Synopsis

Moderate: tomcat7 security update

Type/Severity

Security Advisory: Moderate

Topic

Updated tomcat7 packages that fix one security issue are now available for
JBoss Enterprise Web Server 2.0.0 for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Apache Tomcat is a servlet container.

It was found that sending a request without a session identifier to a
protected resource could bypass the Cross-Site Request Forgery (CSRF)
prevention filter. A remote attacker could use this flaw to perform
CSRF attacks against applications that rely on the CSRF prevention filter
and do not contain internal mitigation for CSRF. (CVE-2012-4431)

Warning: Before applying the update, back up your existing JBoss Enterprise
Web Server installation (including all applications and configuration
files).

Users of Tomcat should upgrade to these updated packages, which resolve
this issue. Tomcat must be restarted for this update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• JBoss Enterprise Web Server 2 for RHEL 6 x86_64
• JBoss Enterprise Web Server 2 for RHEL 6 i386
• JBoss Enterprise Web Server 2 for RHEL 5 x86_64
• JBoss Enterprise Web Server 2 for RHEL 5 i386

Fixes

• BZ - 883636 - CVE-2012-4431 Tomcat/JBoss Web - Bypass of CSRF prevention filter

CVEs

• CVE-2012-4431

References

• https://access.redhat.com/security/updates/classification/#moderate
• http://tomcat.apache.org/security-7.html

JBoss Enterprise Web Server 2 for RHEL 6

SRPM
tomcat7-7.0.30-5_patch_02.ep6.el6.src.rpm	SHA-256: 836b2ffb9debef3091d2f0a57d86e7fec3abec7a135104cdd983d64d7f79822c
x86_64
tomcat7-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: d5da0b18f690f5113b73997625ae71e5998dc7092b4282472447ebf3904d9615
tomcat7-admin-webapps-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: d6088def93474629eeecfc2f453aab081012a7a28c5e91019d39e71e4c1be97c
tomcat7-docs-webapp-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: 7336bb430b912845239cac593b9843d078be9a2823a385fcc8264f8889a57b64
tomcat7-el-1.0-api-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: 928ca45b255c047da98b5d402871702ad5aa523b2b2f9b056b94e478d6071ea1
tomcat7-javadoc-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: fc0d6b78b5afcdeed769931e2b93eec56d0fd7adfb25b7c22d40985fbceec06c
tomcat7-jsp-2.2-api-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: 1b26ea9e5d9a71d1e108d753da5195b8949bb43394d0a7751f71e711c5651abe
tomcat7-lib-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: dd6a4b8950847402b5cecdd1512a1fe43ff368620a643ba6ad340a01cf07aa05
tomcat7-log4j-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: 2a61ce918a6c8e525c62035958c66b3ac4973a542765731c95d91adb3ad39a84
tomcat7-servlet-3.0-api-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: c58f6dfd198414820a65a3dbdf54a178243b79e675468232402fc4d7e4eee2c8
tomcat7-webapps-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: a0f3f63aed4d85682a8e3f81d6077e36554a574ec11908cdda93d0076fe3f7d5
i386
tomcat7-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: d5da0b18f690f5113b73997625ae71e5998dc7092b4282472447ebf3904d9615
tomcat7-admin-webapps-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: d6088def93474629eeecfc2f453aab081012a7a28c5e91019d39e71e4c1be97c
tomcat7-docs-webapp-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: 7336bb430b912845239cac593b9843d078be9a2823a385fcc8264f8889a57b64
tomcat7-el-1.0-api-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: 928ca45b255c047da98b5d402871702ad5aa523b2b2f9b056b94e478d6071ea1
tomcat7-javadoc-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: fc0d6b78b5afcdeed769931e2b93eec56d0fd7adfb25b7c22d40985fbceec06c
tomcat7-jsp-2.2-api-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: 1b26ea9e5d9a71d1e108d753da5195b8949bb43394d0a7751f71e711c5651abe
tomcat7-lib-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: dd6a4b8950847402b5cecdd1512a1fe43ff368620a643ba6ad340a01cf07aa05
tomcat7-log4j-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: 2a61ce918a6c8e525c62035958c66b3ac4973a542765731c95d91adb3ad39a84
tomcat7-servlet-3.0-api-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: c58f6dfd198414820a65a3dbdf54a178243b79e675468232402fc4d7e4eee2c8
tomcat7-webapps-7.0.30-5_patch_02.ep6.el6.noarch.rpm	SHA-256: a0f3f63aed4d85682a8e3f81d6077e36554a574ec11908cdda93d0076fe3f7d5

JBoss Enterprise Web Server 2 for RHEL 5

SRPM
tomcat7-7.0.30-3_patch_02.ep6.el5.src.rpm	SHA-256: 2f7cd6f708ed65bb2e0c128b37793d8c40d055e661395149f1fd6ce7e71aa016
x86_64
tomcat7-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: 35c2499e279f0a4cd22c4b09057d2840e264caa16fd2c5c3db567ef2e7853dcb
tomcat7-admin-webapps-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: 364e3a2b2366bd58d80c02fe2cac4a0d455f3ff33a724f7fa429a1c527bb006e
tomcat7-docs-webapp-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: 866446e8ab4933cd94dc2258da6fbc0816098ab93f16c7dac517230de2a75ea8
tomcat7-el-1.0-api-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: eb801cb16a878a20aec19258acb8fd2f133e0fb9754c98355ae0f408616b5cb1
tomcat7-javadoc-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: c4bcfdda97add4e35820124445a951f0c57f17fa224c390878d9950e22f0df3e
tomcat7-jsp-2.2-api-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: bf393f19121364dc6876d9e24ba296259c15a8ae9fea309e0302ff64ff3707d6
tomcat7-lib-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: a2ffef5ecdfc599f4bf7be537395575c4060b4bbf98065621c1c9a968616e1f7
tomcat7-log4j-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: 1720062a570aae3ba2ef3e1db665d7356cb5b38527c9dff9c61c1e27cf44b8c2
tomcat7-servlet-3.0-api-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: 4322351db49b54cf7b5eb1ab891fec8249f96bd51906c1ebd473aa606963a6cf
tomcat7-webapps-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: 7f0237756f931a2e67e2e4d36533e692f66fb733268b3e6b94e2f9a96c43cb28
i386
tomcat7-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: 35c2499e279f0a4cd22c4b09057d2840e264caa16fd2c5c3db567ef2e7853dcb
tomcat7-admin-webapps-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: 364e3a2b2366bd58d80c02fe2cac4a0d455f3ff33a724f7fa429a1c527bb006e
tomcat7-docs-webapp-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: 866446e8ab4933cd94dc2258da6fbc0816098ab93f16c7dac517230de2a75ea8
tomcat7-el-1.0-api-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: eb801cb16a878a20aec19258acb8fd2f133e0fb9754c98355ae0f408616b5cb1
tomcat7-javadoc-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: c4bcfdda97add4e35820124445a951f0c57f17fa224c390878d9950e22f0df3e
tomcat7-jsp-2.2-api-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: bf393f19121364dc6876d9e24ba296259c15a8ae9fea309e0302ff64ff3707d6
tomcat7-lib-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: a2ffef5ecdfc599f4bf7be537395575c4060b4bbf98065621c1c9a968616e1f7
tomcat7-log4j-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: 1720062a570aae3ba2ef3e1db665d7356cb5b38527c9dff9c61c1e27cf44b8c2
tomcat7-servlet-3.0-api-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: 4322351db49b54cf7b5eb1ab891fec8249f96bd51906c1ebd473aa606963a6cf
tomcat7-webapps-7.0.30-3_patch_02.ep6.el5.noarch.rpm	SHA-256: 7f0237756f931a2e67e2e4d36533e692f66fb733268b3e6b94e2f9a96c43cb28