Skip to content
OpenAdvisories
High ALAS2-2018-1105 1 CVE

Important: tomcat security update (Amazon Linux 2)

Published Nov 7, 2018 · Updated Nov 8, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86. 1607591: CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 tomcat 0:7.0.76-8.amzn2
Amazon Linux · 2 tomcat-admin-webapps 0:7.0.76-8.amzn2
Amazon Linux · 2 tomcat-docs-webapp 0:7.0.76-8.amzn2
Amazon Linux · 2 tomcat-el-2.2-api 0:7.0.76-8.amzn2
Amazon Linux · 2 tomcat-javadoc 0:7.0.76-8.amzn2
Amazon Linux · 2 tomcat-jsp-2.2-api 0:7.0.76-8.amzn2
Amazon Linux · 2 tomcat-jsvc 0:7.0.76-8.amzn2
Amazon Linux · 2 tomcat-lib 0:7.0.76-8.amzn2
Amazon Linux · 2 tomcat-servlet-3.0-api 0:7.0.76-8.amzn2
Amazon Linux · 2 tomcat-webapps 0:7.0.76-8.amzn2

Vulnerabilities 1

  • High 7.5
    CVE-2018-1336 EPSS 20%

    In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder

    An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-1336.html