DSA-4596: -1 tomcat8 -- security update

Published Dec 27, 2019

Updated

Several issues were discovered in the Tomcat servlet and JSP engine, which could result in session fixation attacks, information disclosure, cross-site scripting, denial of service via resource exhaustion and insecure redirects.

Affected Software

2 affected components

debian/tomcat8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tomcat8 to a version that resolves this vulnerability.
Patch DSA-4596-1

Event History

Dec 27, 2019

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What types of impact should be considered during triage?

The reported issues can enable session fixation, information disclosure, cross-site scripting, denial of service through resource exhaustion, and insecure redirects. The practical impact will depend on which affected Tomcat functionality is exposed and used.

Which CVEs are associated with this update?

The update references CVE-2018-8014, CVE-2018-11784, and CVE-2019-0199.