Oval Definition:oval:org.opensuse.security:def:53394
Revision Date:2020-12-01Version:1
Title:Security update for tomcat (Moderate)
Description:

This update for tomcat to version 9.0.10 fixes the following issues:

Security issues fixed:

- CVE-2018-1336: An improper handing of overflow in the UTF-8 decoder with supplementary characters could have lead to an infinite loop in the decoder causing a Denial of Service (bsc#1102400). - CVE-2018-8014: Fix insecure default CORS filter settings (bsc#1093697). - CVE-2018-8034: The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default (bsc#1102379). - CVE-2018-8037: If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could have resulted in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also have resulted in a user seeing a response intended for another user (bsc#1102410).

Bug fixes:

- Avoid overwriting of customer's configuration during update (bsc#1067720) - Disable adding OSGi metadata to JAR files

- See changelog at http://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.10_(markt)
Family:unixClass:patch
Status:Reference(s):1000106
1003030
1003032
1003870
1004016
1005004
1005005
1007157
1007160
1009100
1009103
1009104
1009107
1009108
1009109
1009111
1011652
1017646
1019416
1024416
1024989
1027147
1044337
1067720
1093697
1102379
1102400
1102410
1162689
1162691
1167373
1169659
1170313
909479
927841
935863
935876
939342
940084
940188
958791
963017
993692
993707
CVE-2006-2607
CVE-2009-1720
CVE-2009-1721
CVE-2010-0424
CVE-2011-0904
CVE-2011-0905
CVE-2011-1164
CVE-2012-2673
CVE-2014-3467
CVE-2014-3468
CVE-2014-3469
CVE-2015-2806
CVE-2015-3228
CVE-2015-3310
CVE-2015-3622
CVE-2015-5621
CVE-2015-8025
CVE-2015-8540
CVE-2016-10087
CVE-2016-4008
CVE-2016-7777
CVE-2016-7908
CVE-2016-7909
CVE-2016-7995
CVE-2016-8576
CVE-2016-8667
CVE-2016-8669
CVE-2016-8909
CVE-2016-8910
CVE-2016-9377
CVE-2016-9378
CVE-2016-9379
CVE-2016-9380
CVE-2016-9381
CVE-2016-9382
CVE-2016-9383
CVE-2016-9385
CVE-2016-9386
CVE-2016-9427
CVE-2016-9637
CVE-2016-9811
CVE-2017-0663
CVE-2017-2619
CVE-2017-5837
CVE-2017-5839
CVE-2017-5842
CVE-2017-5844
CVE-2017-5969
CVE-2018-1336
CVE-2018-8014
CVE-2018-8034
CVE-2018-8037
CVE-2019-12519
CVE-2019-12521
CVE-2019-12528
CVE-2019-18860
CVE-2020-11945
CVE-2020-8517
SUSE-SU-2015:1556-1
SUSE-SU-2016:0884-1
SUSE-SU-2016:3083-1
SUSE-SU-2017:0474-1
SUSE-SU-2017:0859-1
SUSE-SU-2017:0860-1
SUSE-SU-2017:1670-1
SUSE-SU-2018:3011-1
SUSE-SU-2020:1156-1
Platform(s):openSUSE Leap 15.0
openSUSE Leap 15.1
SUSE Linux Enterprise Desktop 11 SP2
SUSE Linux Enterprise Desktop 11 SP3
SUSE Linux Enterprise Desktop 11 SP4
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Desktop 12 SP1
SUSE Linux Enterprise Desktop 12 SP2
SUSE Linux Enterprise Desktop 12 SP3
SUSE Linux Enterprise Desktop 12 SP4
SUSE Linux Enterprise Module for Web Scripting 15
SUSE Linux Enterprise Server 12 SP1
SUSE Linux Enterprise Server 12 SP1-LTSS
SUSE Linux Enterprise Server 12 SP2
SUSE Linux Enterprise Server 12 SP2-BCL
SUSE Linux Enterprise Server 12 SP2-ESPOS
SUSE Linux Enterprise Server 12 SP2-LTSS
SUSE Linux Enterprise Server 12 SP3
SUSE Linux Enterprise Server 12 SP3-BCL
SUSE Linux Enterprise Server 12 SP3-ESPOS
SUSE Linux Enterprise Server 12 SP3-LTSS
SUSE Linux Enterprise Server 12 SP3-TERADATA
SUSE Linux Enterprise Server 12 SP4
SUSE Linux Enterprise Server 15-LTSS
SUSE OpenStack Cloud 6
SUSE OpenStack Cloud 7
SUSE OpenStack Cloud 8
SUSE OpenStack Cloud 9
SUSE OpenStack Cloud Crowbar 8
SUSE OpenStack Cloud Crowbar 9
Product(s):
Definition Synopsis
  • openSUSE Leap 15.0 is installed
  • AND Package Information
  • gimp-2.8.22-lp150.3 is installed
  • OR gimp-lang-2.8.22-lp150.3 is installed
  • OR gimp-plugins-python-2.8.22-lp150.3 is installed
  • OR libgimp-2_0-0-2.8.22-lp150.3 is installed
  • OR libgimpui-2_0-0-2.8.22-lp150.3 is installed
    • Definition Synopsis
  • openSUSE Leap 15.1 is installed
  • AND Package Information
  • libBasicUsageEnvironment1-2019.06.28-lp151.2.3 is installed
  • OR libUsageEnvironment3-2019.06.28-lp151.2.3 is installed
  • OR libgroupsock8-2019.06.28-lp151.2.3 is installed
  • OR libliveMedia66-2019.06.28-lp151.2.3 is installed
  • OR live555-2019.06.28-lp151.2.3 is installed
  • OR live555-devel-2019.06.28-lp151.2.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 11 SP2 is installed
  • AND Package Information
  • ImageMagick-6.4.3.6-7.26 is installed
  • OR libMagick++1-6.4.3.6-7.26 is installed
  • OR libMagickCore1-6.4.3.6-7.26 is installed
  • OR libMagickCore1-32bit-6.4.3.6-7.26 is installed
  • OR libMagickWand1-6.4.3.6-7.26 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 11 SP3 is installed
  • AND Package Information
  • compat-wireless-kmp-default-3.13_3.0.101_0.31-0.9 is installed
  • OR compat-wireless-kmp-pae-3.13_3.0.101_0.31-0.9 is installed
  • OR compat-wireless-kmp-xen-3.13_3.0.101_0.31-0.9 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 11 SP4 is installed
  • AND Package Information
  • MozillaFirefox-31.8.0esr-0.13 is installed
  • OR MozillaFirefox-translations-31.8.0esr-0.13 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 is installed
  • AND Package Information
  • libsnmp30-5.7.2.1-4.3 is installed
  • OR libsnmp30-32bit-5.7.2.1-4.3 is installed
  • OR net-snmp-5.7.2.1-4.3 is installed
  • OR perl-SNMP-5.7.2.1-4.3 is installed
  • OR snmp-mibs-5.7.2.1-4.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 SP1 is installed
  • AND Package Information
  • xen-4.5.5_02-22.3 is installed
  • OR xen-kmp-default-4.5.5_02_k3.12.67_60.64.18-22.3 is installed
  • OR xen-libs-4.5.5_02-22.3 is installed
  • OR xen-libs-32bit-4.5.5_02-22.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 SP2 is installed
  • AND Package Information
  • libxml2-2.9.4-42 is installed
  • OR libxml2-2-2.9.4-42 is installed
  • OR libxml2-2-32bit-2.9.4-42 is installed
  • OR libxml2-tools-2.9.4-42 is installed
  • OR python-libxml2-2.9.4-42 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 SP3 is installed
  • AND Package Information
  • cron-4.2-58 is installed
  • OR cronie-1.4.11-58 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 SP4 is installed
  • AND Package Information
  • gstreamer-plugins-base-1.8.3-12 is installed
  • OR gstreamer-plugins-base-lang-1.8.3-12 is installed
  • OR libgstallocators-1_0-0-1.8.3-12 is installed
  • OR libgstapp-1_0-0-1.8.3-12 is installed
  • OR libgstapp-1_0-0-32bit-1.8.3-12 is installed
  • OR libgstaudio-1_0-0-1.8.3-12 is installed
  • OR libgstaudio-1_0-0-32bit-1.8.3-12 is installed
  • OR libgstfft-1_0-0-1.8.3-12 is installed
  • OR libgstfft-1_0-0-32bit-1.8.3-12 is installed
  • OR libgstpbutils-1_0-0-1.8.3-12 is installed
  • OR libgstpbutils-1_0-0-32bit-1.8.3-12 is installed
  • OR libgstriff-1_0-0-1.8.3-12 is installed
  • OR libgstrtp-1_0-0-1.8.3-12 is installed
  • OR libgstrtsp-1_0-0-1.8.3-12 is installed
  • OR libgstsdp-1_0-0-1.8.3-12 is installed
  • OR libgsttag-1_0-0-1.8.3-12 is installed
  • OR libgsttag-1_0-0-32bit-1.8.3-12 is installed
  • OR libgstvideo-1_0-0-1.8.3-12 is installed
  • OR libgstvideo-1_0-0-32bit-1.8.3-12 is installed
  • OR typelib-1_0-GstAudio-1_0-1.8.3-12 is installed
  • OR typelib-1_0-GstPbutils-1_0-1.8.3-12 is installed
  • OR typelib-1_0-GstTag-1_0-1.8.3-12 is installed
  • OR typelib-1_0-GstVideo-1_0-1.8.3-12 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Web Scripting 15 is installed
  • AND Package Information
  • tomcat-9.0.10-3.7 is installed
  • OR tomcat-admin-webapps-9.0.10-3.7 is installed
  • OR tomcat-el-3_0-api-9.0.10-3.7 is installed
  • OR tomcat-jsp-2_3-api-9.0.10-3.7 is installed
  • OR tomcat-lib-9.0.10-3.7 is installed
  • OR tomcat-servlet-4_0-api-9.0.10-3.7 is installed
  • OR tomcat-webapps-9.0.10-3.7 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP1 is installed
  • AND Package Information
  • expat-2.1.0-13 is installed
  • OR libexpat1-2.1.0-13 is installed
  • OR libexpat1-32bit-2.1.0-13 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP1-LTSS is installed
  • AND Package Information
  • java-1_8_0-ibm-1.8.0_sr4.10-30.5 is installed
  • OR java-1_8_0-ibm-alsa-1.8.0_sr4.10-30.5 is installed
  • OR java-1_8_0-ibm-devel-1.8.0_sr4.10-30.5 is installed
  • OR java-1_8_0-ibm-plugin-1.8.0_sr4.10-30.5 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2 is installed
  • AND ruby-2.1-1 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2-BCL is installed
  • AND Package Information
  • git-2.12.3-27.14 is installed
  • OR git-core-2.12.3-27.14 is installed
  • OR git-doc-2.12.3-27.14 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2-ESPOS is installed
  • AND Package Information
  • ntp-4.2.8p11-64.5 is installed
  • OR ntp-doc-4.2.8p11-64.5 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2-LTSS is installed
  • AND Package Information
  • libsystemd0-228-150.58 is installed
  • OR libsystemd0-32bit-228-150.58 is installed
  • OR libudev1-228-150.58 is installed
  • OR libudev1-32bit-228-150.58 is installed
  • OR systemd-228-150.58 is installed
  • OR systemd-32bit-228-150.58 is installed
  • OR systemd-bash-completion-228-150.58 is installed
  • OR systemd-sysvinit-228-150.58 is installed
  • OR udev-228-150.58 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3 is installed
  • AND autofs-5.0.9-27 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-BCL is installed
  • AND Package Information
  • kernel-default-4.4.180-94.107 is installed
  • OR kernel-default-base-4.4.180-94.107 is installed
  • OR kernel-default-devel-4.4.180-94.107 is installed
  • OR kernel-devel-4.4.180-94.107 is installed
  • OR kernel-macros-4.4.180-94.107 is installed
  • OR kernel-source-4.4.180-94.107 is installed
  • OR kernel-syms-4.4.180-94.107 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-ESPOS is installed
  • AND Package Information
  • kgraft-patch-4_4_180-94_103-default-2-2 is installed
  • OR kgraft-patch-SLE12-SP3_Update_28-2-2 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-LTSS is installed
  • AND Package Information
  • kgraft-patch-4_4_162-94_69-default-6-2 is installed
  • OR kgraft-patch-SLE12-SP3_Update_21-6-2 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-TERADATA is installed
  • AND Package Information
  • libgcrypt-1.6.1-16.62 is installed
  • OR libgcrypt20-1.6.1-16.62 is installed
  • OR libgcrypt20-32bit-1.6.1-16.62 is installed
  • OR libgcrypt20-hmac-1.6.1-16.62 is installed
  • OR libgcrypt20-hmac-32bit-1.6.1-16.62 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP4 is installed
  • AND apache2-mod_jk-1.2.40-5 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 15-LTSS is installed
  • AND squid-4.11-5.17 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud 6 is installed
  • AND Package Information
  • kernel-default-3.12.74-60.64.88 is installed
  • OR kernel-default-base-3.12.74-60.64.88 is installed
  • OR kernel-default-devel-3.12.74-60.64.88 is installed
  • OR kernel-devel-3.12.74-60.64.88 is installed
  • OR kernel-macros-3.12.74-60.64.88 is installed
  • OR kernel-source-3.12.74-60.64.88 is installed
  • OR kernel-syms-3.12.74-60.64.88 is installed
  • OR kernel-xen-3.12.74-60.64.88 is installed
  • OR kernel-xen-base-3.12.74-60.64.88 is installed
  • OR kernel-xen-devel-3.12.74-60.64.88 is installed
  • OR kgraft-patch-3_12_74-60_64_88-default-1-2.3 is installed
  • OR kgraft-patch-3_12_74-60_64_88-xen-1-2.3 is installed
  • OR kgraft-patch-SLE12-SP1_Update_27-1-2.3 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud 7 is installed
  • AND Package Information
  • java-1_8_0-openjdk-1.8.0.181-27.26 is installed
  • OR java-1_8_0-openjdk-demo-1.8.0.181-27.26 is installed
  • OR java-1_8_0-openjdk-devel-1.8.0.181-27.26 is installed
  • OR java-1_8_0-openjdk-headless-1.8.0.181-27.26 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud 8 is installed
  • AND Package Information
  • MozillaFirefox-68.5.0-109.106 is installed
  • OR MozillaFirefox-translations-common-68.5.0-109.106 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud 9 is installed
  • AND Package Information
  • ardana-db-9.0+git.1572311426.a6dc2fd-3.13 is installed
  • OR ardana-keystone-9.0+git.1573069087.15ffd1c-3.13 is installed
  • OR ardana-neutron-9.0+git.1572019823.6650494-3.16 is installed
  • OR ardana-nova-9.0+git.1572618171.4460843-3.13 is installed
  • OR openstack-barbican-7.0.1~dev21-3.3 is installed
  • OR openstack-barbican-api-7.0.1~dev21-3.3 is installed
  • OR openstack-barbican-keystone-listener-7.0.1~dev21-3.3 is installed
  • OR openstack-barbican-retry-7.0.1~dev21-3.3 is installed
  • OR openstack-barbican-worker-7.0.1~dev21-3.3 is installed
  • OR openstack-heat-templates-0.0.0+git.1553459627.948e8cc-3.3 is installed
  • OR openstack-keystone-14.1.1~dev28-3.16 is installed
  • OR openstack-neutron-13.0.6~dev8-3.16 is installed
  • OR openstack-neutron-dhcp-agent-13.0.6~dev8-3.16 is installed
  • OR openstack-neutron-gbp-5.0.1~dev476-3.13 is installed
  • OR openstack-neutron-ha-tool-13.0.6~dev8-3.16 is installed
  • OR openstack-neutron-l3-agent-13.0.6~dev8-3.16 is installed
  • OR openstack-neutron-lbaas-13.0.1~dev16-3.13 is installed
  • OR openstack-neutron-lbaas-agent-13.0.1~dev16-3.13 is installed
  • OR openstack-neutron-linuxbridge-agent-13.0.6~dev8-3.16 is installed
  • OR openstack-neutron-macvtap-agent-13.0.6~dev8-3.16 is installed
  • OR openstack-neutron-metadata-agent-13.0.6~dev8-3.16 is installed
  • OR openstack-neutron-metering-agent-13.0.6~dev8-3.16 is installed
  • OR openstack-neutron-openvswitch-agent-13.0.6~dev8-3.16 is installed
  • OR openstack-neutron-server-13.0.6~dev8-3.16 is installed
  • OR openstack-nova-18.2.4~dev22-3.16 is installed
  • OR openstack-nova-api-18.2.4~dev22-3.16 is installed
  • OR openstack-nova-cells-18.2.4~dev22-3.16 is installed
  • OR openstack-nova-compute-18.2.4~dev22-3.16 is installed
  • OR openstack-nova-conductor-18.2.4~dev22-3.16 is installed
  • OR openstack-nova-console-18.2.4~dev22-3.16 is installed
  • OR openstack-nova-novncproxy-18.2.4~dev22-3.16 is installed
  • OR openstack-nova-placement-api-18.2.4~dev22-3.16 is installed
  • OR openstack-nova-scheduler-18.2.4~dev22-3.16 is installed
  • OR openstack-nova-serialproxy-18.2.4~dev22-3.16 is installed
  • OR openstack-nova-vncproxy-18.2.4~dev22-3.16 is installed
  • OR openstack-octavia-3.2.1~dev3-3.16 is installed
  • OR openstack-octavia-amphora-agent-3.2.1~dev3-3.16 is installed
  • OR openstack-octavia-api-3.2.1~dev3-3.16 is installed
  • OR openstack-octavia-health-manager-3.2.1~dev3-3.16 is installed
  • OR openstack-octavia-housekeeping-3.2.1~dev3-3.16 is installed
  • OR openstack-octavia-worker-3.2.1~dev3-3.16 is installed
  • OR openstack-sahara-9.0.2~dev14-3.6 is installed
  • OR openstack-sahara-api-9.0.2~dev14-3.6 is installed
  • OR openstack-sahara-engine-9.0.2~dev14-3.6 is installed
  • OR python-barbican-7.0.1~dev21-3.3 is installed
  • OR python-keystone-14.1.1~dev28-3.16 is installed
  • OR python-neutron-13.0.6~dev8-3.16 is installed
  • OR python-neutron-gbp-5.0.1~dev476-3.13 is installed
  • OR python-neutron-lbaas-13.0.1~dev16-3.13 is installed
  • OR python-nova-18.2.4~dev22-3.16 is installed
  • OR python-octavia-3.2.1~dev3-3.16 is installed
  • OR python-psutil-5.4.6-3.3 is installed
  • OR python-sahara-9.0.2~dev14-3.6 is installed
  • OR release-notes-suse-openstack-cloud-9.20191025-3.15 is installed
  • OR venv-openstack-barbican-7.0.1~dev21-3.13 is installed
  • OR venv-openstack-barbican-x86_64-7.0.1~dev21-3.13 is installed
  • OR venv-openstack-cinder-13.0.8~dev8-3.13 is installed
  • OR venv-openstack-cinder-x86_64-13.0.8~dev8-3.13 is installed
  • OR venv-openstack-designate-7.0.1~dev22-3.13 is installed
  • OR venv-openstack-designate-x86_64-7.0.1~dev22-3.13 is installed
  • OR venv-openstack-heat-11.0.3~dev23-3.13 is installed
  • OR venv-openstack-heat-x86_64-11.0.3~dev23-3.13 is installed
  • OR venv-openstack-keystone-14.1.1~dev28-3.13 is installed
  • OR venv-openstack-keystone-x86_64-14.1.1~dev28-3.13 is installed
  • OR venv-openstack-magnum-7.1.1~dev28-4.13 is installed
  • OR venv-openstack-magnum-x86_64-7.1.1~dev28-4.13 is installed
  • OR venv-openstack-manila-7.3.1~dev15-3.13 is installed
  • OR venv-openstack-manila-x86_64-7.3.1~dev15-3.13 is installed
  • OR venv-openstack-monasca-ceilometer-1.8.2~dev3-3.13 is installed
  • OR venv-openstack-monasca-ceilometer-x86_64-1.8.2~dev3-3.13 is installed
  • OR venv-openstack-neutron-13.0.6~dev8-6.13 is installed
  • OR venv-openstack-neutron-x86_64-13.0.6~dev8-6.13 is installed
  • OR venv-openstack-nova-18.2.4~dev22-3.13 is installed
  • OR venv-openstack-nova-x86_64-18.2.4~dev22-3.13 is installed
  • OR venv-openstack-octavia-3.2.1~dev3-4.13 is installed
  • OR venv-openstack-octavia-x86_64-3.2.1~dev3-4.13 is installed
  • OR venv-openstack-sahara-9.0.2~dev14-3.13 is installed
  • OR venv-openstack-sahara-x86_64-9.0.2~dev14-3.13 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud Crowbar 8 is installed
  • AND Package Information
  • crowbar-5.0+git.1528696845.81a7b5d0-3.3 is installed
  • OR crowbar-core-5.0+git.1533887407.6e9b0412d-3.8 is installed
  • OR crowbar-core-branding-upstream-5.0+git.1533887407.6e9b0412d-3.8 is installed
  • OR crowbar-devel-5.0+git.1528696845.81a7b5d0-3.3 is installed
  • OR crowbar-ha-5.0+git.1530177874.35b9099-3.3 is installed
  • OR crowbar-init-5.0+git.1520420379.d5bbb35-3.3 is installed
  • OR crowbar-openstack-5.0+git.1534167599.d325ef804-4.8 is installed
  • OR crowbar-ui-1.2.0+git.1533844061.4ac8e723-3.3 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud Crowbar 9 is installed
  • AND Package Information
  • openstack-manila-7.3.1~dev15-4.18 is installed
  • OR openstack-manila-api-7.3.1~dev15-4.18 is installed
  • OR openstack-manila-data-7.3.1~dev15-4.18 is installed
  • OR openstack-manila-scheduler-7.3.1~dev15-4.18 is installed
  • OR openstack-manila-share-7.3.1~dev15-4.18 is installed
  • OR python-manila-7.3.1~dev15-4.18 is installed
    • BACK