ALAS-2017-862


Amazon Linux AMI Security Advisory: ALAS-2017-862
Advisory Release Date: 2017-08-31 23:17 Pacific
Severity: Important

Issue Overview:

Security constrained bypass in error page mechanism:
A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. (CVE-2017-5664 )

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances. (CVE-2017-7674 )


Affected Packages:

tomcat8


Issue Correction:
Run yum update tomcat8 to update your system.

New Packages:
noarch:
    tomcat8-webapps-8.0.45-1.72.amzn1.noarch
    tomcat8-docs-webapp-8.0.45-1.72.amzn1.noarch
    tomcat8-8.0.45-1.72.amzn1.noarch
    tomcat8-javadoc-8.0.45-1.72.amzn1.noarch
    tomcat8-lib-8.0.45-1.72.amzn1.noarch
    tomcat8-servlet-3.1-api-8.0.45-1.72.amzn1.noarch
    tomcat8-admin-webapps-8.0.45-1.72.amzn1.noarch
    tomcat8-el-3.0-api-8.0.45-1.72.amzn1.noarch
    tomcat8-jsp-2.3-api-8.0.45-1.72.amzn1.noarch
    tomcat8-log4j-8.0.45-1.72.amzn1.noarch

src:
    tomcat8-8.0.45-1.72.amzn1.src