Publishing details

• Removed from disk on 2018-01-08.
• Removal requested on 2018-01-08.
• Deleted on 2018-01-08 by Marc Deslauriers
• Published on 2017-09-28

Changelog

tomcat8 (8.0.32-1ubuntu1.5) xenial-security; urgency=medium

  * SECURITY UPDATE: loss of pipeline requests
    - debian/patches/CVE-2017-5647.patch: improve sendfile handling when
      requests are pipelined in
      java/org/apache/coyote/AbstractProtocol.java,
      java/org/apache/coyote/http11/Http11AprProcessor.java,
      java/org/apache/coyote/http11/Http11Nio2Processor.java,
      java/org/apache/coyote/http11/Http11NioProcessor.java,
      java/org/apache/tomcat/util/net/AprEndpoint.java,
      java/org/apache/tomcat/util/net/Nio2Endpoint.java,
      java/org/apache/tomcat/util/net/NioEndpoint.java,
      java/org/apache/tomcat/util/net/SendfileKeepAliveState.java.
    - CVE-2017-5647
  * SECURITY UPDATE: incorrect facade object use
    - debian/patches/CVE-2017-5648.patch: ensure request and response
      facades are used when firing application listeners in
      java/org/apache/catalina/authenticator/FormAuthenticator.java,
      java/org/apache/catalina/core/StandardHostValve.java.
    - CVE-2017-5648
  * SECURITY UPDATE: unexpected and undesirable results for static error
    pages
    - debian/patches/CVE-2017-5664.patch: use a more reliable mechanism in
      java/org/apache/catalina/servlets/DefaultServlet.java,
      java/org/apache/catalina/servlets/WebdavServlet.java.
    - CVE-2017-5664
  * SECURITY UPDATE: client and server side cache poisoning in CORS filter
    - debian/patches/CVE-2017-7674.patch: set Vary header in response in
      java/org/apache/catalina/filters/CorsFilter.java.
    - CVE-2017-7674

 -- Marc Deslauriers <email address hidden>  Wed, 27 Sep 2017 17:23:18 -0400

Builds

• amd64

Package files

• libservlet3.1-java-doc_8.0.32-1ubuntu1.5_all.deb (235.2 KiB)
• libservlet3.1-java_8.0.32-1ubuntu1.5_all.deb (381.3 KiB)
• libtomcat8-java_8.0.32-1ubuntu1.5_all.deb (4.4 MiB)
• tomcat8-admin_8.0.32-1ubuntu1.5_all.deb (30.1 KiB)
• tomcat8-common_8.0.32-1ubuntu1.5_all.deb (51.8 KiB)
• tomcat8-docs_8.0.32-1ubuntu1.5_all.deb (659.9 KiB)
• tomcat8-examples_8.0.32-1ubuntu1.5_all.deb (183.5 KiB)
• tomcat8-user_8.0.32-1ubuntu1.5_all.deb (30.0 KiB)
• tomcat8_8.0.32-1ubuntu1.5.debian.tar.xz (53.9 KiB)
• tomcat8_8.0.32-1ubuntu1.5.dsc (2.8 KiB)
• tomcat8_8.0.32-1ubuntu1.5_all.deb (41.3 KiB)
• tomcat8_8.0.32.orig.tar.xz (3.3 MiB)