Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.1608
tomcat9 security update
7 May 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: tomcat9
Publisher: Debian
Operating System: Debian GNU/Linux 10
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Access Confidential Data -- Existing Account
Unauthorised Access -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-1938 CVE-2020-1935 CVE-2019-17569
CVE-2019-17563 CVE-2019-12418 CVE-2019-10072
Reference: ESB-2020.1565
Original Bulletin:
https://security-tracker.debian.org/tracker/DSA-4680-1
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4680-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
May 06, 2020 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : tomcat9
CVE ID : CVE-2019-10072 CVE-2019-12418 CVE-2019-17563
CVE-2019-17569 CVE-2020-1935 CVE-2020-1938
Several vulnerabilities were discovered in the Tomcat servlet and JSP
engine, which could result in HTTP request smuggling, code execution
in the AJP connector (disabled by default in Debian) or a man-in-the-middle
attack against the JMX interface.
For the stable distribution (buster), these problems have been fixed in
version 9.0.31-1~deb10u1. The fix for CVE-2020-1938 may require
configuration changes when Tomcat is used with the AJP connector, e.g.
in combination with libapache-mod-jk. For instance the attribute
"secretRequired" is set to true by default now. For affected setups it's
recommended to review https://tomcat.apache.org/tomcat-9.0-doc/config/ajp.html
before the deploying the update.
We recommend that you upgrade your tomcat9 packages.
For the detailed security status of tomcat9 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tomcat9
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl6zJKQACgkQEMKTtsN8
TjYyjQ/+PcaMqPqvviDHl79uke1rIdFNyZ0bJU5prm9aQgv2/YF1AxlTE6Iim+yJ
uvqTpLEWYF4eufOj9uh9XgBMvjfPcB6iPqQ3fot4kuIgZmwyX5yeMdEEPvAMOC2r
a/+gFWkLtWNO4ppQeOppUhGgagmWtWLcVrDZX09JS+loLufqcNdGWFv8PIUH+jZO
J9r93seU5mafKV7h7G3Z2gdAWIV2XRJVpk5x1w4O8VAft6aZ9Tn9VTV18MNJiy3H
hS0kxempEUzSu/kQWUWjxICrhKH/WmAoFJJGUeKj5nj9AIf1m1aXPOppq4ww1DyX
VU3htZ06YejVDKOtJ4cotNWVZU/HWSZXlHeKnzDFTfjjlhvW53wM5CfNuWqtNGHG
jLN7qj3Y/kmhy55IxABqMSS9lpSZiGjjytOi4fKGKL3xryDl7NsIAUPmxm7YQQya
+VBihzj0rXRYMPGctisBA71SkMML9fB+OzqmSAI7DAz+AxMotipsJGGCpiWfT8Ke
4opXXQe+NhVx2jCtjExI8bvM7mfvHE/N13VNpdxGwTvjYm5tFHKvNOg3X8QR01/a
EC+5xiUJh3ilL3zCw7mP+3tv9p5TFuphA1hWJygudnZg4UtqjgBzuAtNkWUIt/xe
JTtGcm/HQuYhsZbO3pqwo8pm92LeUfs7YFp2NPTU7SaYt3uWxKM=
=WcA6
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXrNcGmaOgq3Tt24GAQhdihAAwzdw8/S2JWNhlMflE8w6HZoZEsAC8epj
jJgcFOl4UINwt8M8FGFb64F73zLsyZpAvZbpfRnANdJni1tTv4goZM99HcusbeYr
V0uZ98B7F0BPJI2Vprxqk9GOG0hVY2Y0Jyl/Qssz3MPKaCD2uOltns/2WVFxHMfq
XfkZJ3263BWM1FObAZi4F/T1LZX2DVzjzKSueKpx4ZPZatJoWX1S4JPzrh6F3nnt
I7lP8BbiVC0L5GIf4gF14uK7QX/0/NzjXUiFgHVV98abN2TsEI35wOk8EtrvqhIY
X39YVz/cefk2oHoffmuqNdWNN0WTlcPJL2Snia/EnV/nuPMXH+TdYOw7+12FV0NB
7cKco5/A/fxAdO8X64A2Wn1uKkCQPRh6xyuKdNOjUyFVXO5xj/fNsaSDDJkXgtmQ
oc8VkUtbjnjmsVmgjWuK9Lq3DH3G6huVgx9WCH+YfCjX/d8H758ksOVw5hERcSVM
ED+1ETgbBje8BFzyebhjP2gy8nqjQHF0LvnlqknYrSlVGXwP/ili20fbxocBJtxq
Fy2h2clqKPHw3BHJQG7S541ha3grDOD8MGJJMsPgYCpDEgaiQYWnl3uj/vRFT2XQ
IdjVyAd04PhIfPybARnZRnsvPZOapK+o+C4Em6nqJ9N19nN4CIws4pvK8mXFEEh1
34URYSTsUyI=
=KaMd
-----END PGP SIGNATURE-----