Security update for tomcat
Announcement ID: | SUSE-SU-2017:3039-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves three vulnerabilities and has two security fixes can now be installed.
Description:
This update for tomcat fixes the following issues:
Security issues fixed:
- CVE-2017-5664: A problem in handling error pages was fixed, to avoid potential file overwrites during error page handling. (bsc#1042910).
- CVE-2017-7674: A CORS Filter issue could lead to client and server side cache poisoning (bsc#1053352)
- CVE-2017-12617: A remote code execution possibility via JSP Upload was fixed (bsc#1059554)
Non security bugs fixed:
- Fix tomcat-digest classpath error (bsc#977410)
- Fix packaged /etc/alternatives symlinks for api libs that caused rpm -V to report link mismatch (bsc#1019016)
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2
zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1874=1
-
SUSE Linux Enterprise High Performance Computing 12 SP2
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1874=1
-
SUSE Linux Enterprise Server 12 SP2
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1874=1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP2
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1874=1
-
SUSE Linux Enterprise Server 12 SP3
zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1874=1
-
SUSE Linux Enterprise High Performance Computing 12 SP3
zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1874=1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP3
zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1874=1
Package List:
-
SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 (noarch)
- tomcat-servlet-3_1-api-8.0.43-29.5.1
- tomcat-javadoc-8.0.43-29.5.1
- tomcat-el-3_0-api-8.0.43-29.5.1
- tomcat-jsp-2_3-api-8.0.43-29.5.1
- tomcat-webapps-8.0.43-29.5.1
- tomcat-admin-webapps-8.0.43-29.5.1
- tomcat-8.0.43-29.5.1
- tomcat-docs-webapp-8.0.43-29.5.1
- tomcat-lib-8.0.43-29.5.1
-
SUSE Linux Enterprise High Performance Computing 12 SP2 (noarch)
- tomcat-servlet-3_1-api-8.0.43-29.5.1
- tomcat-javadoc-8.0.43-29.5.1
- tomcat-el-3_0-api-8.0.43-29.5.1
- tomcat-jsp-2_3-api-8.0.43-29.5.1
- tomcat-webapps-8.0.43-29.5.1
- tomcat-admin-webapps-8.0.43-29.5.1
- tomcat-8.0.43-29.5.1
- tomcat-docs-webapp-8.0.43-29.5.1
- tomcat-lib-8.0.43-29.5.1
-
SUSE Linux Enterprise Server 12 SP2 (noarch)
- tomcat-servlet-3_1-api-8.0.43-29.5.1
- tomcat-javadoc-8.0.43-29.5.1
- tomcat-el-3_0-api-8.0.43-29.5.1
- tomcat-jsp-2_3-api-8.0.43-29.5.1
- tomcat-webapps-8.0.43-29.5.1
- tomcat-admin-webapps-8.0.43-29.5.1
- tomcat-8.0.43-29.5.1
- tomcat-docs-webapp-8.0.43-29.5.1
- tomcat-lib-8.0.43-29.5.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP2 (noarch)
- tomcat-servlet-3_1-api-8.0.43-29.5.1
- tomcat-javadoc-8.0.43-29.5.1
- tomcat-el-3_0-api-8.0.43-29.5.1
- tomcat-jsp-2_3-api-8.0.43-29.5.1
- tomcat-webapps-8.0.43-29.5.1
- tomcat-admin-webapps-8.0.43-29.5.1
- tomcat-8.0.43-29.5.1
- tomcat-docs-webapp-8.0.43-29.5.1
- tomcat-lib-8.0.43-29.5.1
-
SUSE Linux Enterprise Server 12 SP3 (noarch)
- tomcat-servlet-3_1-api-8.0.43-29.5.1
- tomcat-javadoc-8.0.43-29.5.1
- tomcat-el-3_0-api-8.0.43-29.5.1
- tomcat-jsp-2_3-api-8.0.43-29.5.1
- tomcat-webapps-8.0.43-29.5.1
- tomcat-admin-webapps-8.0.43-29.5.1
- tomcat-8.0.43-29.5.1
- tomcat-docs-webapp-8.0.43-29.5.1
- tomcat-lib-8.0.43-29.5.1
-
SUSE Linux Enterprise High Performance Computing 12 SP3 (noarch)
- tomcat-servlet-3_1-api-8.0.43-29.5.1
- tomcat-javadoc-8.0.43-29.5.1
- tomcat-el-3_0-api-8.0.43-29.5.1
- tomcat-jsp-2_3-api-8.0.43-29.5.1
- tomcat-webapps-8.0.43-29.5.1
- tomcat-admin-webapps-8.0.43-29.5.1
- tomcat-8.0.43-29.5.1
- tomcat-docs-webapp-8.0.43-29.5.1
- tomcat-lib-8.0.43-29.5.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP3 (noarch)
- tomcat-servlet-3_1-api-8.0.43-29.5.1
- tomcat-javadoc-8.0.43-29.5.1
- tomcat-el-3_0-api-8.0.43-29.5.1
- tomcat-jsp-2_3-api-8.0.43-29.5.1
- tomcat-webapps-8.0.43-29.5.1
- tomcat-admin-webapps-8.0.43-29.5.1
- tomcat-8.0.43-29.5.1
- tomcat-docs-webapp-8.0.43-29.5.1
- tomcat-lib-8.0.43-29.5.1
References:
- https://www.suse.com/security/cve/CVE-2017-12617.html
- https://www.suse.com/security/cve/CVE-2017-5664.html
- https://www.suse.com/security/cve/CVE-2017-7674.html
- https://bugzilla.suse.com/show_bug.cgi?id=1019016
- https://bugzilla.suse.com/show_bug.cgi?id=1042910
- https://bugzilla.suse.com/show_bug.cgi?id=1053352
- https://bugzilla.suse.com/show_bug.cgi?id=1059554
- https://bugzilla.suse.com/show_bug.cgi?id=977410