-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2020.2089
                        Security update for tomcat
                               17 June 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           tomcat
Publisher:         SUSE
Operating System:  SUSE
Impact/Access:     Execute Arbitrary Code/Commands -- Existing Account            
                   Increased Privileges            -- Existing Account            
                   Cross-site Scripting            -- Remote with User Interaction
                   Access Confidential Data        -- Existing Account            
                   Reduced Security                -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-9484 CVE-2019-17569 CVE-2019-17563
                   CVE-2019-12418 CVE-2019-0221 

Reference:         ASB-2020.0087
                   ASB-2020.0074
                   ESB-2020.2083
                   ESB-2020.1887
                   ESB-2020.1608

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2020/suse-su-20201497-1.html
   https://www.suse.com/support/update/announcement/2020/suse-su-20201498-1.html

Comment: This bulletin contains two (2) SUSE security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

SUSE Security Update: Security update for tomcat

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:1497-1
Rating:            important
References:        #1136085 #1159723 #1159729 #1164825 #1171928
Cross-References:  CVE-2019-0221 CVE-2019-12418 CVE-2019-17563 CVE-2019-17569
                   CVE-2020-9484
Affected Products:
                   SUSE Linux Enterprise Server for SAP 12-SP1
                   SUSE Linux Enterprise Server 12-SP1-LTSS
______________________________________________________________________________

An update that fixes 5 vulnerabilities is now available.

Description:

This update for tomcat fixes the following issues:
CVE-2020-9484 (bsc#1171928) Apache Tomcat Remote Code Execution via session
persistence
If an attacker was able to control the contents and name of a file on a server
configured to use the PersistenceManager, then the attacker could have
triggered a remote code execution via deserialization of the file under their
control.
CVE-2019-12418 (bsc#1159723) Local privilege escalation by manipulating the RMI
registry and performing a man-in-the-middle attack
When Tomcat is configured with the JMX Remote Lifecycle Listener, a local
attacker without access to the Tomcat process or configuration files was able
to manipulate the RMI registry to perform a man-in-the-middle attack to capture
user names and passwords used to access the JMX interface. The attacker could
then use these credentials to access the JMX interface and gain complete
control over the Tomcat instance.
CVE-2019-0221 (bsc#1136085) The SSI printenv command echoed user provided data
without escaping, which made it vulnerable to XSS.
CVE-2019-17563 (bsc#1159729) When using FORM authentication there was a narrow
window where an attacker could perform a session fixation attack.
CVE-2019-17569 (bsc#1164825) Invalid Transfer-Encoding headers were incorrectly
processed leading to a possibility of HTTP Request Smuggling if Tomcat was
located behind a reverse proxy that incorrectly handled the invalid
Transfer-Encoding header.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Server for SAP 12-SP1:
    zypper in -t patch SUSE-SLE-SAP-12-SP1-2020-1497=1
  o SUSE Linux Enterprise Server 12-SP1-LTSS:
    zypper in -t patch SUSE-SLE-SERVER-12-SP1-2020-1497=1

Package List:

  o SUSE Linux Enterprise Server for SAP 12-SP1 (noarch):
       tomcat-8.0.53-10.43.1
       tomcat-admin-webapps-8.0.53-10.43.1
       tomcat-docs-webapp-8.0.53-10.43.1
       tomcat-el-3_0-api-8.0.53-10.43.1
       tomcat-javadoc-8.0.53-10.43.1
       tomcat-jsp-2_3-api-8.0.53-10.43.1
       tomcat-lib-8.0.53-10.43.1
       tomcat-servlet-3_1-api-8.0.53-10.43.1
       tomcat-webapps-8.0.53-10.43.1
  o SUSE Linux Enterprise Server 12-SP1-LTSS (noarch):
       tomcat-8.0.53-10.43.1
       tomcat-admin-webapps-8.0.53-10.43.1
       tomcat-docs-webapp-8.0.53-10.43.1
       tomcat-el-3_0-api-8.0.53-10.43.1
       tomcat-javadoc-8.0.53-10.43.1
       tomcat-jsp-2_3-api-8.0.53-10.43.1
       tomcat-lib-8.0.53-10.43.1
       tomcat-servlet-3_1-api-8.0.53-10.43.1
       tomcat-webapps-8.0.53-10.43.1


References:

  o https://www.suse.com/security/cve/CVE-2019-0221.html
  o https://www.suse.com/security/cve/CVE-2019-12418.html
  o https://www.suse.com/security/cve/CVE-2019-17563.html
  o https://www.suse.com/security/cve/CVE-2019-17569.html
  o https://www.suse.com/security/cve/CVE-2020-9484.html
  o https://bugzilla.suse.com/1136085
  o https://bugzilla.suse.com/1159723
  o https://bugzilla.suse.com/1159729
  o https://bugzilla.suse.com/1164825
  o https://bugzilla.suse.com/1171928


- --------------------------------------------------------------------------------


SUSE Security Update: Security update for tomcat

______________________________________________________________________________

Announcement ID:   SUSE-SU-2020:1498-1
Rating:            important
References:        #1136085 #1159723 #1159729 #1164825 #1171928
Cross-References:  CVE-2019-0221 CVE-2019-12418 CVE-2019-17563 CVE-2019-17569
                   CVE-2020-9484
Affected Products:
                   SUSE OpenStack Cloud Crowbar 8
                   SUSE OpenStack Cloud 8
                   SUSE OpenStack Cloud 7
                   SUSE Linux Enterprise Server for SAP 12-SP3
                   SUSE Linux Enterprise Server for SAP 12-SP2
                   SUSE Linux Enterprise Server 12-SP3-LTSS
                   SUSE Linux Enterprise Server 12-SP3-BCL
                   SUSE Linux Enterprise Server 12-SP2-LTSS
                   SUSE Linux Enterprise Server 12-SP2-BCL
                   SUSE Enterprise Storage 5
                   HPE Helion Openstack 8
______________________________________________________________________________

An update that fixes 5 vulnerabilities is now available.

Description:

This update for tomcat fixes the following issues:
CVE-2020-9484 (bsc#1171928) Apache Tomcat Remote Code Execution via session
persistence
If an attacker was able to control the contents and name of a file on a server
configured to use the PersistenceManager, then the attacker could have
triggered a remote code execution via deserialization of the file under their
control.
CVE-2019-12418 (bsc#1159723) Local privilege escalation by manipulating the RMI
registry and performing a man-in-the-middle attack
When Tomcat is configured with the JMX Remote Lifecycle Listener, a local
attacker without access to the Tomcat process or configuration files was able
to manipulate the RMI registry to perform a man-in-the-middle attack to capture
user names and passwords used to access the JMX interface. The attacker could
then use these credentials to access the JMX interface and gain complete
control over the Tomcat instance.
CVE-2019-0221 (bsc#1136085) The SSI printenv command echoed user provided data
without escaping, which made it vulnerable to XSS.
CVE-2019-17563 (bsc#1159729) When using FORM authentication there was a narrow
window where an attacker could perform a session fixation attack.
CVE-2019-17569 (bsc#1164825) Invalid Transfer-Encoding headers were incorrectly
processed leading to a possibility of HTTP Request Smuggling if Tomcat was
located behind a reverse proxy that incorrectly handled the invalid
Transfer-Encoding header.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE OpenStack Cloud Crowbar 8:
    zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2020-1498=1
  o SUSE OpenStack Cloud 8:
    zypper in -t patch SUSE-OpenStack-Cloud-8-2020-1498=1
  o SUSE OpenStack Cloud 7:
    zypper in -t patch SUSE-OpenStack-Cloud-7-2020-1498=1
  o SUSE Linux Enterprise Server for SAP 12-SP3:
    zypper in -t patch SUSE-SLE-SAP-12-SP3-2020-1498=1
  o SUSE Linux Enterprise Server for SAP 12-SP2:
    zypper in -t patch SUSE-SLE-SAP-12-SP2-2020-1498=1
  o SUSE Linux Enterprise Server 12-SP3-LTSS:
    zypper in -t patch SUSE-SLE-SERVER-12-SP3-2020-1498=1
  o SUSE Linux Enterprise Server 12-SP3-BCL:
    zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2020-1498=1
  o SUSE Linux Enterprise Server 12-SP2-LTSS:
    zypper in -t patch SUSE-SLE-SERVER-12-SP2-2020-1498=1
  o SUSE Linux Enterprise Server 12-SP2-BCL:
    zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2020-1498=1
  o SUSE Enterprise Storage 5:
    zypper in -t patch SUSE-Storage-5-2020-1498=1
  o HPE Helion Openstack 8:
    zypper in -t patch HPE-Helion-OpenStack-8-2020-1498=1

Package List:

  o SUSE OpenStack Cloud Crowbar 8 (noarch):
       tomcat-8.0.53-29.27.1
       tomcat-admin-webapps-8.0.53-29.27.1
       tomcat-docs-webapp-8.0.53-29.27.1
       tomcat-el-3_0-api-8.0.53-29.27.1
       tomcat-javadoc-8.0.53-29.27.1
       tomcat-jsp-2_3-api-8.0.53-29.27.1
       tomcat-lib-8.0.53-29.27.1
       tomcat-servlet-3_1-api-8.0.53-29.27.1
       tomcat-webapps-8.0.53-29.27.1
  o SUSE OpenStack Cloud 8 (noarch):
       tomcat-8.0.53-29.27.1
       tomcat-admin-webapps-8.0.53-29.27.1
       tomcat-docs-webapp-8.0.53-29.27.1
       tomcat-el-3_0-api-8.0.53-29.27.1
       tomcat-javadoc-8.0.53-29.27.1
       tomcat-jsp-2_3-api-8.0.53-29.27.1
       tomcat-lib-8.0.53-29.27.1
       tomcat-servlet-3_1-api-8.0.53-29.27.1
       tomcat-webapps-8.0.53-29.27.1
  o SUSE OpenStack Cloud 7 (noarch):
       tomcat-8.0.53-29.27.1
       tomcat-admin-webapps-8.0.53-29.27.1
       tomcat-docs-webapp-8.0.53-29.27.1
       tomcat-el-3_0-api-8.0.53-29.27.1
       tomcat-javadoc-8.0.53-29.27.1
       tomcat-jsp-2_3-api-8.0.53-29.27.1
       tomcat-lib-8.0.53-29.27.1
       tomcat-servlet-3_1-api-8.0.53-29.27.1
       tomcat-webapps-8.0.53-29.27.1
  o SUSE Linux Enterprise Server for SAP 12-SP3 (noarch):
       tomcat-8.0.53-29.27.1
       tomcat-admin-webapps-8.0.53-29.27.1
       tomcat-docs-webapp-8.0.53-29.27.1
       tomcat-el-3_0-api-8.0.53-29.27.1
       tomcat-javadoc-8.0.53-29.27.1
       tomcat-jsp-2_3-api-8.0.53-29.27.1
       tomcat-lib-8.0.53-29.27.1
       tomcat-servlet-3_1-api-8.0.53-29.27.1
       tomcat-webapps-8.0.53-29.27.1
  o SUSE Linux Enterprise Server for SAP 12-SP2 (noarch):
       tomcat-8.0.53-29.27.1
       tomcat-admin-webapps-8.0.53-29.27.1
       tomcat-docs-webapp-8.0.53-29.27.1
       tomcat-el-3_0-api-8.0.53-29.27.1
       tomcat-javadoc-8.0.53-29.27.1
       tomcat-jsp-2_3-api-8.0.53-29.27.1
       tomcat-lib-8.0.53-29.27.1
       tomcat-servlet-3_1-api-8.0.53-29.27.1
       tomcat-webapps-8.0.53-29.27.1
  o SUSE Linux Enterprise Server 12-SP3-LTSS (noarch):
       tomcat-8.0.53-29.27.1
       tomcat-admin-webapps-8.0.53-29.27.1
       tomcat-docs-webapp-8.0.53-29.27.1
       tomcat-el-3_0-api-8.0.53-29.27.1
       tomcat-javadoc-8.0.53-29.27.1
       tomcat-jsp-2_3-api-8.0.53-29.27.1
       tomcat-lib-8.0.53-29.27.1
       tomcat-servlet-3_1-api-8.0.53-29.27.1
       tomcat-webapps-8.0.53-29.27.1
  o SUSE Linux Enterprise Server 12-SP3-BCL (noarch):
       tomcat-8.0.53-29.27.1
       tomcat-admin-webapps-8.0.53-29.27.1
       tomcat-docs-webapp-8.0.53-29.27.1
       tomcat-el-3_0-api-8.0.53-29.27.1
       tomcat-javadoc-8.0.53-29.27.1
       tomcat-jsp-2_3-api-8.0.53-29.27.1
       tomcat-lib-8.0.53-29.27.1
       tomcat-servlet-3_1-api-8.0.53-29.27.1
       tomcat-webapps-8.0.53-29.27.1
  o SUSE Linux Enterprise Server 12-SP2-LTSS (noarch):
       tomcat-8.0.53-29.27.1
       tomcat-admin-webapps-8.0.53-29.27.1
       tomcat-docs-webapp-8.0.53-29.27.1
       tomcat-el-3_0-api-8.0.53-29.27.1
       tomcat-javadoc-8.0.53-29.27.1
       tomcat-jsp-2_3-api-8.0.53-29.27.1
       tomcat-lib-8.0.53-29.27.1
       tomcat-servlet-3_1-api-8.0.53-29.27.1
       tomcat-webapps-8.0.53-29.27.1
  o SUSE Linux Enterprise Server 12-SP2-BCL (noarch):
       tomcat-8.0.53-29.27.1
       tomcat-admin-webapps-8.0.53-29.27.1
       tomcat-docs-webapp-8.0.53-29.27.1
       tomcat-el-3_0-api-8.0.53-29.27.1
       tomcat-javadoc-8.0.53-29.27.1
       tomcat-jsp-2_3-api-8.0.53-29.27.1
       tomcat-lib-8.0.53-29.27.1
       tomcat-servlet-3_1-api-8.0.53-29.27.1
       tomcat-webapps-8.0.53-29.27.1
  o SUSE Enterprise Storage 5 (noarch):
       tomcat-8.0.53-29.27.1
       tomcat-admin-webapps-8.0.53-29.27.1
       tomcat-docs-webapp-8.0.53-29.27.1
       tomcat-el-3_0-api-8.0.53-29.27.1
       tomcat-javadoc-8.0.53-29.27.1
       tomcat-jsp-2_3-api-8.0.53-29.27.1
       tomcat-lib-8.0.53-29.27.1
       tomcat-servlet-3_1-api-8.0.53-29.27.1
       tomcat-webapps-8.0.53-29.27.1
  o HPE Helion Openstack 8 (noarch):
       tomcat-8.0.53-29.27.1
       tomcat-admin-webapps-8.0.53-29.27.1
       tomcat-docs-webapp-8.0.53-29.27.1
       tomcat-el-3_0-api-8.0.53-29.27.1
       tomcat-javadoc-8.0.53-29.27.1
       tomcat-jsp-2_3-api-8.0.53-29.27.1
       tomcat-lib-8.0.53-29.27.1
       tomcat-servlet-3_1-api-8.0.53-29.27.1
       tomcat-webapps-8.0.53-29.27.1


References:

  o https://www.suse.com/security/cve/CVE-2019-0221.html
  o https://www.suse.com/security/cve/CVE-2019-12418.html
  o https://www.suse.com/security/cve/CVE-2019-17563.html
  o https://www.suse.com/security/cve/CVE-2019-17569.html
  o https://www.suse.com/security/cve/CVE-2020-9484.html
  o https://bugzilla.suse.com/1136085
  o https://bugzilla.suse.com/1159723
  o https://bugzilla.suse.com/1159729
  o https://bugzilla.suse.com/1164825
  o https://bugzilla.suse.com/1171928

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXum4SeNLKJtyKPYoAQj71xAAgOKfo312ca1Qk4R0n9ecMhVG4PCoaE2d
wNurZbpaB5FOgy/UsurOh3jRmwAykIbnGgSZ9JWNuC8rbecvM9wHndgOo1iqkVnV
J4HRHXH13/g04ZLSW1539EuVQKIcH+EgdKkL+JOTMX1JRSdqR36BLdvM1Bm6eflj
kBxtbznhnNxHAnE1LU/hHAaecWkpYBvIwVdfRAewA17aNtNr9RcQDmnDp4SfgyYu
ZUTV89hShQy0mHdpbquIjVz/VXnrtWZrg3lHa8VftEf9y1itBDKP3uqF6eDB+QFR
BMkwV6AHchfLxf2GNscxeOB5wlEpSEgMTiDtbW059GCGuzO85fjYj6gKwc9wb5AD
4ZLQa/1MHaU7qmNdUPto9FzKcWZ/kDe/lcY/Wp79/Rdjri4kvKVePuEhQvQ5HGcw
0S/hTdu1wJW7gFoj2dUK73Edgl70++dUAraCeHhy7bPOB4S9Bcb0jAFclcSs/MAO
0fVdj7SbfuiwG0q/1/x/8smLkTFcRdwG2upuHRWpR8skJ2QWANuydevN0tDAg1CO
Fk4YaCLUA/a4G1ApEpksUwK90Cg30Q3eI+B+AGba7ixLGkqej5XLZ6Wht19NDoqQ
Gt38AqzBlDVlqXfqdz7bb6r/qXL3wF5Af8K4XOKmwnJQgGzC7e4ysnd0cPV4AIU/
y4hXNOUq9JA=
=gBSI
-----END PGP SIGNATURE-----