SUSE-SU-2018:3261-1: moderate: Security update for tomcat

sle-security-updates at sle-security-updates at
Fri Oct 19 13:08:34 MDT 2018

   SUSE Security Update: Security update for tomcat

Announcement ID:    SUSE-SU-2018:3261-1
Rating:             moderate
References:         #1078677 #1082480 #1082481 #1093697 #1102379 
                    #1102400 #1110850 
Cross-References:   CVE-2017-15706 CVE-2018-11784 CVE-2018-1304
                    CVE-2018-1305 CVE-2018-1336 CVE-2018-8014
Affected Products:
                    SUSE Linux Enterprise Server 12-LTSS

   An update that fixes 7 vulnerabilities is now available.


   This update for tomcat fixes the following issues:

   Version update to 7.0.90:

   - Another bugfix release, for full details see:

   Security issues fixed:

   - CVE-2018-11784: When the default servlet in Apache Tomcat returned a
     redirect to a directory (e.g. redirecting to '/foo/' when the user
     requested '/foo') a specially crafted URL could be used to cause the
     redirect to be generated to any URI of the attackers choice.
   - CVE-2017-15706: As part of the fix for bug 61201, the documentation for
     Apache Tomcat included an updated description of the search algorithm
     used by the CGI Servlet to identify which script to execute.  The update
     was not correct. As a result, some scripts may have failed to execute as
     expected and other scripts may have been executed unexpectedly. Note
     that the behaviour of the CGI servlet has remained unchanged in this
     regard. It is only the documentation of the behaviour that was wrong and
     has been corrected.(bsc#1078677)
   - CVE-2018-1304: The URL pattern of \"\" (the empty string) which exactly
     maps to the context root was not correctly handled in Apache Tomcat when
     used as part of a security constraint definition. This caused the
     constraint to be ignored. It was, therefore, possible for unauthorised
     users to gain access to web application resources that should have been
     protected.  Only security constraints with a URL pattern of the empty
     string were affected. (bsc#1082480)
   - CVE-2018-1305: Security constraints defined by annotations of Servlets
     in Apache Tomcat were only applied once a Servlet had been loaded.
     Because security constraints defined in this way apply to the URL
     pattern and any URLs below that point, it was possible - depending on
     the order Servlets were loaded - for some security constraints not to be
     applied. This could have exposed resources to users who were not
     authorised to access them.(bsc#1082481)
   - CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with
     supplementary characters can lead to an infinite loop in the decoder
     causing a Denial of Service. (bsc#1102400)
   - CVE-2018-8014: Fixed default settings for the CORS filter, which were
     insecure and enabled 'supportsCredentials' for all origins. (bsc#1093697)
   - CVE-2018-8034: Fixed the host name verification when using TLS with the
     WebSocket client, which was not enabled by default. (bsc#1102379)

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 12-LTSS:

      zypper in -t patch SUSE-SLE-SERVER-12-2018-2339=1

Package List:

   - SUSE Linux Enterprise Server 12-LTSS (noarch):



More information about the sle-security-updates mailing list