Debian Security Advisory
DSA-3974-1 tomcat8 -- security update
- Date Reported:
- 15 Sep 2017
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 802312.
In Mitre's CVE dictionary: CVE-2017-7674, CVE-2017-7675.
- More information:
Two issues were discovered in the Tomcat servlet and JSP engine.
Rick Riemer discovered that the Cross-Origin Resource Sharing filter did not add a Vary header indicating possible different responses, which could lead to cache poisoning.
- CVE-2017-7675 (stretch only)
Markus Dörschmidt found that the HTTP/2 implementation bypassed some security checks, thus allowing an attacker to conduct directory traversal attacks by using specially crafted URLs.
For the oldstable distribution (jessie), these problems have been fixed in version 8.0.14-1+deb8u11.
For the stable distribution (stretch), these problems have been fixed in version 8.5.14-1+deb9u2.
We recommend that you upgrade your tomcat8 packages.