SUSE-SU-2017:1382-1

CRITICAL9.1

Security update for tomcat

Published May 23, 2017

Modified 1 months ago

Fix available

Details

Description of the patch:

This update for tomcat fixes the following issues:

CVE-2017-5647 Pipelined requests could lead to information disclosure (bsc#1033448)
CVE-2017-5648 Untrusted application could retain listener leading to information disclosure (bsc#1033447)
CVE-2016-8745 shared Processor on Connector code could lead to information disclosure (bsc#1015119)

Affected Packages

tomcat

SUSE Linux Enterprise High Performance Computing 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

0:8.0.43-10.19.1

tomcat-admin-webapps

SUSE Linux Enterprise High Performance Computing 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

0:8.0.43-10.19.1

tomcat-docs-webapp

SUSE Linux Enterprise High Performance Computing 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

0:8.0.43-10.19.1

tomcat-el-3_0-api

SUSE Linux Enterprise High Performance Computing 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

0:8.0.43-10.19.1

tomcat-javadoc

SUSE Linux Enterprise High Performance Computing 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

0:8.0.43-10.19.1

tomcat-jsp-2_3-api

SUSE Linux Enterprise High Performance Computing 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

0:8.0.43-10.19.1

tomcat-lib

SUSE Linux Enterprise High Performance Computing 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

0:8.0.43-10.19.1

tomcat-servlet-3_1-api

SUSE Linux Enterprise High Performance Computing 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

0:8.0.43-10.19.1

tomcat-webapps

SUSE Linux Enterprise High Performance Computing 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

0:8.0.43-10.19.1

References

ADVISORY

https://bugzilla.suse.com/1015119

ADVISORY

https://bugzilla.suse.com/1033447

ADVISORY

https://bugzilla.suse.com/1033448

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2017-May/002909.html

ADVISORY

https://www.suse.com/security/cve/CVE-2016-8745/

ADVISORY

https://www.suse.com/security/cve/CVE-2017-5647/

ADVISORY

https://www.suse.com/security/cve/CVE-2017-5648/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2017/suse-su-20171382-1/

CVSS Analysis

CVSS v3.0

9.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

NoneA:N

9.1/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Upstream

CVE-2016-8745 CVE-2017-5647 CVE-2017-5648

Ecosystems

SUSE Linux Enterprise High Performance Computing 12 SP1 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP1

Timeline

PublishedMay 23, 2017

ModifiedSep 20, 2026

SUSE-SU-2017:1382-1 | Mondoo Vulnerability Intelligence