Security Update for tomcat7
Summary
DLA-924-1: tomcat7 - security update. Affects tomcat7 versions < 7.0.28-4+deb7u12. Fixed in 7.0.28-4+deb7u12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tomcat7 is a servlet and JSP engine that provides a Java-based web server environment for running Java web applications. It is widely used for hosting websites and web applications. However, two security vulnerabilities have been discovered in the Tomcat servlet and JSP engine.
Vulnerability Detail
The first vulnerability, identified as CVE-2017-5647, is related to the handling of pipelined requests when using the send file feature. Due to a bug, the pipelined request could be lost when the send file processing of the previous request completed. This could lead to responses being sent for the wrong request.
The second vulnerability, CVE-2017-5648, involves the improper usage of application listeners. In certain cases, calls to application listeners did not use the appropriate facade object. This allowed untrusted applications running under a SecurityManager to retain a reference to the request or response object and potentially access or modify information associated with another web application.
How To Fix
Minimum fixed version
7.0.28-4+deb7u12
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tomcat7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, it is important to upgrade the tomcat7 package to address these security vulnerabilities. By upgrading to version 7.0.28-4+deb7u12 or later, you can ensure the proper handling of pipelined requests and prevent unauthorized access to information associated with other web applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tomcat7 →
FAQ
The impact of CVE-2017-5647 is that responses may appear to be sent for the wrong request due to the loss of pipelined requests when using the send file feature.
An attacker can exploit CVE-2017-5648 by running an untrusted application under a SecurityManager and retaining a reference to the request or response object. This allows them to access and potentially modify information associated with another web application.
No specific workaround is mentioned for these vulnerabilities. It is recommended to upgrade to the fixed version of the tomcat7 package.
The vulnerabilities are fixed in version 7.0.28-4+deb7u12 of the tomcat7 package.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat7.
