Amazon Linux 1 Security Advisory: ALAS-2017-903
Advisory Release Date: 2017-10-02 16:47 Pacific
Advisory Updated Date: 2017-10-02 21:44 Pacific
Severity:
Medium
Issue Overview:
1480618:
Vary header not added by CORS filter leading to cache poisoning
The CORS Filter in Apache Tomcat did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances. (CVE-2017-7674)
Affected Packages:
tomcat7, tomcat8
Issue Correction:
Run yum update tomcat7 to update your system.
Run yum update tomcat8 to update your system.
New Packages:
noarch:
tomcat7-7.0.81-1.29.amzn1.noarch
tomcat7-lib-7.0.81-1.29.amzn1.noarch
tomcat7-webapps-7.0.81-1.29.amzn1.noarch
tomcat7-javadoc-7.0.81-1.29.amzn1.noarch
tomcat7-servlet-3.0-api-7.0.81-1.29.amzn1.noarch
tomcat7-docs-webapp-7.0.81-1.29.amzn1.noarch
tomcat7-log4j-7.0.81-1.29.amzn1.noarch
tomcat7-el-2.2-api-7.0.81-1.29.amzn1.noarch
tomcat7-jsp-2.2-api-7.0.81-1.29.amzn1.noarch
tomcat7-admin-webapps-7.0.81-1.29.amzn1.noarch
tomcat8-servlet-3.1-api-8.0.46-1.76.amzn1.noarch
tomcat8-docs-webapp-8.0.46-1.76.amzn1.noarch
tomcat8-el-3.0-api-8.0.46-1.76.amzn1.noarch
tomcat8-log4j-8.0.46-1.76.amzn1.noarch
tomcat8-webapps-8.0.46-1.76.amzn1.noarch
tomcat8-8.0.46-1.76.amzn1.noarch
tomcat8-admin-webapps-8.0.46-1.76.amzn1.noarch
tomcat8-javadoc-8.0.46-1.76.amzn1.noarch
tomcat8-jsp-2.3-api-8.0.46-1.76.amzn1.noarch
tomcat8-lib-8.0.46-1.76.amzn1.noarch
src:
tomcat7-7.0.81-1.29.amzn1.src
tomcat8-8.0.46-1.76.amzn1.src