Debian Security Advisory

DSA-3974-1 tomcat8 -- security update

Date Reported:
15 Sep 2017
Affected Packages:
Security database references:
In the Debian bugtracking system: Bug 802312.
In Mitre's CVE dictionary: CVE-2017-7674, CVE-2017-7675.
More information:

Two issues were discovered in the Tomcat servlet and JSP engine.

  • CVE-2017-7674

    Rick Riemer discovered that the Cross-Origin Resource Sharing filter did not add a Vary header indicating possible different responses, which could lead to cache poisoning.

  • CVE-2017-7675 (stretch only)

    Markus Dörschmidt found that the HTTP/2 implementation bypassed some security checks, thus allowing an attacker to conduct directory traversal attacks by using specially crafted URLs.

For the oldstable distribution (jessie), these problems have been fixed in version 8.0.14-1+deb8u11.

For the stable distribution (stretch), these problems have been fixed in version 8.5.14-1+deb9u2.

We recommend that you upgrade your tomcat8 packages.