Summary
The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-core module by AlmaLinux Certificate System.
Security Fix(es):
* tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up (CVE-2018-8037)
* tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)
* tomcat: Open redirect in default servlet (CVE-2018-11784)
* tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 50
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | apache-commons-collections | 3.2.2-10.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | apache-commons-collections | 3.2.2-10.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | apache-commons-lang | 2.6-21.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | apache-commons-lang | 2.6-21.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | bea-stax-api | 1.2.0-16.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | bea-stax-api | 1.2.0-16.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | glassfish-fastinfoset | 1.2.13-9.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | glassfish-fastinfoset | 1.2.13-9.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | glassfish-jaxb-api | 2.2.12-8.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | glassfish-jaxb-api | 2.2.12-8.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | glassfish-jaxb-core | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | glassfish-jaxb-core | 2.2.11-11.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | glassfish-jaxb-runtime | 2.2.11-11.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | glassfish-jaxb-runtime | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | glassfish-jaxb-txw2 | 2.2.11-11.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | glassfish-jaxb-txw2 | 2.2.11-11.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | jackson-module-jaxb-annotations | 2.7.6-4.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | jackson-module-jaxb-annotations | 2.7.6-4.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | jakarta-commons-httpclient | 1:3.1-28.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | jakarta-commons-httpclient | 1:3.1-28.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | javassist | 3.18.1-8.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | javassist | 3.18.1-8.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | javassist-javadoc | 3.18.1-8.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | javassist-javadoc | 3.18.1-8.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | python-nss-doc | 1.0.1-10.module_el8.5.0+150+5f0dbea0.alma |
| AlmaLinux · 8 | python-nss-doc | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma |
| AlmaLinux · 8 | python3-nss | 1.0.1-10.module_el8.5.0+150+5f0dbea0.alma |
| AlmaLinux · 8 | python3-nss | 1.0.1-10.module_el8.5.0+2577+9e95fe00.alma |
| AlmaLinux · 8 | relaxngDatatype | 2011.1-7.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | relaxngDatatype | 2011.1-7.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | slf4j | 1.7.25-4.module_el8.6.0+2752+f1f3449e |
| AlmaLinux · 8 | slf4j | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | slf4j-jdk14 | 1.7.25-4.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | slf4j-jdk14 | 1.7.25-4.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | stax-ex | 1.7.7-8.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | stax-ex | 1.7.7-8.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | velocity | 1.7-24.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | velocity | 1.7-24.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | xalan-j2 | 2.7.1-38.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | xalan-j2 | 2.7.1-38.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | xerces-j2 | 2.11.0-34.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | xerces-j2 | 2.11.0-34.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | xml-commons-apis | 1.4.01-25.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | xml-commons-apis | 1.4.01-25.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | xml-commons-resolver | 1.2-26.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | xml-commons-resolver | 1.2-26.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | xmlstreambuffer | 1.5.4-8.module_el8.5.0+2577+9e95fe00 |
| AlmaLinux · 8 | xmlstreambuffer | 1.5.4-8.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | xsom | 0-19.20110809svn.module_el8.5.0+150+5f0dbea0 |
| AlmaLinux · 8 | xsom | 0-19.20110809svn.module_el8.5.0+2577+9e95fe00 |
Vulnerabilities 4
-
Critical 9.8CVE-2018-8014 EPSS 21%
The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have…
-
High 7.5CVE-2018-8034 EPSS 21%
The host name verification missing in Apache Tomcat
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
-
Medium 5.9CVE-2018-8037 EPSS 11%
Apache Tomcat Race Condition vulnerability
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NI…
-
Medium 4.3
Apache Tomcat Open Redirect vulnerability
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redi…