Scientific Linux: SLSA-2017:0527-1 Moderate: Tomcat6 HTTP Response Issues

Date: Wed, 15 Mar 2017 15:08:55 -0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: tomcat6 on SL6.x (noarch)
MIME-Version: 1.0
Message-ID: <20170315150855.30720.6668@slpackages.fnal.gov>

Synopsis: Moderate: tomcat6 security update
Advisory ID: SLSA-2017:0527-1
Issue Date: 2017-03-15
CVE Numbers: CVE-2016-6816
 CVE-2016-8745
--

Security Fix(es):

* It was discovered that the code that parsed the HTTP request line
permitted invalid characters. This could be exploited, in conjunction with
a proxy that also permitted the invalid characters but with a different
interpretation, to inject data into the HTTP response. By manipulating the
HTTP response the attacker could poison a web-cache, perform an XSS
attack, or obtain sensitive information from requests other then their
own. (CVE-2016-6816)

Note: This fix causes Tomcat to respond with an HTTP 400 Bad Request error
when request contains characters that are not permitted by the HTTP
specification to appear not encoded, even though they were previously
accepted. The newly introduced system property
tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to
configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|)
in not encoded form, as these are often used in URLs without being
properly encoded.

* A bug was discovered in the error handling of the send file code for the
NIO HTTP connector. This led to the current Processor object being added
to the Processor cache multiple times allowing information leakage between
requests including, and not limited to, session ID and the response body.
(CVE-2016-8745)
--

SL6
 noarch
 tomcat6-6.0.24-105.el6_8.noarch.rpm
 tomcat6-admin-webapps-6.0.24-105.el6_8.noarch.rpm
 tomcat6-docs-webapp-6.0.24-105.el6_8.noarch.rpm
 tomcat6-el-2.1-api-6.0.24-105.el6_8.noarch.rpm
 tomcat6-javadoc-6.0.24-105.el6_8.noarch.rpm
 tomcat6-jsp-2.1-api-6.0.24-105.el6_8.noarch.rpm
 tomcat6-lib-6.0.24-105.el6_8.noarch.rpm
 tomcat6-servlet-2.5-api-6.0.24-105.el6_8.noarch.rpm
 tomcat6-webapps-6.0.24-105.el6_8.noarch.rpm

- Scientific Linux Development Team