Advisories » MGASA-2016-0312

Updated tomcat packages fix security vulnerability

Publication date: 21 Sep 2016
Modification date: 21 Sep 2016
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-5388

Description

Apache Tomcat through 8.5.4, when the CGI Servlet is enabled, follows RFC
3875 section 4.1.18 and therefore does not protect applications from the
presence of untrusted client data in the HTTP_PROXY environment variable,
which might allow remote attackers to redirect an application's outbound
HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an
HTTP request, aka an "httpoxy" issue (CVE-2016-5388).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=19306
• http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5388

SRPMS

5/core

• tomcat-7.0.68-1.3.mga5