エラータID: AXSA:2020-136:02

Release date: 
Friday, June 12, 2020 - 04:42
Affected Channels: 
Asianux Server 4 for x86_64
Asianux Server 4 for x86

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: deserialization flaw in session persistence storage leading to RCE (CVE-2020-9484)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.


Update packages.

Additional Info: 



  1. tomcat6-6.0.24-115.AXS4.src.rpm
    MD5: 8d908fde6ff9c6d4ad3591debd07be80
    SHA-256: 802b38ba8c287e2a9fccda394c758dd134a4790d695b733a4faae605f4f1dfbd
    Size: 3.66 MB

Asianux Server 4 for x86
  1. tomcat6-6.0.24-115.AXS4.noarch.rpm
    MD5: 259ddb7b07523148e4d0c9f790a5cbb4
    SHA-256: efd1bfbd2dfbea242be18309a3b3d82f4cd9929b8eb6a4aa8a85e3f8f8f32fff
    Size: 96.23 kB
  2. tomcat6-el-2.1-api-6.0.24-115.AXS4.noarch.rpm
    MD5: ab3102ca89d56c5e290390580cc1574f
    SHA-256: fc664750996299d025f2b4b8133be3fd850aba65b88e7c51c0c483b6e1227758
    Size: 52.03 kB
  3. tomcat6-jsp-2.1-api-6.0.24-115.AXS4.noarch.rpm
    MD5: 0d1eda3e30fb9e084398c9614a075627
    SHA-256: 3b5a513dc0ac85b215bfdc932d43b31b1badad38781b45b3fc672083608f7e86
    Size: 88.48 kB
  4. tomcat6-lib-6.0.24-115.AXS4.noarch.rpm
    MD5: bc90db0f8f15cb2a8b2a5e34a7324b65
    SHA-256: 1ca6db269a41c93afee2e011c0553adce15269427f6d1db40afe187e1f3e43f0
    Size: 2.92 MB
  5. tomcat6-servlet-2.5-api-6.0.24-115.AXS4.noarch.rpm
    MD5: 81c71d43880f21929a09dfd6fec9de8a
    SHA-256: a7b0473dbef3257a8da08c609fd57a50614f61c559f425818d7460b955b93654
    Size: 122.51 kB

Asianux Server 4 for x86_64
  1. tomcat6-6.0.24-115.AXS4.noarch.rpm
    MD5: c354dfad651c1888f0338f8b801bd31a
    SHA-256: acd26c1fed8f78aa9d9ca593a483974ad8ede7b395663b6d582aee1b2b5f6c94
    Size: 95.79 kB
  2. tomcat6-el-2.1-api-6.0.24-115.AXS4.noarch.rpm
    MD5: d3419acc4c9cad7c28c44542b2280ce5
    SHA-256: 0f3d19306511129fd4014a2b31b2a6dba644143bf94ff96811deb05f0542838c
    Size: 51.57 kB
  3. tomcat6-jsp-2.1-api-6.0.24-115.AXS4.noarch.rpm
    MD5: 37a2027b98cd4f33d20961c0321cc273
    SHA-256: 783c343769c5f653f4f73284ff21843989b52af75658762885c0b73420bfc091
    Size: 88.02 kB
  4. tomcat6-lib-6.0.24-115.AXS4.noarch.rpm
    MD5: 994d544c19b2c25a4fc293a554d9d42b
    SHA-256: 655128559b96c197440cf5bd0d3633dd276b3c6be2faaf33c9265142ad467f3e
    Size: 2.92 MB
  5. tomcat6-servlet-2.5-api-6.0.24-115.AXS4.noarch.rpm
    MD5: 7e8dac9051580e2e47e3e5f629ea9286
    SHA-256: 2e81f89dd4fb7bf46d439405f5fb2e270f57f01331e5b5327c1dcd9f56b5694b
    Size: 122.05 kB