Amazon Linux 1 Security Advisory: ALAS-2017-913
Advisory Release Date: 2017-10-26 16:29 Pacific
Advisory Updated Date: 2017-10-26 22:56 Pacific
Severity:
Important
Issue Overview:
A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution. (CVE-2017-12617)
Affected Packages:
tomcat8, tomcat80, tomcat7
Issue Correction:
Run yum update tomcat8 to update your system.
Run yum update tomcat80 to update your system.
Run yum update tomcat7 to update your system.
New Packages:
noarch:
tomcat8-admin-webapps-8.5.23-1.75.amzn1.noarch
tomcat8-javadoc-8.5.23-1.75.amzn1.noarch
tomcat8-el-3.0-api-8.5.23-1.75.amzn1.noarch
tomcat8-docs-webapp-8.5.23-1.75.amzn1.noarch
tomcat8-log4j-8.5.23-1.75.amzn1.noarch
tomcat8-webapps-8.5.23-1.75.amzn1.noarch
tomcat8-8.5.23-1.75.amzn1.noarch
tomcat8-jsp-2.3-api-8.5.23-1.75.amzn1.noarch
tomcat8-lib-8.5.23-1.75.amzn1.noarch
tomcat8-servlet-3.1-api-8.5.23-1.75.amzn1.noarch
tomcat80-8.0.47-1.78.amzn1.noarch
tomcat80-log4j-8.0.47-1.78.amzn1.noarch
tomcat80-jsp-2.3-api-8.0.47-1.78.amzn1.noarch
tomcat80-admin-webapps-8.0.47-1.78.amzn1.noarch
tomcat80-webapps-8.0.47-1.78.amzn1.noarch
tomcat80-el-3.0-api-8.0.47-1.78.amzn1.noarch
tomcat80-lib-8.0.47-1.78.amzn1.noarch
tomcat80-servlet-3.1-api-8.0.47-1.78.amzn1.noarch
tomcat80-docs-webapp-8.0.47-1.78.amzn1.noarch
tomcat80-javadoc-8.0.47-1.78.amzn1.noarch
tomcat7-javadoc-7.0.82-1.30.amzn1.noarch
tomcat7-7.0.82-1.30.amzn1.noarch
tomcat7-lib-7.0.82-1.30.amzn1.noarch
tomcat7-admin-webapps-7.0.82-1.30.amzn1.noarch
tomcat7-webapps-7.0.82-1.30.amzn1.noarch
tomcat7-log4j-7.0.82-1.30.amzn1.noarch
tomcat7-el-2.2-api-7.0.82-1.30.amzn1.noarch
tomcat7-docs-webapp-7.0.82-1.30.amzn1.noarch
tomcat7-jsp-2.2-api-7.0.82-1.30.amzn1.noarch
tomcat7-servlet-3.0-api-7.0.82-1.30.amzn1.noarch
src:
tomcat8-8.5.23-1.75.amzn1.src
tomcat80-8.0.47-1.78.amzn1.src
tomcat7-7.0.82-1.30.amzn1.src