Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:2996-1

Опубликовано: 22 окт. 2020
Источник: suse-cvrf

Описание

Security update for tomcat

This update for tomcat fixes the following issues:

  • CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582)
  • Don't give write permissions for the tomcat group on files and directories where it's not needed (bsc#1172562)
  • Use %tmpfiles_create macro in %post instead of calling systemd-tmpfiles directly

Список пакетов

SUSE Linux Enterprise Server 12 SP5
tomcat-9.0.36-3.50.1
tomcat-admin-webapps-9.0.36-3.50.1
tomcat-docs-webapp-9.0.36-3.50.1
tomcat-el-3_0-api-9.0.36-3.50.1
tomcat-javadoc-9.0.36-3.50.1
tomcat-jsp-2_3-api-9.0.36-3.50.1
tomcat-lib-9.0.36-3.50.1
tomcat-servlet-4_0-api-9.0.36-3.50.1
tomcat-webapps-9.0.36-3.50.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
tomcat-9.0.36-3.50.1
tomcat-admin-webapps-9.0.36-3.50.1
tomcat-docs-webapp-9.0.36-3.50.1
tomcat-el-3_0-api-9.0.36-3.50.1
tomcat-javadoc-9.0.36-3.50.1
tomcat-jsp-2_3-api-9.0.36-3.50.1
tomcat-lib-9.0.36-3.50.1
tomcat-servlet-4_0-api-9.0.36-3.50.1
tomcat-webapps-9.0.36-3.50.1

Ссылки

Описание

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5:tomcat-9.0.36-3.50.1
SUSE Linux Enterprise Server 12 SP5:tomcat-admin-webapps-9.0.36-3.50.1
SUSE Linux Enterprise Server 12 SP5:tomcat-docs-webapp-9.0.36-3.50.1
SUSE Linux Enterprise Server 12 SP5:tomcat-el-3_0-api-9.0.36-3.50.1
Ссылки