DSA-4673: -1 tomcat8 -- security update

Published May 3, 2020

Updated

Several vulnerabilities were discovered in the Tomcat servlet and JSP engine, which could result in HTTP request smuggling and code execution in the AJP connector (disabled by default in Debian).

Affected Software

2 affected components

debian/tomcat8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tomcat8 to a version that resolves this vulnerability.
Patch DSA-4673-1

Event History

May 3, 2020

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments are most exposed to the code execution issue?

Deployments with the AJP connector enabled are exposed to the code execution risk. The AJP connector is disabled by default in Debian, so default Debian configurations are not affected by that connector issue unless it has been enabled.

What can be done if the update cannot be applied immediately?

Disable the AJP connector if it is enabled. This removes exposure to the AJP-related code execution issue described in the advisory.

Are the HTTP request smuggling issues limited to AJP-enabled configurations?

The provided advisory identifies HTTP request smuggling separately from the AJP connector code execution issue, but does not state which configurations are affected by the request smuggling vulnerabilities.