[gentoo-announce] [ GLSA 202208-34 ] Apache Tomcat: Multiple Vulnerabilities - gentoo-announce

From:	John Helmert III <ajak@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 202208-34 ] Apache Tomcat: Multiple Vulnerabilities
Date:	Sun, 21 Aug 2022 06:20:19
Message-Id:	`YwHOGyzZpFuIa8i+@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 202208-34

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Low

8

    Title: Apache Tomcat: Multiple Vulnerabilities

9

     Date: August 21, 2022

10

     Bugs: #773571, #801916, #818160, #855971

11

       ID: 202208-34

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been discovered in Apache Tomcat, the

19

worst of which could result in denial of service.

20

21

Background

22

==========

23

24

Apache Tomcat is a Servlet-3.0/JSP-2.2 Container.

25

26

Affected packages

27

=================

28

29

    -------------------------------------------------------------------

30

     Package              /     Vulnerable     /            Unaffected

31

    -------------------------------------------------------------------

32

  1  www-servers/tomcat         < 8.5.82:8.5              >= 8.5.82:8.5

33

                                < 9.0.65:9                >= 9.0.65:9

34

                                < 10.0.23:10              >= 10.0.23:10

35

36

Description

37

===========

38

39

Multiple vulnerabilities have been discovered in Apache Tomcat. Please

40

review the CVE identifiers referenced below for details.

41

42

Impact

43

======

44

45

Please review the referenced CVE identifiers for details.

46

47

Workaround

48

==========

49

50

There is no known workaround at this time.

51

52

Resolution

53

==========

54

55

All Apache Tomcat 10.x users should upgrade to the latest version:

56

57

  # emerge --sync

58

  # emerge --ask --oneshot --verbose ">=www-servers/tomcat-10.0.23:10"

59

60

All Apache Tomcat 9.x users should upgrade to the latest version:

61

62

  # emerge --sync

63

  # emerge --ask --oneshot --verbose ">=www-servers/tomcat-9.0.65:9"

64

65

All Apache Tomcat 8.5.x users should upgrade to the latest version:

66

67

  # emerge --sync

68

  # emerge --ask --oneshot --verbose ">=www-servers/tomcat-8.5.82:8.5"

69

70

References

71

==========

72

73

[ 1 ] CVE-2021-25122

74

      https://nvd.nist.gov/vuln/detail/CVE-2021-25122

75

[ 2 ] CVE-2021-25329

76

      https://nvd.nist.gov/vuln/detail/CVE-2021-25329

77

[ 3 ] CVE-2021-30639

78

      https://nvd.nist.gov/vuln/detail/CVE-2021-30639

79

[ 4 ] CVE-2021-30640

80

      https://nvd.nist.gov/vuln/detail/CVE-2021-30640

81

[ 5 ] CVE-2021-33037

82

      https://nvd.nist.gov/vuln/detail/CVE-2021-33037

83

[ 6 ] CVE-2021-42340

84

      https://nvd.nist.gov/vuln/detail/CVE-2021-42340

85

[ 7 ] CVE-2022-34305

86

      https://nvd.nist.gov/vuln/detail/CVE-2022-34305

87

88

Availability

89

============

90

91

This GLSA and any updates to it are available for viewing at

92

the Gentoo Security Website:

93

94

 https://security.gentoo.org/glsa/202208-34

95

96

Concerns?

97

=========

98

99

Security is a primary focus of Gentoo Linux and ensuring the

100

confidentiality and security of our users' machines is of utmost

101

importance to us. Any security concerns should be addressed to

102

security@g.o or alternatively, you may file a bug at

103

https://bugs.gentoo.org.

104

105

License

106

=======

107

108

Copyright 2022 Gentoo Foundation, Inc; referenced text

109

belongs to its owner(s).

110

111

The contents of this document are licensed under the

112

Creative Commons - Attribution / Share Alike license.

113

114

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 202208-34
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Low
8	Title: Apache Tomcat: Multiple Vulnerabilities
9	Date: August 21, 2022
10	Bugs: #773571, #801916, #818160, #855971
11	ID: 202208-34
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been discovered in Apache Tomcat, the
19	worst of which could result in denial of service.
20
21	Background
22	==========
23
24	Apache Tomcat is a Servlet-3.0/JSP-2.2 Container.
25
26	Affected packages
27	=================
28
29	-------------------------------------------------------------------
30	Package / Vulnerable / Unaffected
31	-------------------------------------------------------------------
32	1 www-servers/tomcat < 8.5.82:8.5 >= 8.5.82:8.5
33	< 9.0.65:9 >= 9.0.65:9
34	< 10.0.23:10 >= 10.0.23:10
35
36	Description
37	===========
38
39	Multiple vulnerabilities have been discovered in Apache Tomcat. Please
40	review the CVE identifiers referenced below for details.
41
42	Impact
43	======
44
45	Please review the referenced CVE identifiers for details.
46
47	Workaround
48	==========
49
50	There is no known workaround at this time.
51
52	Resolution
53	==========
54
55	All Apache Tomcat 10.x users should upgrade to the latest version:
56
57	# emerge --sync
58	# emerge --ask --oneshot --verbose ">=www-servers/tomcat-10.0.23:10"
59
60	All Apache Tomcat 9.x users should upgrade to the latest version:
61
62	# emerge --sync
63	# emerge --ask --oneshot --verbose ">=www-servers/tomcat-9.0.65:9"
64
65	All Apache Tomcat 8.5.x users should upgrade to the latest version:
66
67	# emerge --sync
68	# emerge --ask --oneshot --verbose ">=www-servers/tomcat-8.5.82:8.5"
69
70	References
71	==========
72
73	[ 1 ] CVE-2021-25122
74	https://nvd.nist.gov/vuln/detail/CVE-2021-25122
75	[ 2 ] CVE-2021-25329
76	https://nvd.nist.gov/vuln/detail/CVE-2021-25329
77	[ 3 ] CVE-2021-30639
78	https://nvd.nist.gov/vuln/detail/CVE-2021-30639
79	[ 4 ] CVE-2021-30640
80	https://nvd.nist.gov/vuln/detail/CVE-2021-30640
81	[ 5 ] CVE-2021-33037
82	https://nvd.nist.gov/vuln/detail/CVE-2021-33037
83	[ 6 ] CVE-2021-42340
84	https://nvd.nist.gov/vuln/detail/CVE-2021-42340
85	[ 7 ] CVE-2022-34305
86	https://nvd.nist.gov/vuln/detail/CVE-2022-34305
87
88	Availability
89	============
90
91	This GLSA and any updates to it are available for viewing at
92	the Gentoo Security Website:
93
94	https://security.gentoo.org/glsa/202208-34
95
96	Concerns?
97	=========
98
99	Security is a primary focus of Gentoo Linux and ensuring the
100	confidentiality and security of our users' machines is of utmost
101	importance to us. Any security concerns should be addressed to
102	security@g.o or alternatively, you may file a bug at
103	https://bugs.gentoo.org.
104
105	License
106	=======
107
108	Copyright 2022 Gentoo Foundation, Inc; referenced text
109	belongs to its owner(s).
110
111	The contents of this document are licensed under the
112	Creative Commons - Attribution / Share Alike license.
113
114	https://creativecommons.org/licenses/by-sa/2.5