[ubuntu/focal-security] tomcat9 9.0.31-1ubuntu0.2 (Accepted)
Paulo Flabiano Smorigo
pfsmorigo at canonical.com
Thu Mar 31 13:09:08 UTC 2022
tomcat9 (9.0.31-1ubuntu0.2) focal-security; urgency=medium
* SECURITY UPDATE: TLS Denial of Service
- debian/patches/CVE-2021-41079.patch: Apache Tomcat did not properly
validate incoming TLS packets. When Tomcat was configured to use
NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be
used to trigger an infinite loop resulting in a denial of service.
* SECURITY UPDATE: Authentication Vulnerability
- debian/patches/CVE-2021-30640.patch: A vulnerability in the JNDI Realm
of Apache Tomcat allows an attacker to authenticate using variations of
a validc user name and/or to bypass some of the protection provided by
the LockOut Realm.
* SECURITY UPDATE: Request Smuggling
- debian/patches/CVE-2021-33037.patch: Apache Tomcat did not correctly
parse the HTTP transfer-encoding request header in some circumstances
leading to the possibility to request smuggling when used with a reverse
proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding
header if the client declared it would only accept an HTTP/1.0 response;
- Tomcat honoured the identify encoding; and - Tomcat did not ensure
that, if present, the chunked encoding was the final encoding.
* SECURITY UPDATE: remote code execution via session persistence
- debian/patches/CVE-2021-25329.patch: The fix for CVE-2020-9484 was
incomplete. When using Apache Tomcat with a configuration edge case that
was highly unlikely to be used, the Tomcat instance was still vulnerable
to CVE-2020-9494. Note that both the previously published prerequisites
for CVE-2020-9484 and the previously published mitigations for
CVE-2020-9484 also apply to this issue.
* SECURITY UPDATE: Request Header Duplication
- debian/patches/CVE-2021-25122.patch: When responding to new h2c
connection requests, Apache Tomcat could duplicate request headers and a
limited amount of request body from one request to another meaning user
A and user B could both see the results of user A's request.
* SECURITY UPDATE: HTTP/2 request header mix-up
- debian/patches/CVE-2020-17527.patch: HTTP/2 It was discovered that
Apache Tomcat could re-use an HTTP request header value from the previous
stream received on an HTTP/2 connection for the request associated with
the subsequent stream. While this would most likely lead to an error and
the closure of the HTTP/2 connection, it is possible that information
could leak between requests.
* SECURITY UPDATE: HTTP/2 request mix-up
- debian/patches/CVE-2020-13943.patch: If an HTTP/2 client exceeded the
agreed maximum number of concurrent streams for a connection (in
violation of the HTTP/2 protocol), it was possible that a subsequent
request made on that connection could contain HTTP headers - including
HTTP/2 pseudo headers - from a previous request rather than the intended
headers. This could lead to users seeing responses for unexpected
Date: 2022-03-29 19:01:10.636130+00:00
Changed-By: Evren Yurtesen <eyurtese at abo.fi>
Signed-By: Paulo Flabiano Smorigo <pfsmorigo at canonical.com>
-------------- next part --------------
Sorry, changesfile not available.
More information about the Focal-changes