Advisories ยป MGASA-2017-0352

Updated tomcat packages fix security vulnerability

Publication date: 21 Sep 2017
Modification date: 21 Sep 2017
Type: security
Affected Mageia releases : 5 , 6
CVE: CVE-2017-7674 , CVE-2017-12616


The CORS Filter did not add an HTTP Vary header indicating that the
response varies depending on Origin. This permitted client and server
side cache poisoning in some circumstances (CVE-2017-7674).

When using a VirtualDirContext it was possible to bypass security
constraints and/or view the source code of JSPs for resources served
by the VirtualDirContext using a specially crafted request

Note that CVE-2017-12616 only affected tomcat 7 in Mageia 5.