Debian alert DLA-2209-1 (tomcat8)

From:
             
 
Markus Koschany <apo@debian.org> 
To:
             
 
debian-lts-announce@lists.debian.org 
Subject:
             
 
[SECURITY] [DLA 2209-1] tomcat8 security update 
Date:
             
 
Thu, 28 May 2020 19:53:49 +0200
Message-ID:
             
 
<8926bce3-cc06-9698-42b7-87c4feccd83f@debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package        : tomcat8
Version        : 8.0.14-1+deb8u17
CVE ID         : CVE-2019-17563 CVE-2020-1935 CVE-2020-1938
                 CVE-2020-9484
Debian Bug     : 961209 952436 952437 952438


Several security vulnerabilities have been discovered in the Tomcat
servlet and JSP engine.

WARNING: The fix for CVE-2020-1938 may disrupt services that rely on a
working AJP configuration. The option secretRequired defaults to true
now. You should define a secret in your server.xml or you can revert
back by setting secretRequired to false.


CVE-2019-17563

    When using FORM authentication with Apache Tomcat there was a narrow
    window where an attacker could perform a session fixation attack.
    The window was considered too narrow for an exploit to be practical
    but, erring on the side of caution, this issue has been treated as a
    security vulnerability.

CVE-2020-1935

    In Apache Tomcat the HTTP header parsing code used an approach to
    end-of-line parsing that allowed some invalid HTTP headers to be
    parsed as valid. This led to a possibility of HTTP Request Smuggling
    if Tomcat was located behind a reverse proxy that incorrectly
    handled the invalid Transfer-Encoding header in a particular manner.
    Such a reverse proxy is considered unlikely.

CVE-2020-1938

    When using the Apache JServ Protocol (AJP), care must be taken when
    trusting incoming connections to Apache Tomcat. Tomcat treats AJP
    connections as having higher trust than, for example, a similar HTTP
    connection. If such connections are available to an attacker, they
    can be exploited in ways that may be surprising. Previously Tomcat
    shipped with an AJP Connector enabled by default that listened on
    all configured IP addresses. It was expected (and recommended in the
    security guide) that this Connector would be disabled if not
    required.
    .
    Note that Debian already disabled the AJP connector by default.
    Mitigation is only required if the AJP port was made accessible to
    untrusted users.

CVE-2020-9484

    When using Apache Tomcat and an attacker is able to control the
    contents and name of a file on the server; and b) the server is
    configured to use the PersistenceManager with a FileStore; and c)
    the PersistenceManager is configured with
    sessionAttributeValueClassNameFilter="null" (the default unless a
    SecurityManager is used) or a sufficiently lax filter to allow the
    attacker provided object to be deserialized; and d) the attacker
    knows the relative file path from the storage location used by
    FileStore to the file the attacker has control over; then, using a
    specifically crafted request, the attacker will be able to trigger
    remote code execution via deserialization of the file under their
    control. Note that all of conditions a) to d) must be true for the
    attack to succeed.


For Debian 8 "Jessie", these problems have been fixed in version
8.0.14-1+deb8u17.

We recommend that you upgrade your tomcat8 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAl7P+q1fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeSdChAAnX/tDsl4R4UoOFCbxKQMbUKbPtuIMrV4LTZuxYEs4NJDv+zjTkTnXzmF
KjhaKXqZzYtARxXwrJlHhymD4C+cBseq/TN2IyJyDXG3N6nGxhq1ONXF42Hlrk/o
xcXPEkLBzHtczcAm3ph/hEl27+BkmIxG9yWWFoyj7Ek/A3IFQl0ZVNmy0Rw7g6eP
bDPFIlz2Ff6jLczHzpGoJHtUo7D7ZnxulCqYf2i/b0Y1pqg7GeVsc0xfauYmXIMS
FQQbAVCa9iKz2KxWiBQZcapDwNfdgixzDLFPL82rTNwwEow4G+xpaBYQSvWirMnj
a+6OXvtrg9gh4xlbqdAcnLja4WEfbgaptAwLNaItkdTrAbvljj4bOMK8SUJPVF7h
NKv7aXHVwHBXC7EnBkbbuArzZrHuH/rKdBOY2iIzw8kQt5FOQ7cvhmw/L+RFA9eN
vayYJUxXnOgekODBfgMoLcaQZVefidfSxkxz9ty13VacDDR8ZezVocOacIrLVKkQ
W7spKiAPAdpcqk15YzDvJs4FGDPkNYyTYV4qUvdFkAnTr3+HMrHFhr9OAXRiWH8d
X6xChxkomBtBMz5Jz1zAEiRwlNIuOvHFVYfTwFqRQ6JmvNa5GEkBrEVhOlDkAkcp
DW0nMGX4u3IQ1/zVcv8FeRktnEhjHPsx08B76GYa7cGlc4ckYGs=
=Gg7F
-----END PGP SIGNATURE-----