Scientific Linux: SLSA-2021:1098-3 Important: Python3 Security Flaw

Date: Wed, 13 May 2015 15:37:58 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: tomcat6 on SL6.x i386/srpm/x86_64
MIME-Version: 1.0

Synopsis: Moderate: tomcat6 security and bug fix update
Advisory ID: SLSA-2015:0991-1
Issue Date: 2015-05-12
CVE Numbers: CVE-2014-0227
--

It was discovered that the ChunkedInputFilter in Tomcat did not fail
subsequent attempts to read input after malformed chunked encoding was
detected. A remote attacker could possibly use this flaw to make Tomcat
process part of the request body as new request, or cause a denial of
service. (CVE-2014-0227)

This update also fixes the following bug:

* Before this update, the tomcat6 init script did not try to kill the
tomcat process if an attempt to stop it was unsuccessful, which would
prevent tomcat from restarting properly. The init script was modified to
correct this issue.

Tomcat must be restarted for this update to take effect.
--

SL6
 x86_64
 tomcat6-admin-webapps-6.0.24-83.el6_6.x86_64.rpm
 tomcat6-javadoc-6.0.24-83.el6_6.x86_64.rpm
 tomcat6-jsp-2.1-api-6.0.24-83.el6_6.x86_64.rpm
 tomcat6-el-2.1-api-6.0.24-83.el6_6.x86_64.rpm
 tomcat6-docs-webapp-6.0.24-83.el6_6.x86_64.rpm
 tomcat6-servlet-2.5-api-6.0.24-83.el6_6.x86_64.rpm
 tomcat6-6.0.24-83.el6_6.x86_64.rpm
 tomcat6-webapps-6.0.24-83.el6_6.x86_64.rpm
 tomcat6-lib-6.0.24-83.el6_6.x86_64.rpm
 tomcat6-debuginfo-6.0.24-83.el6_6.x86_64.rpm
 i386
 tomcat6-servlet-2.5-api-6.0.24-83.el6_6.i686.rpm
 tomcat6-jsp-2.1-api-6.0.24-83.el6_6.i686.rpm
 tomcat6-javadoc-6.0.24-83.el6_6.i686.rpm
 tomcat6-docs-webapp-6.0.24-83.el6_6.i686.rpm
 tomcat6-admin-webapps-6.0.24-83.el6_6.i686.rpm
 tomcat6-el-2.1-api-6.0.24-83.el6_6.i686.rpm
 tomcat6-lib-6.0.24-83.el6_6.i686.rpm
 tomcat6-webapps-6.0.24-83.el6_6.i686.rpm
 tomcat6-6.0.24-83.el6_6.i686.rpm
 tomcat6-debuginfo-6.0.24-83.el6_6.i686.rpm
 srpm
 tomcat6-6.0.24-83.el6_6.src.rpm
 noarch
 tomcat6-debuginfo-6.0.24-83.el6_6.x86_64.rpm
 tomcat6-debuginfo-6.0.24-83.el6_6.i686.rpm

- Scientific Linux Development Team