc-7.0.76-9.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.76-9.el7.noarch.rpm
tomcat-jsvc-7.0.76-9.el7.noarch.rpm
tomcat-lib-7.0.76-9.el7.noarch.rpm
tomcat-webapps-7.0.76-9.el7.noarch.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
tomcat-7.0.76-9.el7.src.rpm

noarch:
tomcat-7.0.76-9.el7.noarch.rpm
tomcat-admin-webapps-7.0.76-9.el7.noarch.rpm
tomcat-el-2.2-api-7.0.76-9.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.76-9.el7.noarch.rpm
tomcat-lib-7.0.76-9.el7.noarch.rpm
tomcat-servlet-3.0-api-7.0.76-9.el7.noarch.rpm
tomcat-webapps-7.0.76-9.el7.noarch.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

noarch:
tomcat-7.0.76-9.el7.noarch.rpm
tomcat-admin-webapps-7.0.76-9.el7.noarch.rpm
tomcat-docs-webapp-7.0.76-9.el7.noarch.rpm
tomcat-el-2.2-api-7.0.76-9.el7.noarch.rpm
tomcat-javadoc-7.0.76-9.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.76-9.el7.noarch.rpm
tomcat-jsvc-7.0.76-9.el7.noarch.rpm
tomcat-lib-7.0.76-9.el7.noarch.rpm
tomcat-webapps-7.0.76-9.el7.noarch.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
tomcat-7.0.76-9.el7.src.rpm

noarch:
tomcat-7.0.76-9.el7.noarch.rpm
tomcat-admin-webapps-7.0.76-9.el7.noarch.rpm
tomcat-el-2.2-api-7.0.76-9.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.76-9.el7.noarch.rpm
tomcat-lib-7.0.76-9.el7.noarch.rpm
tomcat-servlet-3.0-api-7.0.76-9.el7.noarch.rpm
tomcat-webapps-7.0.76-9.el7.noarch.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

noarch:
tomcat-docs-webapp-7.0.76-9.el7.noarch.rpm
tomcat-javadoc-7.0.76-9.el7.noarch.rpm
tomcat-jsvc-7.0.76-9.el7.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-1304
https://access.redhat.com/security/cve/CVE-2018-1305
https://access.redhat.com/security/cve/CVE-2018-8014
https://access.redhat.com/security/cve/CVE-2018-8034
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXUl3udzjgjWX9erEAQjEqQ//cb18QLOP8tG2mfUHh6oMly9c0rGaBj5K
oqF80bTSfIqAjQ7KYX7112PFYROJ74wMr9areVPNgPjMOF0zSXswL26EwDPIceUK
g2NMmRZcaoFFHUjcqNy6EybRYLW2jLzmUf0PgjEWBuC6ldBkC64RuQkg9ZcJh/8T
3/KKA0p+Mtd0dPuqLpa5tgRdRWowlc58EBBIiXFd6bwcWpdjrz5kkz2qG0b9Fu1V
FHph1Z5vVB70UMWrdgZ99z0G8rSjy3run4HgQia8VlIkHwNqJIYL+OGqCqvixWQK
lZWVRR786gQl/f/PqYgEGNBPTQNpLndLcPf2DQmQYRotANnhXnsV8PblyOxKOm/8
v48naAvbNDGT6WByoHOLSOlj2XKT7E6bzQgdqmyNSPjxDsidovSffXj9V0AMJMvf
eW/90vXKsZ83533t30IoSmCJi/BvBan9qNixDc9uqqmgKcCAHutb8q+D+HcUILfq
6C/EHPOlyHFZlzYGwGxB1fecjwIv51zklPjJ/M4R1P7FjL5gmiNmWOY7cNc15iEG
n8yORHE5axgsCZs6TXepcffLfQRq4cxQPFziHHpJcuXLPa3hzW23WPZUkqz89y/l
+zNP1N8wYKKRrT2/OblpS+6CxOxYcUtqSc/Uz50GGxreXgYu8L6EYz9kZk8qEtd6
dCDFxKTHa/E=
=IOQJ
—–END PGP SIGNATURE—–


RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

AutorJosip Papratovic
Cert idNCERT-REF-2019-08-0001-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
IzvorAdobe
Top
More in Preporuke
Sigurnosni nedostaci programske biblioteke libssh2

Otkriveni su sigurnosni nedostaci programske biblioteke libssh2 za operacijski sustav RHEL. Otkriveni nedostaci potencijalnim napadačima omogućuju izazivanje DoS stanja ili...

Close