Stay Secure with the Latest Linux Advisories

security advisorycriticalsoftware update

Debian: DSA-3679-1 Critical: Apache Jackrabbit CSRF Threat Resolved

Lukas Reschke discovered that Apache Jackrabbit, an implementation of the Content Repository for Java Technology API, did not correctly check the Content-Type header on HTTP POST requests, enabling Cross-Site Request Forgery (CSRF) attacks by malicious web sites. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3679-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Florian Weimer September 27, 2016 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : jackrabbit CVE ID : CVE-2016-6801 Debian Bug : 838204 Lukas Reschke discovered that Apache Jackrabbit, an implementation of the Content Repository for Java Technology API, did not correctly check the Content-Type header on HTTP POST requests, enabling Cross-Site Request Forgery (CSRF) attacks by malicious web sites. For the stable distribution (jessie), this problem has been fixed in version 2.3.6-1+deb8u2. For the unstable distribution (sid), this problem has been fixed in version 2.12.4-1. We recommend that you upgrade your jackrabbit packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . The Debian Security Advisory DSA-3680-1 highlights vulnerabilities in the Samba package; prompt action advised to maintain secure systems.. jackrabbit update,debian advisory,csurf protection,apache security. . Severity: Critical. LinuxSecurity.com Team

Sep 27, 2016 •Critical Debian