ESB-2018.2188 - [Debian] tomcat8: Access confidential data - Remote/unauthenticated 2018-07-30

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.2188
                          tomcat8 security update
                               30 July 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           tomcat8
Publisher:         Debian
Operating System:  Debian GNU/Linux 8
Impact/Access:     Access Confidential Data -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-1305 CVE-2018-1304 

Reference:         ASB-2018.0180
                   ESB-2018.2054
                   ESB-2018.1956
                   ESB-2018.1630
                   ESB-2018.1488
                   ESB-2018.1487
                   ESB-2018.1882.2

Original Bulletin: 
   https://security-tracker.debian.org/tracker/DLA-1450-1

- --------------------------BEGIN INCLUDED TEXT--------------------

- --35mlhkqf534mafg6
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Package        : tomcat8
Version        : 8.0.14-1+deb8u12
CVE ID         : CVE-2018-1304 CVE-2018-1305
Debian Bug     : 802312


Several security vulnerabilities have been discovered in the Tomcat
servlet and JSP engine.

CVE-2018-1304
    The URL pattern of "" (the empty string) which exactly maps to the
    context root was not correctly handled in Apache Tomcat when used as
    part of a security constraint definition. This caused the constraint
    to be ignored. It was, therefore, possible for unauthorized users to
    gain access to web application resources that should have been
    protected. Only security constraints with a URL pattern of the empty
    string were affected.

CVE-2018-1305
    Security constraints defined by annotations of Servlets in Apache
    Tomcat were only applied once a Servlet had been loaded. Because
    security constraints defined in this way apply to the URL pattern
    and any URLs below that point, it was possible - depending on the
    order Servlets were loaded - for some security constraints not to be
    applied. This could have exposed resources to users who were not
    authorized to access them.


For Debian 8 "Jessie", these problems have been fixed in version
8.0.14-1+deb8u12.

We recommend that you upgrade your tomcat8 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

- --35mlhkqf534mafg6
Content-Type: application/pgp-signature; name="signature.asc"

- -----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEz9ERzDttUsU/BH8iLNd4Xt2nsg8FAltdq8cACgkQLNd4Xt2n
sg+vew/8CFSj1Bqyvq9pvcVTAAaPH1X+y+OQ6lVpO024nGvk62wfEbUqMX2QD0+s
HGPKq0sVUwGvrI9oCp/8ws5q8Qif3yeZSwIA4LuXp+y1wOYq/XBqlKBagTPNETEy
QTkIjWfAM2mY4QaXYJaAHphBKljlORzjjuWUXt9PpWnQ/O2ClnngmX0ogAnJ971U
ij+wB/6qV+wQLL5R+5yHloCJViZq4C/vPaevqTWZtGhk+77qAbDz69VzzCj4mMEH
XQzkdLLnV5x6+jMej1oXFIUU1nHO/G6qNYDnoCUKItfSs03j6LW8aiiodoK2inbm
vJdjH+qPKx9N8RTYQgCh/vTMoydMXIg5GQIATJdcGn4EU2+u+GDV5iS7pDozErTE
f/d5JIFijr5Vqg4jDdRDQd21AJpBdlZPck7J4dkwgBpE6R6gNMjnU7D+MxfuRjJn
fHkrngiQZT/1DREhxSB38+c3MHYIGKMilygIx0UaBbSvLYElfKdm7hxODzOk1UHJ
5gYbrWIdf7CjcYts+ubusFpASXiPcKdo38VVJSalr2oLLAzbQESVHGMPX1evlOc0
DFpXDd7Y7z16ept7+As9y6hMP8WkB3moGGgGDdrIUcqRH1aB7U1f6IgOVtMhNBwn
bVEjcW80zmWqlc9dEBM4uEFgakejA62mbQUF+lreGTrCF5i7up8=
=63am
- -----END PGP SIGNATURE-----

- --35mlhkqf534mafg6--

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBW15TtWaOgq3Tt24GAQiXvRAAptIg0RyopMCw9wfOzkx65JyTnkK2Jqkx
/Wzvtciw8N7HqY+izR+JUKN4yNFS6knn97BJvaeptCKPnF3G7c8D9qOxRRm7Vpn+
HcJa/fk8dfsLrm+eZ1oWtsXHo0vIAeALQyjUNpnJXNaHZtD8q9DXeNYp5wsQgufO
s8QhLJH/2mmP4MzGMjd8SA3tDLPJWM7QNwD+/H9/YI6NnKPg86JRjX3i8VTBHXM6
yqVNh27XWmxTvR+qdJ7r7R5Kxbaae/iIaF5/TLcKFuLbRXRZooeLthmByfo9ebN8
ST33m8nGn8sBI1KHIJ11dXX4LeMYKP0eZkO6QRZtdwYUa1TmfCje7xI07jYM5u6D
eIsyYRxnzrsDHX+zYmEAYfDOq7FW3aYf2IDuzNRGtAES93w3bJduGvgWh+nzqssh
reJTfuKs0Nj/9V4TsPExxf7yKg90ChYd43x4PwKb8bb0rQMTZw1zudmKVhkMEvBF
OBXzsKGTBKrF89JjlTtVYY5M3qfHrPkLyYFUBZn8KVs10ndwnbkCMZmRWcVS94bi
RuXChs4/QDHWTpwJ7ZKXjBCK0/78YMmI54lvVRTnYr4enaNLrKX1QuhsxRIoU9kC
9GzpsW002oaX8CPje56Ax4u5GFd2jZbB50N5khtWhWt6l+V8WZk+nlrg0LWWHsOo
TyJz5Idcd0E=
=oTW+
-----END PGP SIGNATURE-----

« Back to bulletins