-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: tomcat security, bug fix, and enhancement update
Advisory ID:       RHSA-2016:2599-02
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2016-2599.html
Issue date:        2016-11-03
CVE Names:         CVE-2015-5174 CVE-2015-5345 CVE-2015-5351 
                   CVE-2016-0706 CVE-2016-0714 CVE-2016-0763 
                   CVE-2016-3092 
=====================================================================

1. Summary:

An update for tomcat is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - noarch
Red Hat Enterprise Linux Client Optional (v. 7) - noarch
Red Hat Enterprise Linux ComputeNode (v. 7) - noarch
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch
Red Hat Enterprise Linux Server (v. 7) - noarch
Red Hat Enterprise Linux Server Optional (v. 7) - noarch
Red Hat Enterprise Linux Workstation (v. 7) - noarch
Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch

3. Description:

Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.

The following packages have been upgraded to a newer upstream version:
tomcat (7.0.69). (BZ#1287928)

Security Fix(es):

* A CSRF flaw was found in Tomcat's the index pages for the Manager and
Host Manager applications. These applications included a valid CSRF token
when issuing a redirect as a result of an unauthenticated request to the
root of the web application. This token could then be used by an attacker
to perform a CSRF attack. (CVE-2015-5351)

* It was found that several Tomcat session persistence mechanisms could
allow a remote, authenticated user to bypass intended SecurityManager
restrictions and execute arbitrary code in a privileged context via a web
application that placed a crafted object in a session. (CVE-2016-0714)

* A security manager bypass flaw was found in Tomcat that could allow
remote, authenticated users to access arbitrary application data,
potentially resulting in a denial of service. (CVE-2016-0763)

* A denial of service vulnerability was identified in Commons FileUpload
that occurred when the length of the multipart boundary was just below the
size of the buffer (4096 bytes) used to read the uploaded file if the
boundary was the typical tens of bytes long. (CVE-2016-3092)

* A directory traversal flaw was found in Tomcat's RequestUtil.java. A
remote, authenticated user could use this flaw to bypass intended
SecurityManager restrictions and list a parent directory via a '/..' in a
pathname used by a web application in a getResource, getResourceAsStream,
or getResourcePaths call. (CVE-2015-5174)

* It was found that Tomcat could reveal the presence of a directory even
when that directory was protected by a security constraint. A user could
make a request to a directory via a URL not ending with a slash and,
depending on whether Tomcat redirected that request, could confirm whether
that directory existed. (CVE-2015-5345)

* It was found that Tomcat allowed the StatusManagerServlet to be loaded by
a web application when a security manager was configured. This allowed a
web application to list all deployed web applications and expose sensitive
information such as session IDs. (CVE-2016-0706)

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.3 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1133070 - Need to include full implementation of tomcat-juli.jar and tomcat-juli-adapters.jar
1201409 - Fix the broken tomcat-jsvc service unit
1208402 - Mark web.xml in tomcat-admin-webapps as config file
1221896 - tomcat.service loads /etc/sysconfig/tomcat without shell expansion
1229476 - Tomcat startup ONLY options
1240279 - The command tomcat-digest doesn't work with RHEL 7
1265698 - CVE-2015-5174 tomcat: URL Normalization issue
1277197 - tomcat user has non-existing default shell set
1287928 - Rebase tomcat to 7.0.69 or backport features
1311076 - CVE-2015-5351 tomcat: CSRF token leak
1311082 - CVE-2016-0714 tomcat: Security Manager bypass via persistence mechanisms
1311087 - CVE-2016-0706 tomcat: security manager bypass via StatusManagerServlet
1311089 - CVE-2015-5345 tomcat: directory disclosure
1311093 - CVE-2016-0763 tomcat: security manager bypass via setGlobalContext()
1311622 - Getting NoSuchElementException while handling attributes with empty string value in tomcat 7.0.54
1320853 - Add HSTS support
1327326 - rpm -V tomcat fails on /var/log/tomcat/catalina.out
1347774 - The security manager doesn't work correctly (JSPs cannot be compiled)
1347860 - The systemd service unit does not allow tomcat to shut down gracefully
1349468 - CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
tomcat-7.0.69-10.el7.src.rpm

noarch:
tomcat-servlet-3.0-api-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-docs-webapp-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-javadoc-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsvc-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
tomcat-7.0.69-10.el7.src.rpm

noarch:
tomcat-servlet-3.0-api-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-docs-webapp-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-javadoc-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsvc-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
tomcat-7.0.69-10.el7.src.rpm

noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-servlet-3.0-api-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-docs-webapp-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-javadoc-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsvc-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
tomcat-7.0.69-10.el7.src.rpm

noarch:
tomcat-7.0.69-10.el7.noarch.rpm
tomcat-admin-webapps-7.0.69-10.el7.noarch.rpm
tomcat-el-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-jsp-2.2-api-7.0.69-10.el7.noarch.rpm
tomcat-lib-7.0.69-10.el7.noarch.rpm
tomcat-servlet-3.0-api-7.0.69-10.el7.noarch.rpm
tomcat-webapps-7.0.69-10.el7.noarch.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

noarch:
tomcat-docs-webapp-7.0.69-10.el7.noarch.rpm
tomcat-javadoc-7.0.69-10.el7.noarch.rpm
tomcat-jsvc-7.0.69-10.el7.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2015-5174
https://access.redhat.com/security/cve/CVE-2015-5345
https://access.redhat.com/security/cve/CVE-2015-5351
https://access.redhat.com/security/cve/CVE-2016-0706
https://access.redhat.com/security/cve/CVE-2016-0714
https://access.redhat.com/security/cve/CVE-2016-0763
https://access.redhat.com/security/cve/CVE-2016-3092
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFYGv0mXlSAg2UNWIIRAq74AJ9mIwnepxw2jbrHnfK3Gkc+N7uMIACfXM+E
5lVH/+qu5TZIB819MY4FTO0=
=u+za
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce