ALAS-2017-913


Amazon Linux AMI Security Advisory: ALAS-2017-913
Advisory Release Date: 2017-10-26 22:56 Pacific
Severity: Important
References: CVE-2017-12617 

Issue Overview:

A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution. (CVE-2017-12617 )


Affected Packages:

tomcat8,tomcat80,tomcat7


Issue Correction:
Run yum update tomcat8 to update your system.
Run yum update tomcat80 to update your system.
Run yum update tomcat7 to update your system.

New Packages:
noarch:
    tomcat8-admin-webapps-8.5.23-1.75.amzn1.noarch
    tomcat8-javadoc-8.5.23-1.75.amzn1.noarch
    tomcat8-el-3.0-api-8.5.23-1.75.amzn1.noarch
    tomcat8-docs-webapp-8.5.23-1.75.amzn1.noarch
    tomcat8-log4j-8.5.23-1.75.amzn1.noarch
    tomcat8-webapps-8.5.23-1.75.amzn1.noarch
    tomcat8-8.5.23-1.75.amzn1.noarch
    tomcat8-jsp-2.3-api-8.5.23-1.75.amzn1.noarch
    tomcat8-lib-8.5.23-1.75.amzn1.noarch
    tomcat8-servlet-3.1-api-8.5.23-1.75.amzn1.noarch
    tomcat80-8.0.47-1.78.amzn1.noarch
    tomcat80-log4j-8.0.47-1.78.amzn1.noarch
    tomcat80-jsp-2.3-api-8.0.47-1.78.amzn1.noarch
    tomcat80-admin-webapps-8.0.47-1.78.amzn1.noarch
    tomcat80-webapps-8.0.47-1.78.amzn1.noarch
    tomcat80-el-3.0-api-8.0.47-1.78.amzn1.noarch
    tomcat80-lib-8.0.47-1.78.amzn1.noarch
    tomcat80-servlet-3.1-api-8.0.47-1.78.amzn1.noarch
    tomcat80-docs-webapp-8.0.47-1.78.amzn1.noarch
    tomcat80-javadoc-8.0.47-1.78.amzn1.noarch
    tomcat7-javadoc-7.0.82-1.30.amzn1.noarch
    tomcat7-7.0.82-1.30.amzn1.noarch
    tomcat7-lib-7.0.82-1.30.amzn1.noarch
    tomcat7-admin-webapps-7.0.82-1.30.amzn1.noarch
    tomcat7-webapps-7.0.82-1.30.amzn1.noarch
    tomcat7-log4j-7.0.82-1.30.amzn1.noarch
    tomcat7-el-2.2-api-7.0.82-1.30.amzn1.noarch
    tomcat7-docs-webapp-7.0.82-1.30.amzn1.noarch
    tomcat7-jsp-2.2-api-7.0.82-1.30.amzn1.noarch
    tomcat7-servlet-3.0-api-7.0.82-1.30.amzn1.noarch

src:
    tomcat8-8.5.23-1.75.amzn1.src
    tomcat80-8.0.47-1.78.amzn1.src
    tomcat7-7.0.82-1.30.amzn1.src