Apache has issued advisories today (April 10): http://openwall.com/lists/oss-security/2017/04/10/24 http://openwall.com/lists/oss-security/2017/04/10/23 Mageia 5 is also affected. The issues are fixed upstream in 7.0.77 and 8.0.43.
Whiteboard: (none) => MGA5TOOCC: (none) => geiger.david68210
Whiteboard: MGA5TOO => (none)Version: Cauldron => 5
pushed in updates_testing: srpms: tomcat-7.0.77-1.mga5
Assignee: mageia => qa-bugs
Thanks Nicolas! Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=8307#c17 Advisory: ======================== Updated tomcat packages fix security vulnerabilities: A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C (CVE-2017-5647). While investigating bug 60718, it was noticed that some calls to application listeners did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application (CVE-2017-5648). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5647 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5648 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.77 ======================== Updated packages in core/updates_testing: ======================== tomcat-7.0.77-1.mga5 tomcat-admin-webapps-7.0.77-1.mga5 tomcat-docs-webapp-7.0.77-1.mga5 tomcat-javadoc-7.0.77-1.mga5 tomcat-jsvc-7.0.77-1.mga5 tomcat-jsp-2.2-api-7.0.77-1.mga5 tomcat-lib-7.0.77-1.mga5 tomcat-servlet-3.0-api-7.0.77-1.mga5 tomcat-el-2.2-api-7.0.77-1.mga5 tomcat-webapps-7.0.77-1.mga5 from tomcat-7.0.77-1.mga5.src.rpm
Whiteboard: (none) => has_procedureSeverity: normal => critical
MGA-32 on Asus A6000VM Xfce No installtion issues. Followed procedure as per Comment 2, all works OK.
CC: (none) => herman.viaeneWhiteboard: has_procedure => has_procedure MGA5-32-OK
Whiteboard: has_procedure MGA5-32-OK => has_procedure MGA5-32-OK advisoryCC: (none) => davidwhodgins
MGA5-64 on Lenovo B50KDE No installation issues. Followed procedure as per Comment 2, all works OK.
Whiteboard: has_procedure MGA5-32-OK advisory => has_procedure MGA5-32-OK MGA5-64-OK advisory
Validating the update. Thanks for the testing Herman.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2017-0117.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED