SUSE-SU-2018:3261-1: moderate: Security update for tomcat

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for tomcat
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:3261-1
Rating:             moderate
References:         #1078677 #1082480 #1082481 #1093697 #1102379 
                    #1102400 #1110850 
Cross-References:   CVE-2017-15706 CVE-2018-11784 CVE-2018-1304
                    CVE-2018-1305 CVE-2018-1336 CVE-2018-8014
                    CVE-2018-8034
Affected Products:
                    SUSE Linux Enterprise Server 12-LTSS
______________________________________________________________________________

   An update that fixes 7 vulnerabilities is now available.

Description:

   This update for tomcat fixes the following issues:

   Version update to 7.0.90:

   - Another bugfix release, for full details see:
     https://tomcat.apache.org/tomcat-7.0-doc/changelog.html

   Security issues fixed:

   - CVE-2018-11784: When the default servlet in Apache Tomcat returned a
     redirect to a directory (e.g. redirecting to '/foo/' when the user
     requested '/foo') a specially crafted URL could be used to cause the
     redirect to be generated to any URI of the attackers choice.
     (bsc#1110850)
   - CVE-2017-15706: As part of the fix for bug 61201, the documentation for
     Apache Tomcat included an updated description of the search algorithm
     used by the CGI Servlet to identify which script to execute.  The update
     was not correct. As a result, some scripts may have failed to execute as
     expected and other scripts may have been executed unexpectedly. Note
     that the behaviour of the CGI servlet has remained unchanged in this
     regard. It is only the documentation of the behaviour that was wrong and
     has been corrected.(bsc#1078677)
   - CVE-2018-1304: The URL pattern of \"\" (the empty string) which exactly
     maps to the context root was not correctly handled in Apache Tomcat when
     used as part of a security constraint definition. This caused the
     constraint to be ignored. It was, therefore, possible for unauthorised
     users to gain access to web application resources that should have been
     protected.  Only security constraints with a URL pattern of the empty
     string were affected. (bsc#1082480)
   - CVE-2018-1305: Security constraints defined by annotations of Servlets
     in Apache Tomcat were only applied once a Servlet had been loaded.
     Because security constraints defined in this way apply to the URL
     pattern and any URLs below that point, it was possible - depending on
     the order Servlets were loaded - for some security constraints not to be
     applied. This could have exposed resources to users who were not
     authorised to access them.(bsc#1082481)
   - CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with
     supplementary characters can lead to an infinite loop in the decoder
     causing a Denial of Service. (bsc#1102400)
   - CVE-2018-8014: Fixed default settings for the CORS filter, which were
     insecure and enabled 'supportsCredentials' for all origins. (bsc#1093697)
   - CVE-2018-8034: Fixed the host name verification when using TLS with the
     WebSocket client, which was not enabled by default. (bsc#1102379)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 12-LTSS:

      zypper in -t patch SUSE-SLE-SERVER-12-2018-2339=1



Package List:

   - SUSE Linux Enterprise Server 12-LTSS (noarch):

      tomcat-7.0.90-7.23.1
      tomcat-admin-webapps-7.0.90-7.23.1
      tomcat-docs-webapp-7.0.90-7.23.1
      tomcat-el-2_2-api-7.0.90-7.23.1
      tomcat-javadoc-7.0.90-7.23.1
      tomcat-jsp-2_2-api-7.0.90-7.23.1
      tomcat-lib-7.0.90-7.23.1
      tomcat-servlet-3_0-api-7.0.90-7.23.1
      tomcat-webapps-7.0.90-7.23.1


References:

   https://www.suse.com/security/cve/CVE-2017-15706.html
   https://www.suse.com/security/cve/CVE-2018-11784.html
   https://www.suse.com/security/cve/CVE-2018-1304.html
   https://www.suse.com/security/cve/CVE-2018-1305.html
   https://www.suse.com/security/cve/CVE-2018-1336.html
   https://www.suse.com/security/cve/CVE-2018-8014.html
   https://www.suse.com/security/cve/CVE-2018-8034.html
   https://bugzilla.suse.com/1078677
   https://bugzilla.suse.com/1082480
   https://bugzilla.suse.com/1082481
   https://bugzilla.suse.com/1093697
   https://bugzilla.suse.com/1102379
   https://bugzilla.suse.com/1102400
   https://bugzilla.suse.com/1110850