Ubuntu Security Notice USN-4128-1
September 10, 2019

tomcat8 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Tomcat 8.

Software Description:
– tomcat8: Servlet and JSP engine

Details:

It was discovered that the Tomcat 8 SSI printenv command echoed user
provided data without escaping it. An attacker could possibly use this
issue to perform an XSS attack. (CVE-2019-0221)

It was discovered that Tomcat 8 did not address HTTP/2 connection window
exhaustion on write while addressing CVE-2019-0199. An attacker could
possibly use this issue to cause a denial of service. (CVE-2019-10072)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
libtomcat8-java 8.5.39-1ubuntu1~18.04.3
tomcat8 8.5.39-1ubuntu1~18.04.3

Ubuntu 16.04 LTS:
libtomcat8-java 8.0.32-1ubuntu1.10
tomcat8 8.0.32-1ubuntu1.10

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4128-1
CVE-2019-0221, CVE-2019-10072

Package Information:
https://launchpad.net/ubuntu/+source/tomcat8/8.5.39-1ubuntu1~18.04.3
https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.10

—–BEGIN PGP SIGNATURE—–

iQGzBAEBCgAdFiEEyHJjgXFrw9J7hoV1y48W+9OmT4IFAl13+fIACgkQy48W+9Om
T4KHKAv+KmIF7coPqMmKKiy/U7mT9B5Nl4iGqyMV+z8tKhIk/bxve0SvbNACz4yF
XPnRMt68Z3sE4mU2ciQjARosMUjq7G8DgSAWotDH05vtUUPQ8puaXvUAwwf6xv6S
m14fQI5dXVdGcQW9aA1332v8dlnEebuYiTfiD64gA4xk/v6ErRcBZdJsiPodclXx
SNkWLeGzjnuwJeNwL4QXfMOTYlaoimTa/ozolBJXKO9N9I/pwy9TRboLAiSmm2wZ
Jq9k/ixwBZhxHWnOJAwl7pYQCJFdQY4K61KD4W3ReH9SD/YELRI064B2gAnShng3
+rUqTZsTgalLgULqAstTCGbpmJSa/LR6NjaCOwiNJl4BRvek3pQbz7gE4ptSgL9R
xQlvSRG1AZ/CmrXFOi/D842UTiNa3xgtAOCDJSu1JEqH/yizTkP19XJtyPbHaW+j
YGYwixNEPY6vduCK8J419hwmKC/mpy5ZmIgiIFtMeRudFZITUrzgP/psmMLidY8x
TDjmoH0q
=cEqZ
—–END PGP SIGNATURE—–
—