Scientific Linux SL7.x: SLSA-2017:0935-1 Moderate: Tomcat Security Update

Date: Wed, 12 Apr 2017 20:08:42 -0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: tomcat on SL7.x (noarch)
MIME-Version: 1.0
Message-ID: <20170412200842.19846.34193@slpackages.fnal.gov>

Synopsis: Moderate: tomcat security update
Advisory ID: SLSA-2017:0935-1
Issue Date: 2017-04-12
CVE Numbers: CVE-2016-6816
 CVE-2016-8745
--

Security Fix(es):

* It was discovered that the code that parsed the HTTP request line
permitted invalid characters. This could be exploited, in conjunction with
a proxy that also permitted the invalid characters but with a different
interpretation, to inject data into the HTTP response. By manipulating the
HTTP response the attacker could poison a web-cache, perform an XSS
attack, or obtain sensitive information from requests other then their
own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error
when request contains characters that are not permitted by the HTTP
specification to appear not encoded, even though they were previously
accepted. The newly introduced system property
tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to
configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|)
in not encoded form, as these are often used in URLs without being
properly encoded.

* A bug was discovered in the error handling of the send file code for the
NIO HTTP connector. This led to the current Processor object being added
to the Processor cache multiple times allowing information leakage between
requests including, and not limited to, session ID and the response body.
(CVE-2016-8745)
--

SL7
 noarch
 tomcat-servlet-3.0-api-7.0.69-11.el7_3.noarch.rpm
 tomcat-7.0.69-11.el7_3.noarch.rpm
 tomcat-admin-webapps-7.0.69-11.el7_3.noarch.rpm
 tomcat-docs-webapp-7.0.69-11.el7_3.noarch.rpm
 tomcat-el-2.2-api-7.0.69-11.el7_3.noarch.rpm
 tomcat-javadoc-7.0.69-11.el7_3.noarch.rpm
 tomcat-jsp-2.2-api-7.0.69-11.el7_3.noarch.rpm
 tomcat-jsvc-7.0.69-11.el7_3.noarch.rpm
 tomcat-lib-7.0.69-11.el7_3.noarch.rpm
 tomcat-webapps-7.0.69-11.el7_3.noarch.rpm

- Scientific Linux Development Team