[ubuntu/lucid-updates] tomcat6 6.0.24-2ubuntu1.15 (Accepted)
Ubuntu Archive Robot
cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk
Thu Mar 6 13:58:21 UTC 2014
tomcat6 (6.0.24-2ubuntu1.15) lucid-security; urgency=medium
* SECURITY UPDATE: request smuggling attack via content-length headers
- debian/patches/CVE-2013-4286.patch: handle multiple content lengths
in java/org/apache/coyote/ajp/AbstractAjpProcessor.java,
java/org/apache/coyote/ajp/AjpProcessor.java, handle content length
and chunked encoding being both specified in
java/org/apache/coyote/http11/Http11AprProcessor.java,
java/org/apache/coyote/http11/Http11NioProcessor.java,
java/org/apache/coyote/http11/Http11Processor.java.
- CVE-2013-4286
* SECURITY UPDATE: denial of service via chunked transfer coding
- debian/patches/CVE-2013-4322.patch: limit length of extension data in
java/org/apache/coyote/Constants.java,
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java,
webapps/docs/config/systemprops.xml.
- CVE-2013-4322
Date: 2014-03-05 20:12:18.295140+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk>
https://launchpad.net/ubuntu/lucid/+source/tomcat6/6.0.24-2ubuntu1.15
-------------- next part --------------
Sorry, changesfile not available.
More information about the Lucid-changes
mailing list