Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

Debian DSA-3843-1 Critical: Tomcat8 Flaws Affecting Web Apps

debian
Calendar Grey May 3, 2017
Scroller Debian
Debian has released an update for tomcat8, addressing two significant vulnerabilities that impact servlet outputs and the security of applications.
Two vulnerabilities were discovered in tomcat8, a servlet and JSP engine
Topics%20covered

Topics Covered

security advisory debian application security critical flaw tomcat web applications request processing

Summary

CVE-2017-5647

Pipelined requests were processed incorrectly, which could result in
some responses appearing to be sent for the wrong request.

CVE-2017-5648

Some application listeners calls were issued against the wrong
objects, allowing untrusted applications running under a
SecurityManager to bypass that protection mechanism and access or
modify information associated with other web applications.

For the stable distribution (jessie), these problems have been fixed in
version 8.0.14-1+deb8u9.

For the upcoming stable (stretch) and unstable (sid) distributions,
these problems have been fixed in version 8.5.11-2.

We recommend that you upgrade your tomcat8 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/



Severity
critical
Lowest
Low
Medium
High
Critical

Package: tomcat8
CVE ID: CVE-2017-5647 CVE-2017-5648

Topics%20covered

Topics Covered

security advisory debian application security critical flaw tomcat web applications request processing

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.