Debian: DSA-3679-1: jackrabbit security update
Summary
Lukas Reschke discovered that Apache Jackrabbit, an implementation of
the Content Repository for Java Technology API, did not correctly
check the Content-Type header on HTTP POST requests, enabling
Cross-Site Request Forgery (CSRF) attacks by malicious web sites.
For the stable distribution (jessie), this problem has been fixed in
version 2.3.6-1+deb8u2.
For the unstable distribution (sid), this problem has been fixed in
version 2.12.4-1.
We recommend that you upgrade your jackrabbit packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org