Red Hat Security Advisory

RHSA-2017:3081

tomcat security update

Released 2017-10-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.76-3.el7_4, tomcat-servlet-3.0-api-7.0.76-3.el7_4
Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.76-3.el7_4, tomcat-admin-webapps-7.0.76-3.el7_4, tomcat-docs-webapp-7.0.76-3.el7_4 +6
Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.76-3.el7_4, tomcat-servlet-3.0-api-7.0.76-3.el7_4
Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.76-3.el7_4, tomcat-admin-webapps-7.0.76-3.el7_4, tomcat-docs-webapp-7.0.76-3.el7_4 +6
Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.76-3.el7_4, tomcat-admin-webapps-7.0.76-3.el7_4, tomcat-el-2.2-api-7.0.76-3.el7_4 +4
Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.76-3.el7_4, tomcat-admin-webapps-7.0.76-3.el7_4, tomcat-docs-webapp-7.0.76-3.el7_4 +6
Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.76-3.el7_4, tomcat-admin-webapps-7.0.76-3.el7_4, tomcat-el-2.2-api-7.0.76-3.el7_4 +4
Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.76-3.el7_4, tomcat-javadoc-7.0.76-3.el7_4, tomcat-jsvc-7.0.76-3.el7_4

Fixes 4 records

TI-2017-09342 CVE-2017-12617 · GHSA-xjgh-84hx-56c5

Unrestricted file upload in Apache Tomcat

CRITICAL 94KEV

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.99968 Published 2017-10-03 Partial fix · 9.0.1, 8.5.23 +2 CWE-434

TI-2017-09340 CVE-2017-12615 · GHSA-pjfr-qf3p-3q25

Unrestricted file upload in Apache Tomcat

CRITICAL 94KEV

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.99707 Published 2017-09-19 Fixed in 7.0.79 CWE-434

TI-2017-03647 CVE-2017-5647 · GHSA-3gv7-3h64-78cm

Information disclosure in Apache Tomcat

MEDIUM 50

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined reques…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.1684 Published 2017-04-17 Partial fix · 9.0.0.M19, 8.5.13 +3 CWE-200

TI-2017-05310 CVE-2017-7674 · GHSA-73rx-3f9r-x949

Insufficient verification of data authenticity in Apache Tomcat

LOW 31

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin.

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.08037 Published 2017-08-11 Partial fix · 9.0.0.M22, 8.5.16 +2 CWE-345