Skip to content
OpenAdvisories
High ALAS2-2023-2047 3 CVEs

Important: tomcat security update (Amazon Linux 2)

Published May 11, 2023 · Updated May 16, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-13935: A flaw was found in Apache Tomcat, where the payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. The highest threat from this vulnerability is to system availability. CVE-2019-17563: When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability. CVE-2019-12418: A privilege escalation flaw was found in Tomcat when the JMX Remote Lifecycle Listener was enabled. A local attacker without access to the Tomcat process or configuration files could be able to manipulate the RMI registry to perform a man-in-the-middle attack. The attacker could then capture user names and passwords used to access the JMX interface and gain complete control over the Tomcat instance.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 tomcat 0:7.0.76-10.amzn2.0.4
Amazon Linux · 2 tomcat-admin-webapps 0:7.0.76-10.amzn2.0.4
Amazon Linux · 2 tomcat-docs-webapp 0:7.0.76-10.amzn2.0.4
Amazon Linux · 2 tomcat-el-2.2-api 0:7.0.76-10.amzn2.0.4
Amazon Linux · 2 tomcat-javadoc 0:7.0.76-10.amzn2.0.4
Amazon Linux · 2 tomcat-jsp-2.2-api 0:7.0.76-10.amzn2.0.4
Amazon Linux · 2 tomcat-jsvc 0:7.0.76-10.amzn2.0.4
Amazon Linux · 2 tomcat-lib 0:7.0.76-10.amzn2.0.4
Amazon Linux · 2 tomcat-servlet-3.0-api 0:7.0.76-10.amzn2.0.4
Amazon Linux · 2 tomcat-webapps 0:7.0.76-10.amzn2.0.4

Vulnerabilities 3

  • High 7.5
    CVE-2019-17563 EPSS 11%

    In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack

    When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical …

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  • High 7.5
    CVE-2020-13935 Public exploit EPSS 87%

    Infinite Loop in Apache Tomcat

    The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payl…

    org.apache.tomcat:tomcat tomcat9 tomcat8 tomcat9 Debian Ubuntu Maven
  • High 7.0
    CVE-2019-12418

    Insufficiently Protected Credentials in Apache Tomcat

    When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-12418.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-17563.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-13935.html