SUSE-SU-2020:0226-1

Details

This update for tomcat to version 9.0.30 fixes the following issues:

Security issue fixed:

CVE-2019-12418: Fixed a local privilege escalation by manipulating the RMI registry (bsc#1159723).
CVE-2019-17563: Fixed a session fixation attack when using FORM authentication (bsc#1159729).

Non-security issue fixed:

Fixed a problem during startup, related to changes in Java 9+ APIs (bsc#1161025).

Affected Packages

tomcat

SUSE Linux Enterprise Module for Web and Scripting 15

Fixed in:

9.0.30-3.34.1

tomcat-admin-webapps

SUSE Linux Enterprise Module for Web and Scripting 15

Fixed in:

9.0.30-3.34.1

tomcat-el-3_0-api

SUSE Linux Enterprise Module for Web and Scripting 15

Fixed in:

9.0.30-3.34.1

tomcat-jsp-2_3-api

SUSE Linux Enterprise Module for Web and Scripting 15

Fixed in:

9.0.30-3.34.1

tomcat-lib

SUSE Linux Enterprise Module for Web and Scripting 15

Fixed in:

9.0.30-3.34.1

tomcat-servlet-4_0-api

SUSE Linux Enterprise Module for Web and Scripting 15

Fixed in:

9.0.30-3.34.1

tomcat-webapps

SUSE Linux Enterprise Module for Web and Scripting 15

Fixed in:

9.0.30-3.34.1

References

REPORT

https://bugzilla.suse.com/1139924

REPORT

https://bugzilla.suse.com/1159723

REPORT

https://bugzilla.suse.com/1159729

REPORT

https://bugzilla.suse.com/1161025

WEB

https://www.suse.com/security/cve/CVE-2019-10072

WEB

https://www.suse.com/security/cve/CVE-2019-12418

WEB

https://www.suse.com/security/cve/CVE-2019-17563

ADVISORY

https://www.suse.com/support/update/announcement/2020/suse-su-20200226-1/