Zero-friction vulnerability management platform

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

Debian Security Advisory DSA 2897-1 (tomcat7 - security update)

Information

Severity

Severity

High

Family

Family

Debian Local Security Checks

CVSSv2 Base

CVSSv2 Base

7.5

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Solution Type

Solution Type

Vendor Patch

Created

Created

8 years ago

Modified

Modified

10 months ago

Summary

Multiple security issues were found in the Tomcat servlet and JSP engine: CVE-2013-2067 FORM authentication associates the most recent request requiring authentication with the current session. By repeatedly sending a request for an authenticated resource while the victim is completing the login form, an attacker could inject a request that would be executed using the victim's credentials. CVE-2013-2071 A runtime exception in AsyncListener.onComplete() prevents the request from being recycled. This may expose elements of a previous request to a current request. CVE-2013-4286 Reject requests with multiple content-length headers or with a content-length header when chunked encoding is being used. CVE-2013-4322 When processing a request submitted using the chunked transfer encoding, Tomcat ignored but did not limit any extensions that were included. This allows a client to perform a limited denial of service by streaming an unlimited amount of data to the server. CVE-2014-0050 Multipart requests with a malformed Content-Type header could trigger an infinite loop causing a denial of service.

Affected Software

Affected Software

tomcat7 on Debian Linux

Detection Method

Detection Method

This check tests the installed software version using the apt package manager.

Solution

Solution

For the stable distribution (wheezy), these problems have been fixed in version 7.0.28-4+deb7u1. For the testing distribution (jessie), these problems have been fixed in version 7.0.52-1. For the unstable distribution (sid), these problems have been fixed in version 7.0.52-1. We recommend that you upgrade your tomcat7 packages.

Common Vulnerabilities and Exposures (CVE)