Skip to content
OpenAdvisories
High ELSA-2017-1809 2 CVEs

Important: tomcat security update (Oracle Linux 7)

Published Jul 27, 2017 · Updated Jul 27, 2017

Ecosystem: Oracle Linux

Summary

[0:7.0.69-12]
- Resolves: rhbz#1441487 CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object
- Resolves: rhbz#1441480 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used
- Resolves: rhbz#1459746 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism

Fixed packages 10

ReleasePackageFixed in
Oracle Linux · 7 tomcat 0:7.0.69-12.el7_3
Oracle Linux · 7 tomcat-admin-webapps 0:7.0.69-12.el7_3
Oracle Linux · 7 tomcat-docs-webapp 0:7.0.69-12.el7_3
Oracle Linux · 7 tomcat-el-2.2-api 0:7.0.69-12.el7_3
Oracle Linux · 7 tomcat-javadoc 0:7.0.69-12.el7_3
Oracle Linux · 7 tomcat-jsp-2.2-api 0:7.0.69-12.el7_3
Oracle Linux · 7 tomcat-jsvc 0:7.0.69-12.el7_3
Oracle Linux · 7 tomcat-lib 0:7.0.69-12.el7_3
Oracle Linux · 7 tomcat-servlet-3.0-api 0:7.0.69-12.el7_3
Oracle Linux · 7 tomcat-webapps 0:7.0.69-12.el7_3

Vulnerabilities 2

  • Critical 9.1
    CVE-2017-5648 EPSS 13%

    Exposure of Resource to Wrong Sphere in Apache Tomcat

    While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted appli…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.5
    CVE-2017-5664 EPSS 17%

    Improper Handling of Exceptional Conditions in Apache Tomcat

    The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is prese…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven