[Bug 1449975] Re: Outstanding low priority security bugs in the tomcat7 packages

Launchpad Bug Tracker 1449975 at bugs.launchpad.net
Thu Jun 25 12:01:05 UTC 2015


This bug was fixed in the package tomcat7 - 7.0.52-1ubuntu0.3

---------------
tomcat7 (7.0.52-1ubuntu0.3) trusty-security; urgency=medium

  * SECURITY UPDATE: arbitrary file disclosure via XML parser
    (LP: #1449975)
    - debian/patches/CVE-2014-0119.patch: add defensive coding and ensure
      TLD parser obtained from cache has correct value of blockExternal in
      java/org/apache/catalina/security/SecurityClassLoad.java,
      java/org/apache/catalina/servlets/DefaultServlet.java,
      java/org/apache/catalina/startup/TldConfig.java,
      java/org/apache/jasper/compiler/JspDocumentParser.java,
      java/org/apache/jasper/xmlparser/ParserUtils.java,
      java/org/apache/tomcat/util/security/PrivilegedGetTccl.java,
      java/org/apache/tomcat/util/security/PrivilegedSetTccl.java.
    - CVE-2014-0119
  * SECURITY UPDATE: HTTP request smuggling or denial of service via
    streaming with malformed chunked transfer encoding (LP: #1449975)
    - debian/patches/CVE-2014-0227.patch: add error flag and improve i18n
      in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java,
      java/org/apache/coyote/http11/filters/LocalStrings.properties.
    - CVE-2014-0227
  * SECURITY UPDATE: denial of service via aborted upload attempts
    (LP: #1449975)
    - debian/patches/CVE-2014-0230.patch: limit amount of data in
      java/org/apache/coyote/http11/AbstractHttp11Processor.java,
      java/org/apache/coyote/http11/AbstractHttp11Protocol.java,
      java/org/apache/coyote/http11/Http11AprProcessor.java,
      java/org/apache/coyote/http11/Http11AprProtocol.java,
      java/org/apache/coyote/http11/Http11NioProcessor.java,
      java/org/apache/coyote/http11/Http11NioProtocol.java,
      java/org/apache/coyote/http11/Http11Processor.java,
      java/org/apache/coyote/http11/Http11Protocol.java,
      java/org/apache/coyote/http11/filters/ChunkedInputFilter.java,
      java/org/apache/coyote/http11/filters/IdentityInputFilter.java,
      java/org/apache/coyote/http11/filters/LocalStrings.properties,
      test/org/apache/catalina/core/TestSwallowAbortedUploads.java,
      webapps/docs/config/http.xml.
    - CVE-2014-0230
  * SECURITY UPDATE: SecurityManager bypass via Expression Language
    - debian/patches/CVE-2014-7810.patch: handle classes that may not be
      accessible but have accessible interfaces in
      java/javax/el/BeanELResolver.java, remove unnecessary code in
      java/org/apache/jasper/runtime/PageContextImpl.java,
      java/org/apache/jasper/security/SecurityClassLoad.java.
    - CVE-2014-7810
  * Replace expired ssl certs and use TLS to fix tests causing FTBFS:
    - debian/patches/0022-use-tls-in-ssl-unit-tests.patch
    - debian/patches/0023-replace-expired-ssl-certificates.patch
    - debian/source/include-binaries

 -- Marc Deslauriers <marc.deslauriers at ubuntu.com>  Fri, 19 Jun 2015
12:30:21 -0400

** Changed in: tomcat7 (Ubuntu)
       Status: Triaged => Fix Released

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2014-7810

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1449975

Title:
  Outstanding low priority security bugs in the tomcat7 packages

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tomcat7/+bug/1449975/+subscriptions



More information about the Ubuntu-server-bugs mailing list