openSUSE Security Update: Security update for tomcat
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2018:3054-1
Rating:             moderate
References:         #1067720 #1093697 #1102379 #1102400 #1102410 
                    
Cross-References:   CVE-2018-1336 CVE-2018-8014 CVE-2018-8034
                    CVE-2018-8037
Affected Products:
                    openSUSE Leap 15.0
______________________________________________________________________________

   An update that solves four vulnerabilities and has one
   errata is now available.

Description:

   This update for tomcat to version 9.0.10 fixes the following issues:

   Security issues fixed:

   - CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with
     supplementary characters could have lead to an infinite loop in the
     decoder causing a Denial of Service (bsc#1102400).
   - CVE-2018-8014: Fix insecure default CORS filter settings (bsc#1093697).
   - CVE-2018-8034: The host name verification when using TLS with the
     WebSocket client was missing. It is now enabled by default (bsc#1102379).
   - CVE-2018-8037: If an async request was completed by the application at
     the same time as the container triggered the async timeout, a race
     condition existed that could have resulted in a user seeing a response
     intended for a different user. An additional issue was present in the
     NIO and NIO2 connectors that did not correctly track the closure of the
     connection when an async request was completed by the application and
     timed out by the container at the same time. This could also have
     resulted in a user seeing a response intended for another user
     (bsc#1102410).

   Bug fixes:

   - Avoid overwriting of customer's configuration during update (bsc#1067720)
   - Disable adding OSGi metadata to JAR files

   - See changelog at
   https://tomcat.apache.org/tomcat-9.0-doc/changelog.html
     )

   This update was imported from the SUSE:SLE-15:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.0:

      zypper in -t patch openSUSE-2018-1129=1



Package List:

   - openSUSE Leap 15.0 (noarch):

      tomcat-9.0.10-lp150.2.3.2
      tomcat-admin-webapps-9.0.10-lp150.2.3.2
      tomcat-docs-webapp-9.0.10-lp150.2.3.2
      tomcat-el-3_0-api-9.0.10-lp150.2.3.2
      tomcat-embed-9.0.10-lp150.2.3.2
      tomcat-javadoc-9.0.10-lp150.2.3.2
      tomcat-jsp-2_3-api-9.0.10-lp150.2.3.2
      tomcat-jsvc-9.0.10-lp150.2.3.2
      tomcat-lib-9.0.10-lp150.2.3.2
      tomcat-servlet-4_0-api-9.0.10-lp150.2.3.2
      tomcat-webapps-9.0.10-lp150.2.3.2


References:

   https://www.suse.com/security/cve/CVE-2018-1336.html
   https://www.suse.com/security/cve/CVE-2018-8014.html
   https://www.suse.com/security/cve/CVE-2018-8034.html
   https://www.suse.com/security/cve/CVE-2018-8037.html
   https://bugzilla.suse.com/1067720
   https://bugzilla.suse.com/1093697
   https://bugzilla.suse.com/1102379
   https://bugzilla.suse.com/1102400
   https://bugzilla.suse.com/1102410

--

openSUSE: 2018:3054-1: moderate: tomcat

October 6, 2018
An update that solves four vulnerabilities and has one errata is now available.

Description

This update for tomcat to version 9.0.10 fixes the following issues: Security issues fixed: - CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with supplementary characters could have lead to an infinite loop in the decoder causing a Denial of Service (bsc#1102400). - CVE-2018-8014: Fix insecure default CORS filter settings (bsc#1093697). - CVE-2018-8034: The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default (bsc#1102379). - CVE-2018-8037: If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could have resulted in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also have resulted in a user seeing a response intended for another user (bsc#1102410). Bug fixes: - Avoid overwriting of customer's configuration during update (bsc#1067720) - Disable adding OSGi metadata to JAR files - See changelog at https://tomcat.apache.org/tomcat-9.0-doc/changelog.html ) This update was imported from the SUSE:SLE-15:Update update project.

 

Patch

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-1129=1


Package List

- openSUSE Leap 15.0 (noarch): tomcat-9.0.10-lp150.2.3.2 tomcat-admin-webapps-9.0.10-lp150.2.3.2 tomcat-docs-webapp-9.0.10-lp150.2.3.2 tomcat-el-3_0-api-9.0.10-lp150.2.3.2 tomcat-embed-9.0.10-lp150.2.3.2 tomcat-javadoc-9.0.10-lp150.2.3.2 tomcat-jsp-2_3-api-9.0.10-lp150.2.3.2 tomcat-jsvc-9.0.10-lp150.2.3.2 tomcat-lib-9.0.10-lp150.2.3.2 tomcat-servlet-4_0-api-9.0.10-lp150.2.3.2 tomcat-webapps-9.0.10-lp150.2.3.2


References

https://www.suse.com/security/cve/CVE-2018-1336.html https://www.suse.com/security/cve/CVE-2018-8014.html https://www.suse.com/security/cve/CVE-2018-8034.html https://www.suse.com/security/cve/CVE-2018-8037.html https://bugzilla.suse.com/1067720 https://bugzilla.suse.com/1093697 https://bugzilla.suse.com/1102379 https://bugzilla.suse.com/1102400 https://bugzilla.suse.com/1102410--


Severity
Announcement ID: openSUSE-SU-2018:3054-1
Rating: moderate
Affected Products: openSUSE Leap 15.0 le.

Related News

19.Laptop Bed Esm H320
2 - 3 min read
The release of Google Chrome 124 addresses four vulnerabilities, including a critical security flaw that can enable attackers to execute arbitrary
23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved