Skip to content
OpenAdvisories
Medium ELSA-2016-2599 7 CVEs

Moderate: tomcat security, bug fix, and enhancement update (Oracle Linux 7)

Published Nov 9, 2016 · Updated Nov 9, 2016

Ecosystem: Oracle Linux

Summary

[0:7.0.69-10]
- Related: rhbz#1368122

[0:7.0.69-9]
- Resolves: rhbz#1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
- Resolves: rhbz#1368122

[0:7.0.69-7]
- Resolves: rhbz#1362545

[0:7.0.69-6]
- Related: rhbz#1201409 Added /etc/sysconfig/tomcat to the systemd unit for tomcat-jsvc.service

[0:7.0.69-5]
- Resolves: rhbz#1347860 The systemd service unit does not allow tomcat to shut down gracefully

[0:7.0.69-4]
- Resolves: rhbz#1350438 CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service

[0:7.0.69-3]
- Resolves: rhbz#1347774 The security manager doesn't work correctly (JSPs cannot be compiled)

[0:7.0.69-2]
- Rebase Resolves: rhbz#1311622 Getting NoSuchElementException while handling attributes with empty string value in tomcat
- Rebase Resolves: rhbz#1320853 Add HSTS support
- Rebase Resolves: rhbz#1293292 CVE-2014-7810 tomcat: Tomcat/JBossWeb: security manager bypass via EL expressions
- Rebase Resolves: rhbz#1347144 CVE-2016-0706 tomcat: security manager bypass via StatusManagerServlet
- Rebase Resolves: rhbz#1347139 CVE-2015-5346 tomcat: Session fixation
- Rebase Resolves: rhbz#1347136 CVE-2015-5345 tomcat: directory disclosure
- Rebase Resolves: rhbz#1347129 CVE-2015-5174 tomcat: URL Normalization issue
- Rebase Resolves: rhbz#1347146 CVE-2016-0763 tomcat: security manager bypass via setGlobalContext()
- Rebase Resolves: rhbz#1347142 CVE-2016-0714 tomcat: Security Manager bypass via persistence mechanisms
- Rebase Resolves: rhbz#1347133 CVE-2015-5351 tomcat: CSRF token leak

[0:7.0.69-1]
- Resolves: rhbz#1287928 Rebase to tomcat 7.0.69
- Resolves: rhbz#1327326 rpm -V tomcat fails on /var/log/tomcat/catalina.out
- Resolves: rhbz#1277197 tomcat user has non-existing default shell set
- Resolves: rhbz#1240279 The command tomcat-digest doesn't work with RHEL 7
- Resolves: rhbz#1229476 Tomcat startup ONLY options
- Resolves: rhbz#1133070 Need to include full implementation of tomcat-juli.jar and tomcat-juli-adapters.jar
- Resolves: rhbz#1201409 Fix the broken tomcat-jsvc service unit
- Resolves: rhbz#1221896 tomcat.service loads /etc/sysconfig/tomcat without shell expansion
- Resolves: rhbz#1208402 Mark web.xml in tomcat-admin-webapps as config file

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 7 tomcat 0:7.0.69-10.el7
Oracle Linux · 7 tomcat-admin-webapps 0:7.0.69-10.el7
Oracle Linux · 7 tomcat-docs-webapp 0:7.0.69-10.el7
Oracle Linux · 7 tomcat-el-2.2-api 0:7.0.69-10.el7
Oracle Linux · 7 tomcat-javadoc 0:7.0.69-10.el7
Oracle Linux · 7 tomcat-jsp-2.2-api 0:7.0.69-10.el7
Oracle Linux · 7 tomcat-jsvc 0:7.0.69-10.el7
Oracle Linux · 7 tomcat-lib 0:7.0.69-10.el7
Oracle Linux · 7 tomcat-servlet-3.0-api 0:7.0.69-10.el7
Oracle Linux · 7 tomcat-webapps 0:7.0.69-10.el7

Vulnerabilities 7

  • High 8.8
    CVE-2015-5351

    Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token

    The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mech…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • High 8.8
    CVE-2016-0714 Public exploit EPSS 13%

    Improper Access Control in Apache Tomcat

    The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • High 7.5
    CVE-2016-3092 EPSS 37%

    High severity vulnerability that affects commons-fileupload:commons-fileupload

    The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consu…

    tomcat8 tomcat7 tomcat6 commons-fileupload:commons-fileupload Debian Ubuntu Maven
  • Medium 6.3
    CVE-2016-0763 EPSS 11%

    Improper Verification of Source of a Communication Channel in Apache Tomcat

    The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allow…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 5.3
    CVE-2015-5345 EPSS 18%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a direc…

    org.apache.tomcat:tomcat tomcat9 tomcat7 tomcat6 Ubuntu Maven
  • Medium 4.3
    CVE-2015-5174 EPSS 13%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash d…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 4.3
    CVE-2016-0706

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticate…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven