Debian Security Advisory

DLA-1883-1 tomcat8 -- LTS security update

Date Reported:

13 Aug 2019

Affected Packages:

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 929895, Bug 898935.
In Mitre's CVE dictionary: CVE-2016-5388, CVE-2018-8014, CVE-2019-0221.

More information:

Several minor issues have been fixed in tomcat8, a Java Servlet and JSP engine.

CVE-2016-5388
Apache Tomcat, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an httpoxy issue. The cgi servlet now has a envHttpHeaders parameter to filter environment variables.
CVE-2018-8014
The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable supportsCredentials for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
CVE-2019-0221
The SSI printenv command in Apache Tomcat echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.

For Debian 8 Jessie, these problems have been fixed in version 8.0.14-1+deb8u15.

We recommend that you upgrade your tomcat8 packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS