- Vulnerability/
- RHSA-2017:3081
RHSA-2017:3081: Important: tomcat security update
First published: Sun Oct 29 2017(Updated: )
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.<br>Security Fix(es):<br><li> A vulnerability was discovered in Tomcat's handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)</li> <li> Two vulnerabilities were discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution. (CVE-2017-12615, CVE-2017-12617)</li> <li> A vulnerability was discovered in Tomcat where the CORS Filter did not send a "Vary: Origin" HTTP header. This potentially allowed sensitive data to be leaked to other visitors through both client-side and server-side caches. (CVE-2017-7674)</li>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/tomcat | <7.0.76-3.el7_4 | 7.0.76-3.el7_4 |
| redhat/tomcat | <7.0.76-3.el7_4 | 7.0.76-3.el7_4 |
| redhat/tomcat-admin-webapps | <7.0.76-3.el7_4 | 7.0.76-3.el7_4 |
| redhat/tomcat-docs-webapp | <7.0.76-3.el7_4 | 7.0.76-3.el7_4 |
| redhat/tomcat-el | <2.2-api-7.0.76-3.el7_4 | 2.2-api-7.0.76-3.el7_4 |
| redhat/tomcat-javadoc | <7.0.76-3.el7_4 | 7.0.76-3.el7_4 |
| redhat/tomcat-jsp | <2.2-api-7.0.76-3.el7_4 | 2.2-api-7.0.76-3.el7_4 |
| redhat/tomcat-jsvc | <7.0.76-3.el7_4 | 7.0.76-3.el7_4 |
| redhat/tomcat-lib | <7.0.76-3.el7_4 | 7.0.76-3.el7_4 |
| redhat/tomcat-servlet | <3.0-api-7.0.76-3.el7_4 | 3.0-api-7.0.76-3.el7_4 |
| redhat/tomcat-webapps | <7.0.76-3.el7_4 | 7.0.76-3.el7_4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of RHSA-2017:3081?
The severity of RHSA-2017:3081 is classified as important.
What software is affected by RHSA-2017:3081?
RHSA-2017:3081 affects various packages of Apache Tomcat version 7.0.76-3.el7_4.
How do I fix RHSA-2017:3081?
To fix RHSA-2017:3081, update your Apache Tomcat installation to the fixed version 7.0.76-3.el7_4 or higher.
What vulnerability does RHSA-2017:3081 address?
RHSA-2017:3081 addresses a vulnerability related to Tomcat's handling of pipelined requests when using the Sendfile feature.
When was RHSA-2017:3081 released?
RHSA-2017:3081 was released on December 21, 2017.
- agent/severity
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/title
- agent/description
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2017:3081
- agent/software-canonical-lookup
- agent/remedy
- agent/references
- agent/tags
- agent/event
- agent/source
- package-manager/redhat