Advisories » MGASA-2023-0138

Updated tomcat packages fix security vulnerability

Publication date: 15 Apr 2023
Modification date: 15 Apr 2023
Type: security
Affected Mageia releases : 8
CVE: CVE-2021-43980 , CVE-2022-23181 , CVE-2022-29885 , CVE-2022-34305 , CVE-2022-42252 , CVE-2022-45143 , CVE-2023-24998 , CVE-2023-28708

Description

Information disclosure due to concurrency bug (CVE-2021-43980)
Fix for CVE-2020-9484 introduced a time of check, time of use
vulnerability (CVE-2022-23181)
Correct documentation to warn of use over untrusted networks.
(CVE-2022-29885)
Correct documentation showing use of XSS vulnerability. (CVE-2022-34305)
Fix to reject invalid Content-Length header (CVE-2022-42252)
Fix escaping of the type, message or description values. (CVE-2022-45143)
Fix FileUpload limiting of the number of request parts to be processed
to prevent the possibility of an attacker triggering a DoS (CVE-2023-24998)
Fix setting of session cookie secure attribute when using RemoteIpFilter
with X-Forwarded-Proto header set to https (CVE-2023-28708)
Obsolete tomcat-jsvc
                

References

• https://bugs.mageia.org/show_bug.cgi?id=30113
• https://lists.suse.com/pipermail/sle-security-updates/2022-March/010339.html
• https://lists.suse.com/pipermail/sle-security-updates/2022-April/010734.html
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.65
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.62
• https://www.debian.org/lts/security/2022/dla-3160
• https://www.debian.org/security/2022/dsa-5265
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.68
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.69
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.71
• https://lists.suse.com/pipermail/sle-security-updates/2023-March/014018.html
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.72
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43980
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23181
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29885
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34305
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42252
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45143
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24998
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28708

SRPMS

8/core

• tomcat-9.0.73-1.1.mga8