Debian LTS: DLA-2733-1: tomcat8 security update

Advisories

-------------------------------------------------------------------------
Debian LTS Advisory DLA-2733-1                [email protected]
https://www.debian.org/lts/security/                      Markus Koschany
August 05, 2021                               https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : tomcat8
Version        : 8.5.54-0+deb9u7
CVE ID         : CVE-2021-30640 CVE-2021-33037
Debian Bug     : 991046 991046

Several security vulnerabilities have been discovered in the Tomcat
servlet and JSP engine.

CVE-2021-30640

   A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to
   authenticate using variations of a valid user name and/or to bypass some of
   the protection provided by the LockOut Realm.

CVE-2021-33037

   Apache Tomcat did not correctly parse the HTTP transfer-encoding request
   header in some circumstances leading to the possibility to request
   smuggling when used with a reverse proxy. Specifically: - Tomcat
   incorrectly ignored the transfer encoding header if the client declared it
   would only accept an HTTP/1.0 response; - Tomcat honoured the identify
   encoding; and - Tomcat did not ensure that, if present, the chunked
   encoding was the final encoding.

For Debian 9 stretch, these problems have been fixed in version
8.5.54-0+deb9u7.

We recommend that you upgrade your tomcat8 packages.

For the detailed security status of tomcat8 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tomcat8

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Debian LTS: DLA-2733-1: tomcat8 security update

August 5, 2021
Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine

Summary


Several security vulnerabilities have been discovered in the Tomcat
servlet and JSP engine.

CVE-2021-30640

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to
authenticate using variations of a valid user name and/or to bypass some of
the protection provided by the LockOut Realm.

CVE-2021-33037

Apache Tomcat did not correctly parse the HTTP transfer-encoding request
header in some circumstances leading to the possibility to request
smuggling when used with a reverse proxy. Specifically: - Tomcat
incorrectly ignored the transfer encoding header if the client declared it
would only accept an HTTP/1.0 response; - Tomcat honoured the identify
encoding; and - Tomcat did not ensure that, if present, the chunked
encoding was the final encoding.

For Debian 9 stretch, these problems have been fixed in version
8.5.54-0+deb9u7.

We recommend that you upgrade your tomcat8 packages.

For the detailed security status of tomcat8 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tomcat8

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Severity
Package : tomcat8
Version : 8.5.54-0+deb9u7
CVE ID : CVE-2021-30640 CVE-2021-33037
Debian Bug : 991046 991046

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.