SUSE-SU-2018:1847-1: moderate: Security update for tomcat6

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for tomcat6
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:1847-1
Rating:             moderate
References:         #1042910 #1082480 
Cross-References:   CVE-2017-5664 CVE-2018-1304
Affected Products:
                    SUSE Linux Enterprise Server 11-SP4
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:

   This update for tomcat6 fixes the following security issues:

   - : The error page mechanism of the Java Servlet Specification requires
     that, when an error occurs and an error page is configured for the error
     that occurred, the original request and response are forwarded to the
     error page. This means that the request is presented to the error page
     with the
     original HTTP method. If the error page is a static file, expected
      behaviour is to serve content of the file as if processing a GET
      request, regardless of the actual HTTP method. The Default Servlet in
      Tomcat did not do this. Depending on the original request this could
      lead to unexpected and undesirable results for static error pages
      including, if the DefaultServlet is configured to permit writes, the
      replacement or removal of the custom error page (bsc#1042910).
   - : The URL pattern of "" was not correctly handled when used as part of a
     security constraint definition. This caused the constraint to be
     ignored. It was possible for unauthorised users to gain access to web
     application resources that should have been protected. Only security
     constraints with a URL pattern of the empty string were affected
     (bsc#1082480).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11-SP4:

      zypper in -t patch slessp4-tomcat6-13685=1



Package List:

   - SUSE Linux Enterprise Server 11-SP4 (noarch):

      tomcat6-6.0.53-0.57.7.1
      tomcat6-admin-webapps-6.0.53-0.57.7.1
      tomcat6-docs-webapp-6.0.53-0.57.7.1
      tomcat6-javadoc-6.0.53-0.57.7.1
      tomcat6-jsp-2_1-api-6.0.53-0.57.7.1
      tomcat6-lib-6.0.53-0.57.7.1
      tomcat6-servlet-2_5-api-6.0.53-0.57.7.1
      tomcat6-webapps-6.0.53-0.57.7.1


References:

   https://www.suse.com/security/cve/CVE-2017-5664.html
   https://www.suse.com/security/cve/CVE-2018-1304.html
   https://bugzilla.suse.com/1042910
   https://bugzilla.suse.com/1082480