[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 779-1] tomcat7 security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package        : tomcat7
Version        : 7.0.28-4+deb7u9
CVE ID         : CVE-2016-8745
Debian Bug     : 849949

A bug in the error handling of the send file code for the NIO HTTP
connector resulted in the current Processor object being added to the
Processor cache multiple times. This in turn meant that the same
Processor could be used for concurrent requests. Sharing a Processor
can result in information leakage between requests including, not
limited to, session ID and the response body.

In addition this update also addresses a regression when running
Tomcat 7 with SecurityManager enabled due to an incomplete fix for
CVE-2016-6816.

For Debian 7 "Wheezy", these problems have been fixed in version
7.0.28-4+deb7u9.

We recommend that you upgrade your tomcat7 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAlh1cCpfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeQpmg//dnHKU2B2sAjkPqOWI/mhfx/f6oIwvvafPwX8TlJV1sD8VkcxFhvRZEN0
Twgi7vwQPRg5tej8AUjJ6WfCcCVYx9l9+0YwFvKNN0nLEORCG1DUCB+VFLMWpLx9
VLJ+dYaS4AxcBFyBA1QEGmIZrbSHXCFw874N+R05XtIZMW2+AQ4n3DwYslDFEMBM
sYmjqOHV1lKNmF+e9dmTgNk1+hGBIhAH5VQvuSSdjomTPG91/D0gfVP+dCXVxQ6z
kuHXsEqR/7TuNoYQs4falw9NL69p8BEkUoHfwBL3W0KmzcPR40zGOs8H/q2PJkwW
FHm8jd03MZL8bNlycWqrgCTy/JB56iL3Xa7GHCrNn10iGMchxSTwQdxmOLUWOk09
nDrkLuXS0VgsqkXV6JpWaJm/U3y3U2lg7UbbLZjDg4t1G9+AbCpU2B0gLr7RMQHh
tZm/VR29aor9dNpyP6/k0xvfjBFFU/q4UZiWYKzYe1w0pfrvPPrhWkE6md8gA27F
fCSv0D+VPhdVJbrkJcEYI2nKN4n7It6w95sxddKc6wFBZ9F2L19j7P30/koPyU6D
+4F+fKAzhHN+Tc/TdBPMdqwXThgFJI+KTAzrtixhDA228mpPUSOkBCzbhNHuSJhG
VKdo4D+6XBvoEiFLDrhSKlUylydx8xuJzhLAluBh2SepTpA6amI=
=4zrd
-----END PGP SIGNATURE-----


Reply to: