Synopsis

Important: tomcat5 and tomcat6 security update

Type/Severity

Security Advisory: Important

Topic

Updated tomcat5 and tomcat6 packages that fix one security issue are now
available for JBoss Enterprise Web Server 1.0.1 for Red Hat Enterprise
Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

Description

Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.

A flaw was found in the way Tomcat handled the Transfer-Encoding header in
HTTP requests. A specially-crafted HTTP request could prevent Tomcat from
sending replies, or cause Tomcat to return truncated replies, or replies
containing data related to the requests of other users, for all subsequent
HTTP requests. (CVE-2010-2227)

Users of Tomcat should upgrade to these updated packages, which contain a
backported patch to resolve this issue. Tomcat must be restarted for this
update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• JBoss Enterprise Web Server 1 for RHEL 5 x86_64
• JBoss Enterprise Web Server 1 for RHEL 5 i386

Fixes

• BZ - 612799 - CVE-2010-2227 tomcat: information leak vulnerability in the handling of 'Transfer-Encoding' header

CVEs

• CVE-2010-2227

References

• http://www.redhat.com/security/updates/classification/#important
• http://tomcat.apache.org/security-5.html
• http://tomcat.apache.org/security-6.html

JBoss Enterprise Web Server 1 for RHEL 5

SRPM
tomcat5-5.5.28-9.patch_01.1.jdk6.ep5.el5.src.rpm	SHA-256: 7dd87c36b2895e692b3efc7525f96c17983a3dedd1c919f33544806e327d8f5f
tomcat6-6.0.24-7.patch_01.jdk6.ep5.el5.src.rpm	SHA-256: 1653a933f83b7dd66388f14d99767cb12e842ebfd3874c170e80c29a9d655788
x86_64
tomcat5-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 93d8bb087140a6edd9736e33c89135c8a23cafcae63847829050dc2b08b9c3a5
tomcat5-admin-webapps-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: b96cc77798019e8d25b6d9f9c1dbc7e126a7c4be8d25054968dee8e3987530aa
tomcat5-common-lib-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: c6403df4cb61d559337b4221f1b4693ec41f9f3015f7e1d7718f21efb15b51a6
tomcat5-jasper-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 19182e7aef7a2aded52b15edcda6072ad6531247dc7382677cc2041f2eb3f9ab
tomcat5-jasper-eclipse-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: f577f902a1664d5ab73f98b5869f58c1ba2411ae4b9fb3e1588db4a539f4644d
tomcat5-jasper-javadoc-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 7aaef79a3a82b757e08a025cb32b8c16c07313f7af049312069e43f1afdd9c88
tomcat5-jsp-2.0-api-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: ce2f71966257780799517ffdd0feaa9d12905caa8168a17996f3cf74b0d465b1
tomcat5-jsp-2.0-api-javadoc-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 2856628e31a83d05c73f5424e7958838acd97b4569e3987acf5c40e066dfb4c7
tomcat5-parent-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 851a74c374af87162ca467074a9a0b3a9ef6ae44e4e03548c4e3214e39619ef0
tomcat5-server-lib-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: b442ca1f44a9673883d66d6dd6765b99338c57403a3b2cb700d15da712e7361e
tomcat5-servlet-2.4-api-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 96e6dfd086aa67fc224f787afc5eccf98c713ce124f00d020c20507f1fc4b35e
tomcat5-servlet-2.4-api-javadoc-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 1c574cc622a0bf3b2c4cc355b038dd2f01484cd560c89d376193f6b83c3061b0
tomcat5-webapps-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: d75ff8b64c7bb594c3a9294741d142162a577ad1c8ffe1d1872e2eb635917aa8
tomcat6-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: 2d57281beccb2a50a69921de10c9207d5e825c32b303bb02e0020e981b2966b5
tomcat6-admin-webapps-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: b0a569befcb847b4dd7227f62632fbcda6e87565848ee6bba1e11448aba45109
tomcat6-docs-webapp-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: 9b645e9883b2072699db2811733b7c8c1b248488176027ad37eb7f69a03dc4e8
tomcat6-el-1.0-api-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: e20095f277d6adfc4c718865fdd893e7be209f91990e14fa6a55072f5430e9d9
tomcat6-javadoc-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: 5cb22a12417aaf648362c766a816a9e1ab7214b105ec4d2181910b3330ff9754
tomcat6-jsp-2.1-api-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: e6f807b568148e279a3a4127209595c963d2b4a7be20930ee1771a9b05badf88
tomcat6-lib-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: b95d635f7d66df58554aa33bf5dc16494f587620242d35e5a1bf54cd2c3a2ead
tomcat6-log4j-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: f22e907423ec66700560376c7c49e69d30a6504fad8a25d09aafdeb44a381f45
tomcat6-servlet-2.5-api-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: 756700f16e44d29cf2faef46edabe9e3b1376dce96f2e3d78b024b2feebced1e
tomcat6-webapps-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: 5b9dd0530794ec511a024a70dd746c81a89247f33e9c9bee7c9b62d59878a61e
i386
tomcat5-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 93d8bb087140a6edd9736e33c89135c8a23cafcae63847829050dc2b08b9c3a5
tomcat5-admin-webapps-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: b96cc77798019e8d25b6d9f9c1dbc7e126a7c4be8d25054968dee8e3987530aa
tomcat5-common-lib-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: c6403df4cb61d559337b4221f1b4693ec41f9f3015f7e1d7718f21efb15b51a6
tomcat5-jasper-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 19182e7aef7a2aded52b15edcda6072ad6531247dc7382677cc2041f2eb3f9ab
tomcat5-jasper-eclipse-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: f577f902a1664d5ab73f98b5869f58c1ba2411ae4b9fb3e1588db4a539f4644d
tomcat5-jasper-javadoc-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 7aaef79a3a82b757e08a025cb32b8c16c07313f7af049312069e43f1afdd9c88
tomcat5-jsp-2.0-api-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: ce2f71966257780799517ffdd0feaa9d12905caa8168a17996f3cf74b0d465b1
tomcat5-jsp-2.0-api-javadoc-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 2856628e31a83d05c73f5424e7958838acd97b4569e3987acf5c40e066dfb4c7
tomcat5-parent-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 851a74c374af87162ca467074a9a0b3a9ef6ae44e4e03548c4e3214e39619ef0
tomcat5-server-lib-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: b442ca1f44a9673883d66d6dd6765b99338c57403a3b2cb700d15da712e7361e
tomcat5-servlet-2.4-api-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 96e6dfd086aa67fc224f787afc5eccf98c713ce124f00d020c20507f1fc4b35e
tomcat5-servlet-2.4-api-javadoc-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: 1c574cc622a0bf3b2c4cc355b038dd2f01484cd560c89d376193f6b83c3061b0
tomcat5-webapps-5.5.28-9.patch_01.1.jdk6.ep5.el5.noarch.rpm	SHA-256: d75ff8b64c7bb594c3a9294741d142162a577ad1c8ffe1d1872e2eb635917aa8
tomcat6-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: 2d57281beccb2a50a69921de10c9207d5e825c32b303bb02e0020e981b2966b5
tomcat6-admin-webapps-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: b0a569befcb847b4dd7227f62632fbcda6e87565848ee6bba1e11448aba45109
tomcat6-docs-webapp-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: 9b645e9883b2072699db2811733b7c8c1b248488176027ad37eb7f69a03dc4e8
tomcat6-el-1.0-api-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: e20095f277d6adfc4c718865fdd893e7be209f91990e14fa6a55072f5430e9d9
tomcat6-javadoc-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: 5cb22a12417aaf648362c766a816a9e1ab7214b105ec4d2181910b3330ff9754
tomcat6-jsp-2.1-api-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: e6f807b568148e279a3a4127209595c963d2b4a7be20930ee1771a9b05badf88
tomcat6-lib-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: b95d635f7d66df58554aa33bf5dc16494f587620242d35e5a1bf54cd2c3a2ead
tomcat6-log4j-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: f22e907423ec66700560376c7c49e69d30a6504fad8a25d09aafdeb44a381f45
tomcat6-servlet-2.5-api-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: 756700f16e44d29cf2faef46edabe9e3b1376dce96f2e3d78b024b2feebced1e
tomcat6-webapps-6.0.24-7.patch_01.jdk6.ep5.el5.noarch.rpm	SHA-256: 5b9dd0530794ec511a024a70dd746c81a89247f33e9c9bee7c9b62d59878a61e