ALT-PU-2018-1731

Высокий

ALT-PU-2018-1731: package tomcat update to version 8.5.29-alt1_1jpp8

Источник

errata.altlinux.org

Дата публикации

17.05.2018

Дата обновления

04.02.2026

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades tomcat to version 8.5.29-alt1_1jpp8.

Устраненные уязвимости6

BDU:2019-01758

Средний 6.5

Дата публикации: 16.05.2019

Уязвимость сервера приложений Apache Tomcat, связанная с недостатками контроля доступа, позволяющая нарушителю повысить свои привилегии

CVSS 3.1

Средний 6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS 2.0

Средний 6.8

AV:N/AC:L/Au:S/C:C/I:N/A:N

Access vector: Network
Complexity: Low
Authentication: Single
Confidentiality: Complete
Integrity: None
Availability: None

Ссылки

BDU:2019-01758 https://bdu.fstec.ru/vul/2019-01758

Ссылки5

ALT-PU-2018-1731 https://errata.altlinux.org/ALT-PU-2018-1731

GHSA-372q-33vh-8mpc

https://github.com/advisories/GHSA-372q-33vh-8mpc

GHSA-6rxj-58jh-436r

https://github.com/advisories/GHSA-6rxj-58jh-436r

GHSA-jx6h-3fjx-cgv5

https://github.com/advisories/GHSA-jx6h-3fjx-cgv5

GHSA-v646-rx6w-r3qq

https://github.com/advisories/GHSA-v646-rx6w-r3qq

Связанные уязвимости

openSUSE-SU-2018:0852-1

suse-cvrf

больше 8 лет назад

Security update for tomcat

SUSE-SU-2018:0817-1

suse-cvrf

больше 8 лет назад

Security update for tomcat

SUSE-SU-2018:3261-1

suse-cvrf

около 8 лет назад

Security update for tomcat

SUSE-SU-2018:3388-1

suse-cvrf

около 8 лет назад

Security update for tomcat

CVE-2016-5388

CVSS3: 8.1

ubuntu

больше 10 лет назад

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.