Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:2611-1

Опубликовано: 11 сент. 2020
Источник: suse-cvrf

Описание

Security update for tomcat

This update for tomcat fixes the following issues:

  • CVE-2020-1935: Fixed an HTTP request smuggling vulnerability (bsc#1164860).
  • CVE-2020-13935: Fixed a WebSocket DoS (bsc#1174117).

Список пакетов

HPE Helion OpenStack 8
tomcat-8.0.53-29.37.1
tomcat-admin-webapps-8.0.53-29.37.1
tomcat-docs-webapp-8.0.53-29.37.1
tomcat-el-3_0-api-8.0.53-29.37.1
tomcat-javadoc-8.0.53-29.37.1
tomcat-jsp-2_3-api-8.0.53-29.37.1
tomcat-lib-8.0.53-29.37.1
tomcat-servlet-3_1-api-8.0.53-29.37.1
tomcat-webapps-8.0.53-29.37.1
SUSE Enterprise Storage 5
tomcat-8.0.53-29.37.1
tomcat-admin-webapps-8.0.53-29.37.1
tomcat-docs-webapp-8.0.53-29.37.1
tomcat-el-3_0-api-8.0.53-29.37.1
tomcat-javadoc-8.0.53-29.37.1
tomcat-jsp-2_3-api-8.0.53-29.37.1
tomcat-lib-8.0.53-29.37.1
tomcat-servlet-3_1-api-8.0.53-29.37.1
tomcat-webapps-8.0.53-29.37.1
SUSE Linux Enterprise Server 12 SP2-BCL
tomcat-8.0.53-29.37.1
tomcat-admin-webapps-8.0.53-29.37.1
tomcat-docs-webapp-8.0.53-29.37.1
tomcat-el-3_0-api-8.0.53-29.37.1
tomcat-javadoc-8.0.53-29.37.1
tomcat-jsp-2_3-api-8.0.53-29.37.1
tomcat-lib-8.0.53-29.37.1
tomcat-servlet-3_1-api-8.0.53-29.37.1
tomcat-webapps-8.0.53-29.37.1
SUSE Linux Enterprise Server 12 SP2-LTSS
tomcat-8.0.53-29.37.1
tomcat-admin-webapps-8.0.53-29.37.1
tomcat-docs-webapp-8.0.53-29.37.1
tomcat-el-3_0-api-8.0.53-29.37.1
tomcat-javadoc-8.0.53-29.37.1
tomcat-jsp-2_3-api-8.0.53-29.37.1
tomcat-lib-8.0.53-29.37.1
tomcat-servlet-3_1-api-8.0.53-29.37.1
tomcat-webapps-8.0.53-29.37.1
SUSE Linux Enterprise Server 12 SP3-BCL
tomcat-8.0.53-29.37.1
tomcat-admin-webapps-8.0.53-29.37.1
tomcat-docs-webapp-8.0.53-29.37.1
tomcat-el-3_0-api-8.0.53-29.37.1
tomcat-javadoc-8.0.53-29.37.1
tomcat-jsp-2_3-api-8.0.53-29.37.1
tomcat-lib-8.0.53-29.37.1
tomcat-servlet-3_1-api-8.0.53-29.37.1
tomcat-webapps-8.0.53-29.37.1
SUSE Linux Enterprise Server 12 SP3-LTSS
tomcat-8.0.53-29.37.1
tomcat-admin-webapps-8.0.53-29.37.1
tomcat-docs-webapp-8.0.53-29.37.1
tomcat-el-3_0-api-8.0.53-29.37.1
tomcat-javadoc-8.0.53-29.37.1
tomcat-jsp-2_3-api-8.0.53-29.37.1
tomcat-lib-8.0.53-29.37.1
tomcat-servlet-3_1-api-8.0.53-29.37.1
tomcat-webapps-8.0.53-29.37.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2
tomcat-8.0.53-29.37.1
tomcat-admin-webapps-8.0.53-29.37.1
tomcat-docs-webapp-8.0.53-29.37.1
tomcat-el-3_0-api-8.0.53-29.37.1
tomcat-javadoc-8.0.53-29.37.1
tomcat-jsp-2_3-api-8.0.53-29.37.1
tomcat-lib-8.0.53-29.37.1
tomcat-servlet-3_1-api-8.0.53-29.37.1
tomcat-webapps-8.0.53-29.37.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
tomcat-8.0.53-29.37.1
tomcat-admin-webapps-8.0.53-29.37.1
tomcat-docs-webapp-8.0.53-29.37.1
tomcat-el-3_0-api-8.0.53-29.37.1
tomcat-javadoc-8.0.53-29.37.1
tomcat-jsp-2_3-api-8.0.53-29.37.1
tomcat-lib-8.0.53-29.37.1
tomcat-servlet-3_1-api-8.0.53-29.37.1
tomcat-webapps-8.0.53-29.37.1
SUSE OpenStack Cloud 7
tomcat-8.0.53-29.37.1
tomcat-admin-webapps-8.0.53-29.37.1
tomcat-docs-webapp-8.0.53-29.37.1
tomcat-el-3_0-api-8.0.53-29.37.1
tomcat-javadoc-8.0.53-29.37.1
tomcat-jsp-2_3-api-8.0.53-29.37.1
tomcat-lib-8.0.53-29.37.1
tomcat-servlet-3_1-api-8.0.53-29.37.1
tomcat-webapps-8.0.53-29.37.1
SUSE OpenStack Cloud 8
tomcat-8.0.53-29.37.1
tomcat-admin-webapps-8.0.53-29.37.1
tomcat-docs-webapp-8.0.53-29.37.1
tomcat-el-3_0-api-8.0.53-29.37.1
tomcat-javadoc-8.0.53-29.37.1
tomcat-jsp-2_3-api-8.0.53-29.37.1
tomcat-lib-8.0.53-29.37.1
tomcat-servlet-3_1-api-8.0.53-29.37.1
tomcat-webapps-8.0.53-29.37.1
SUSE OpenStack Cloud Crowbar 8
tomcat-8.0.53-29.37.1
tomcat-admin-webapps-8.0.53-29.37.1
tomcat-docs-webapp-8.0.53-29.37.1
tomcat-el-3_0-api-8.0.53-29.37.1
tomcat-javadoc-8.0.53-29.37.1
tomcat-jsp-2_3-api-8.0.53-29.37.1
tomcat-lib-8.0.53-29.37.1
tomcat-servlet-3_1-api-8.0.53-29.37.1
tomcat-webapps-8.0.53-29.37.1

Ссылки

Описание

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

Затронутые продукты
HPE Helion OpenStack 8:tomcat-8.0.53-29.37.1
HPE Helion OpenStack 8:tomcat-admin-webapps-8.0.53-29.37.1
HPE Helion OpenStack 8:tomcat-docs-webapp-8.0.53-29.37.1
HPE Helion OpenStack 8:tomcat-el-3_0-api-8.0.53-29.37.1
Ссылки

Описание

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Затронутые продукты
HPE Helion OpenStack 8:tomcat-8.0.53-29.37.1
HPE Helion OpenStack 8:tomcat-admin-webapps-8.0.53-29.37.1
HPE Helion OpenStack 8:tomcat-docs-webapp-8.0.53-29.37.1
HPE Helion OpenStack 8:tomcat-el-3_0-api-8.0.53-29.37.1
Ссылки