==========================================================================
Ubuntu Security Notice USN-4251-1
January 27, 2020

tomcat8 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Tomcat.

Software Description:
– tomcat8: Servlet and JSP engine

Details:

It was discovered that Tomcat incorrectly handled the RMI registry when
configured with the JMX Remote Lifecycle Listener. A local attacker could
possibly use this issue to obtain credentials and gain complete control
over the Tomcat instance. (CVE-2019-12418)

It was discovered that Tomcat incorrectly handled FORM authentication. A
remote attacker could possibly use this issue to perform a session fixation
attack. (CVE-2019-17563)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
libtomcat8-java 8.0.32-1ubuntu1.11
tomcat8 8.0.32-1ubuntu1.11

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4251-1
CVE-2019-12418, CVE-2019-17563

Package Information:
https://launchpad.net/ubuntu/+source/tomcat8/8.0.32-1ubuntu1.11

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl4vDiEACgkQZWnYVadE
vpPbiw/8CqfVrKihzOV3NyJ0x+Af0BIHkrWpbHAcwWe2nZdQzAqqXXlPSgKZiB28
/41FHb/btwtOEXbzAZMIrJFkCyEi9em9EsWNSxrcUMLZX3W9Z/owdmybUwMUovXz
hRhJvEoxycTdLL/k9p0BqIQWXFQS8rGzdG00o6S3fJkgfYS4OaCjRDMVefT5y8Or
wAt/8414FIzKJZ6VtrhLM3/GFSURlOEh/mbVCNCHa5GCONT9smJfxXkaaUC9A/sM
t8L2OxPYUeKSsJwc6E6dM/+I5PsE3uOCRQ++c24MeiP3kRZKGJASDd/mHpZnZFFf
kBwcGRxGVtvIfhZtPg+hJkrU3JjxIfrO67PcjbNrAjSRff7l5FxKfV/yA+DAf00D
deFUtwJ4CVOLezPgwsmxM7N3qmLQvxbVNt5icqSLa5JpCRrIcCRAhOYg+gLZ4t5U
3x7tGCcvPTERDial6FbWpIR9ivPC5cXYg+Y3uQ2lChVFDydwpzapULsKzsNY3t7h
LFJGCTMMaqUdSEGzSXqEakq/Nn0NQyFYQ9po524yh4flB5qDFfrkKX6UpBhl7gJ8
bNk0+ZXIwTHuO3mW6XN+mF3PkkX5/njdJWsKBsVYRR8hc1sZDt+CiANnEzYW2DS/
6GwyxtMr68cGMfhXmZcfI9z49SqmUF+AY7C8CSDyuFx+Vp9z+qw=
=qzOd
—–END PGP SIGNATURE—–
—