tomcat-7.0.76-15.el7

エラータID: AXSA:2020-627:03

Release date: 
Thursday, October 8, 2020 - 00:26
Subject: 
tomcat-7.0.76-15.el7
Affected Channels: 
Asianux Server 7 for x86_64
Severity: 
High
Description: 

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS (CVE-2020-13935)

* tomcat: session fixation when using FORM authentication (CVE-2019-17563)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution: 

Update packages.

CVEs: 
CVE-2019-17563
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
CVE-2020-13935
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
Additional Info: 

N/A

Download: 

SRPMS
  1. tomcat-7.0.76-15.el7.src.rpm
    MD5: d88214e87aa6c5b6d62da21baf565395
    SHA-256: 59fac5d7a9fbe26d36f5a5c2ca269b1789f8a25cb372a4a8ae21f43d3940418f
    Size: 4.61 MB

Asianux Server 7 for x86_64
  1. tomcat-7.0.76-15.el7.noarch.rpm
    MD5: bc1e2ffd9b26217fb294eb40a5555062
    SHA-256: 6b21741113867ba997e536a921b50e09c1a9fc4bb0d24c565576ad4f1e2d0261
    Size: 92.17 kB
  2. tomcat-admin-webapps-7.0.76-15.el7.noarch.rpm
    MD5: 71e9e2bbacf987c79df43cf5c54854ed
    SHA-256: d66b2e792053c2358e164540f953156aeb7bc9bd6d8cd360cf4462932284bc4c
    Size: 40.31 kB
  3. tomcat-el-2.2-api-7.0.76-15.el7.noarch.rpm
    MD5: 1f8f5c0b2f7bd958290c882b8aab20a3
    SHA-256: cd9197d13f2af6c40f4a65caac666e6c0cb98cc5f93d058a624c3d30acbfd9c2
    Size: 81.55 kB
  4. tomcat-jsp-2.2-api-7.0.76-15.el7.noarch.rpm
    MD5: 44fb3a18373641fffdc020bcb3f6b594
    SHA-256: ab64047dbcdbf105e5a4972acc529c35508ce92c04ac8bb82ec364cd0b003df6
    Size: 95.27 kB
  5. tomcat-lib-7.0.76-15.el7.noarch.rpm
    MD5: 67514a4f6533efc4d3fbaeddb0b4f72c
    SHA-256: 179a35338257d91f5f5d9555563c803caa452ff670bde44bf181d09a42702957
    Size: 3.86 MB
  6. tomcat-servlet-3.0-api-7.0.76-15.el7.noarch.rpm
    MD5: f763f5deb5dcee9c511f6676b5e7f82f
    SHA-256: bd3aa1388fa058b30cc63dd89676a8a6860de23da039713c883370e346e892b9
    Size: 212.64 kB
  7. tomcat-webapps-7.0.76-15.el7.noarch.rpm
    MD5: 702081adaed6823cc4f0cd7955e32eec
    SHA-256: c5884990a91ab43bdca24dee367a3217de9bd3fd550061c903066975e2eb82f1
    Size: 341.06 kB