Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
Red Hat Customer Portal
  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
  • Products & Services

    Products

    Support

    • Production Support
    • Development Support
    • Product Life Cycles

    Services

    • Consulting
    • Technical Account Management
    • Training & Certifications

    Documentation

    • Red Hat Enterprise Linux
    • Red Hat JBoss Enterprise Application Platform
    • Red Hat OpenStack Platform
    • Red Hat OpenShift Container Platform
    All Documentation

    Ecosystem Catalog

    • Red Hat Partner Ecosystem
    • Partner Resources
  • Tools

    Tools

    • Troubleshoot a product issue
    • Packages
    • Errata

    Customer Portal Labs

    • Configuration
    • Deployment
    • Security
    • Troubleshoot
    All labs

    Red Hat Insights

    Increase visibility into IT operations to detect and resolve technical issues before they impact your business.

    Learn More
    Go to Insights
  • Security

    Red Hat Product Security Center

    Engage with our Red Hat Product Security team, access security updates, and ensure your environments are not exposed to any known security vulnerabilities.

    Product Security Center

    Security Updates

    • Security Advisories
    • Red Hat CVE Database
    • Security Labs

    Keep your systems secure with Red Hat's specialized responses to security vulnerabilities.

    View Responses

    Resources

    • Security Blog
    • Security Measurement
    • Severity Ratings
    • Backporting Policies
    • Product Signing (GPG) Keys
  • Community

    Customer Portal Community

    • Discussions
    • Private Groups
    Community Activity

    Customer Events

    • Red Hat Convergence
    • Red Hat Summit

    Stories

    • Red Hat Subscription Value
    • You Asked. We Acted.
    • Open Source Communities
Or troubleshoot an issue.

Select Your Language

  • English
  • 한국어
  • 日本語
  • 中文 (中国)

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Virtualization
  • Red Hat Identity Management
  • Red Hat Directory Server
  • Red Hat Certificate System
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Update Infrastructure
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat CloudForms
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Online
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • Red Hat CodeReady Workspaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Thorntail
  • Red Hat build of Eclipse Vert.x
  • Red Hat build of OpenJDK
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Integration
  • Red Hat Fuse
  • Red Hat AMQ
  • Red Hat 3scale API Management
  • Red Hat JBoss Data Virtualization
  • Red Hat Process Automation
  • Red Hat Process Automation Manager
  • Red Hat Decision Manager
All Products
Red Hat Product Errata RHSA-2016:2807 - Security Advisory
Issued:
2016-11-17
Updated:
2016-11-17

RHSA-2016:2807 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Important: Red Hat JBoss Web Server 2.1.2 security update for Tomcat 7

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Web Server 2 for RHEL 6 and Red Hat JBoss Enterprise Web Server 2 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

This release of Red Hat JBoss Web Server 2.1.2 serves as a replacement for Red Hat JBoss Web Server 2.1.1. It contains security fixes for the Tomcat 7 component. Only users of the Tomcat 7 component in JBoss Web Server need to apply the fixes delivered in this release.

Security Fix(es):

  • A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)
  • It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)
  • A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)
  • A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)
  • A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)
  • It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)

Solution

Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 2 for RHEL 7 x86_64
  • JBoss Enterprise Web Server 2 for RHEL 6 x86_64
  • JBoss Enterprise Web Server 2 for RHEL 6 i386

Fixes

  • BZ - 1311076 - CVE-2015-5351 tomcat: CSRF token leak
  • BZ - 1311082 - CVE-2016-0714 tomcat: Security Manager bypass via persistence mechanisms
  • BZ - 1311085 - CVE-2015-5346 tomcat: Session fixation
  • BZ - 1311087 - CVE-2016-0706 tomcat: security manager bypass via StatusManagerServlet
  • BZ - 1311093 - CVE-2016-0763 tomcat: security manager bypass via setGlobalContext()
  • BZ - 1349468 - CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service

CVEs

  • CVE-2015-5346
  • CVE-2015-5351
  • CVE-2016-0706
  • CVE-2016-0714
  • CVE-2016-0763
  • CVE-2016-3092

References

  • https://access.redhat.com/security/updates/classification/#important
Note: More recent versions of these packages may be available. Click a package name for more details.

JBoss Enterprise Web Server 2 for RHEL 7

SRPM
tomcat7-7.0.54-23_patch_05.ep6.el7.src.rpm SHA-256: 1edad745c0043717a8c6581a9258b9d3c995c662d0953a125e28cc84a9bdb179
x86_64
tomcat7-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: e3717d138e7bb946d671cedcc594431783bb7fb377912764d5eb81dad2ae2216
tomcat7-admin-webapps-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: 925cab8be71b88e6883ab3e12fe2dd40659924ee40039fc6a96840b41d688059
tomcat7-docs-webapp-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: dd1569ad00fa9d931914fee96dc19f24f098f79b54d30ae6c01d23e6852fc18f
tomcat7-el-2.2-api-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: 85a2671f748b1c039eb898d51372a36f0aefa219431267b6d6a9f88894e34dbd
tomcat7-javadoc-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: 505a4a543f4a817b183fc4f7ce39ce0e7fb8a7c2b7770b767ada95a265a33b9a
tomcat7-jsp-2.2-api-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: bce56bf00a2fb29dc1039f354e11c11036b5d3fd266c4b8a5dcdc4dfe175491c
tomcat7-lib-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: cc1a64fb5902775f6d01fa40c44bf223575608a586fa57fceed871e541d3f222
tomcat7-log4j-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: e35d0054b4d59133c3adbc6cbe970c18eb6f5a69e80f628e609f4897b6c1ec6b
tomcat7-maven-devel-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: f3407b0d52cb2cfa887f0b6d28dedd633f90bfa6eeb7fbabea4322d7b555901d
tomcat7-servlet-3.0-api-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: d8c13c3b53f35d149ba97af8ec9f61d7dd8129f1067f40dc8faf9fe182f2466c
tomcat7-webapps-7.0.54-23_patch_05.ep6.el7.noarch.rpm SHA-256: f902164df4628c104a6e2d33daa35bf1370412de21dc9f5aa31bd843e404bdf7

JBoss Enterprise Web Server 2 for RHEL 6

SRPM
tomcat7-7.0.54-23_patch_05.ep6.el6.src.rpm SHA-256: c0e3e66ba11ecd2204f4612548fe1b00abe8f2049fecca4e594841ce445e86cc
x86_64
tomcat7-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 91dece641d64b97085722bdd738dece9da95367c7b2c385cfdcd94384831e872
tomcat7-admin-webapps-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 5ac04a420f277df602a1d08b117827f16d7db8fc1261dc992099e7b397ab5ef6
tomcat7-docs-webapp-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 04d35b58186c60b62bab9124d7234dcdbac50458e904187ce6293a334c228551
tomcat7-el-2.2-api-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 5718f9109a6d7e5e2ddbaaeade9e410a935ff065e461f9202c12a238b1e41de6
tomcat7-javadoc-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 23764d283a1a3b235a41845aa9fcd9f0642c604ea8715828e61e676ccc070416
tomcat7-jsp-2.2-api-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 98385e1bf436c2555ffb0cce8617c623d7a43881f549f8b80c6276323ecb689a
tomcat7-lib-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 8e5f9bf37e91e116c31c12b72d74e9b99643feadb9d662e7322bd13d48bebcdb
tomcat7-log4j-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 00731baeba3eb0819302068c453552492916ff0d36f478c98336cbe05232ae5f
tomcat7-maven-devel-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: caea84bbf24812dcc8e48a7ac8f63cfa4f262bb7b461314ca191e8a1bd251cd0
tomcat7-servlet-3.0-api-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 8729b4c7cb3c2f8dee4f79dea389843ee9a87785e11b9a7b91ed121f08eb4c7a
tomcat7-webapps-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: b121b561ffc4ee44f5f8e1dd1a01a564c377a4a567411bac933c316aab8f51bb
i386
tomcat7-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 91dece641d64b97085722bdd738dece9da95367c7b2c385cfdcd94384831e872
tomcat7-admin-webapps-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 5ac04a420f277df602a1d08b117827f16d7db8fc1261dc992099e7b397ab5ef6
tomcat7-docs-webapp-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 04d35b58186c60b62bab9124d7234dcdbac50458e904187ce6293a334c228551
tomcat7-el-2.2-api-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 5718f9109a6d7e5e2ddbaaeade9e410a935ff065e461f9202c12a238b1e41de6
tomcat7-javadoc-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 23764d283a1a3b235a41845aa9fcd9f0642c604ea8715828e61e676ccc070416
tomcat7-jsp-2.2-api-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 98385e1bf436c2555ffb0cce8617c623d7a43881f549f8b80c6276323ecb689a
tomcat7-lib-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 8e5f9bf37e91e116c31c12b72d74e9b99643feadb9d662e7322bd13d48bebcdb
tomcat7-log4j-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 00731baeba3eb0819302068c453552492916ff0d36f478c98336cbe05232ae5f
tomcat7-maven-devel-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: caea84bbf24812dcc8e48a7ac8f63cfa4f262bb7b461314ca191e8a1bd251cd0
tomcat7-servlet-3.0-api-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: 8729b4c7cb3c2f8dee4f79dea389843ee9a87785e11b9a7b91ed121f08eb4c7a
tomcat7-webapps-7.0.54-23_patch_05.ep6.el6.noarch.rpm SHA-256: b121b561ffc4ee44f5f8e1dd1a01a564c377a4a567411bac933c316aab8f51bb

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Red Hat

Quick Links

  • Downloads
  • Subscriptions
  • Support Cases
  • Customer Service
  • Product Documentation

Help

  • Contact Us
  • Customer Portal FAQ
  • Log-in Assistance

Site Info

  • Trust Red Hat
  • Browser Support Policy
  • Accessibility
  • Awards and Recognition
  • Colophon

Related Sites

  • redhat.com
  • developers.redhat.com
  • connect.redhat.com
  • cloud.redhat.com

About

  • Red Hat Subscription Value
  • About Red Hat
  • Red Hat Jobs
2023
  • Privacy Statement
  • Customer Portal Terms of Use
  • All Policies and Guidelines
Twitter Facebook