Alerts This Week
Warning Icon 1 770
Alerts This Week
Warning Icon 1 770

SUSE: 2022:0784-1 Important: Tomcat Local Privilege Escalation Fix

suse
Calendar Grey March 9, 2022
Dist Suse Esm H88
Oracle Security Update tackles vital WebLogic flaw with comprehensive solutions and guidance. Discover more for details.
An update that solves one vulnerability and has two fixes is now available

Summary

This update for tomcat fixes the following issues: Security issues fixed: - CVE-2022-23181: Fixed time of check, time of use vulnerability that allowed local privilege escalation. (bsc#1195255) - Remove log4j dependency, which is currently directly in use (bsc#1196137) - Make the package RPM conflict even more specific to conflict with java-openjdk-headless >= 9 (bsc#1196091) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud Crowbar 9: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2022-784=1 - SUSE OpenStack Cloud Crowbar 8: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2022-784=1 - SUSE OpenStack Cloud 9:

Topics%20covered

Topics Covered

security advisory local privilege escalation tomcat suse important fix

References

#1195255 #1196091 #1196137

Cross- CVE-2022-23181

CVSS scores:

CVE-2022-23181 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2022-23181 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:

HPE Helion Openstack 8

SUSE Linux Enterprise Server 12-SP4-LTSS

SUSE Linux Enterprise Server 12-SP5

SUSE Linux Enterprise Server for SAP 12-SP4

SUSE Linux Enterprise Server for SAP Applications 12-SP5

SUSE Linux Enterprise Software Development Kit 12-SP5

SUSE OpenStack Cloud 8

SUSE OpenStack Cloud 9

SUSE OpenStack Cloud Crowbar 8

SUSE OpenStack Cloud Crowbar 9

https://www.suse.com/security/cve/CVE-2022-23181.html

https://bugzilla.suse.com/1195255

https://bugzilla.suse.com/1196091

https://bugzilla.suse.com/1196137

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2022:0784-1
Rating: important

Topics%20covered

Topics Covered

security advisory local privilege escalation tomcat suse important fix

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here