DSA-4680: -1 tomcat9 -- security update

Published May 6, 2020

Updated

Several vulnerabilities were discovered in the Tomcat servlet and JSP engine, which could result in HTTP request smuggling, code execution in the AJP connector (disabled by default in Debian) or a man-in-the-middle attack against the JMX interface.

Affected Software

2 affected components

debian/tomcat9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tomcat9 to a version that resolves this vulnerability.
Patch DSA-4680-1

Event History

May 6, 2020

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments are most exposed to the AJP-related code execution issue?

Deployments with the Tomcat AJP connector enabled are exposed to this issue. The AJP connector is disabled by default in Debian, so default Debian configurations are not affected by that specific exposure.

What access or position would an attacker need for the JMX issue?

The JMX issue requires an attacker to be in a position to conduct a man-in-the-middle attack against the JMX interface.

Are the listed issues limited to a single attack type?

No. The update addresses vulnerabilities that could lead to HTTP request smuggling, code execution through the AJP connector, or a man-in-the-middle attack against JMX.