Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

Red Hat 7: RHSA-2015:0983-01 Moderate Tomcat Update - Denial Of Service

red hat
Calendar Grey May 12, 2015
Dist Redhat Esm H88
Revised PostgreSQL components for CentOS 7 tackle moderate vulnerabilities, posing significant risks to service reliability.
Updated tomcat packages that fix one security issue are now available for Red Hat Enterprise Linux 7

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
It was discovered that the ChunkedInputFilter in Tomcat did not fail subsequent attempts to read input after malformed chunked encoding was detected. A remote attacker could possibly use this flaw to make Tomcat process part of the request body as new request, or cause a denial of service. (CVE-2014-0227)
All Tomcat 7 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the tomcat service will be restarted automatically.

Topics%20covered

Topics Covered

security advisory denial of service software patch Red Hat Enterprise Linux moderate impact request smuggling Tomcat update

References

https://access.redhat.com/security/cve/CVE-2014-0227 https://access.redhat.com/security/updates/classification/#moderate https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.55

Package List

Red Hat Enterprise Linux Client (v. 7):
Source: tomcat-7.0.54-2.el7_1.src.rpm
noarch: tomcat-servlet-3.0-api-7.0.54-2.el7_1.noarch.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
noarch: tomcat-7.0.54-2.el7_1.noarch.rpm tomcat-admin-webapps-7.0.54-2.el7_1.noarch.rpm tomcat-docs-webapp-7.0.54-2.el7_1.noarch.rpm tomcat-el-2.2-api-7.0.54-2.el7_1.noarch.rpm tomcat-javadoc-7.0.54-2.el7_1.noarch.rpm tomcat-jsp-2.2-api-7.0.54-2.el7_1.noarch.rpm tomcat-jsvc-7.0.54-2.el7_1.noarch.rpm tomcat-lib-7.0.54-2.el7_1.noarch.rpm tomcat-webapps-7.0.54-2.el7_1.noarch.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: tomcat-7.0.54-2.el7_1.src.rpm
noarch: tomcat-servlet-3.0-api-7.0.54-2.el7_1.noarch.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
noarch: tomcat-7.0.54-2.el7_1.noarch.rpm tomcat-admin-webapps-7.0.54-2.el7_1.noarch.rpm tomcat-docs-webapp-7.0.54-2.el7_1.noarch.rpm tomcat-el-2.2-api-7.0.54-2.el7_1.noarch.rpm tomcat-javadoc-7.0.54-2.el7_1.noarch.rpm tomcat-jsp-2.2-api-7.0.54-2.el7_1.noarch.rpm tomcat-jsvc-7.0.54-2.el7_1.noarch.rpm tomcat-lib-7.0.54-2.el7_1.noarch.rpm tomcat-webapps-7.0.54-2.el7_1.noarch.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: tomcat-7.0.54-2.el7_1.src.rpm
noarch: tomcat-7.0.54-2.el7_1.noarch.rpm tomcat-admin-webapps-7.0.54-2.el7_1.noarch.rpm

Read the Full Advisory


Advisory ID: RHSA-2015:0983-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2015:0983.html
Issue date: 2015-05-12

Topic

Updated tomcat packages that fix one security issue are now availablefor Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having Moderate securityimpact. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available from the CVE link in theReferences section.

Topics%20covered

Topics Covered

security advisory denial of service software patch Red Hat Enterprise Linux moderate impact request smuggling Tomcat update

Relevant Releases Architectures

Red Hat Enterprise Linux Client (v. 7) - noarch

Red Hat Enterprise Linux Client Optional (v. 7) - noarch

Red Hat Enterprise Linux ComputeNode (v. 7) - noarch

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch

Red Hat Enterprise Linux Server (v. 7) - noarch

Red Hat Enterprise Linux Server Optional (v. 7) - noarch

Red Hat Enterprise Linux Workstation (v. 7) - noarch

Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch

Bugs Fixed

1109196 - CVE-2014-0227 Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here