Debian Security Advisory
DLA-1883-1 tomcat8 -- LTS security update
- Date Reported:
- 13 Aug 2019
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 929895, Bug 898935.
In Mitre's CVE dictionary: CVE-2016-5388, CVE-2018-8014, CVE-2019-0221.
- More information:
Several minor issues have been fixed in tomcat8, a Java Servlet and JSP engine.
Apache Tomcat, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an
cgiservlet now has a
envHttpHeadersparameter to filter environment variables.
The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable
supportsCredentialsfor all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
The SSI printenv command in Apache Tomcat echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
For Debian 8
Jessie, these problems have been fixed in version 8.0.14-1+deb8u15.
We recommend that you upgrade your tomcat8 packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS