tomcat-7.0.54-8.el7

Tomcat is the servlet container that is used in the official Reference
Implementation for the Java Servlet and JavaServer Pages technologies.
The Java Servlet and JavaServer Pages specifications are developed by
Sun under the Java Community Process.

Tomcat is developed in an open and participatory environment and
released under the Apache Software License version 2.0. Tomcat is intended
to be a collaboration of the best-of-breed developers from around the world.

Security issues fixed with this release:

CVE-2014-7810
The Expression Language (EL) implementation in Apache Tomcat 6.x
before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not
properly consider the possibility of an accessible interface
implemented by an inaccessible class, which allows attackers to bypass
a SecurityManager protection mechanism via a web application that
leverages use of incorrect privileges during EL evaluation.
CVE-2015-5346
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x
before 8.0.30, and 9.x before 9.0.0.M2, when different session
settings are used for deployments of multiple versions of the same web
application, might allow remote attackers to hijack web sessions by
leveraging use of a requestedSessionSSL field for an unintended
request, related to CoyoteAdapter.java and Request.java.
CVE-2016-5388
Apache Tomcat through 8.5.4, when the CGI Servlet is enabled, follows
RFC 3875 section 4.1.18 and therefore does not protect applications
from the presence of untrusted client data in the HTTP_PROXY
environment variable, which might allow remote attackers to redirect
an application's outbound HTTP traffic to an arbitrary proxy server
via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
NOTE: the vendor states "A mitigation is planned for future releases
of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a
CVE ID for a vulnerability.
CVE-2016-5425
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2016-6325
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.