Skip to content
OpenAdvisories
Medium ALAS2-2023-2200 1 CVE

Moderate: tomcat security update (Amazon Linux 2)

Published Aug 3, 2023 · Updated Aug 8, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-0221: The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 tomcat 0:7.0.76-10.amzn2.0.5
Amazon Linux · 2 tomcat-admin-webapps 0:7.0.76-10.amzn2.0.5
Amazon Linux · 2 tomcat-docs-webapp 0:7.0.76-10.amzn2.0.5
Amazon Linux · 2 tomcat-el-2.2-api 0:7.0.76-10.amzn2.0.5
Amazon Linux · 2 tomcat-javadoc 0:7.0.76-10.amzn2.0.5
Amazon Linux · 2 tomcat-jsp-2.2-api 0:7.0.76-10.amzn2.0.5
Amazon Linux · 2 tomcat-jsvc 0:7.0.76-10.amzn2.0.5
Amazon Linux · 2 tomcat-lib 0:7.0.76-10.amzn2.0.5
Amazon Linux · 2 tomcat-servlet-3.0-api 0:7.0.76-10.amzn2.0.5
Amazon Linux · 2 tomcat-webapps 0:7.0.76-10.amzn2.0.5

Vulnerabilities 1

  • Medium 6.1
    CVE-2019-0221 Public exploit Scanner template EPSS 58%

    Cross-site scripting in Apache Tomcat

    The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and…

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-0221.html