Security update for tomcat6

SUSE Security Update: Security update for tomcat6
Announcement ID: SUSE-SU-2018:1847-1
Rating: moderate
References: #1042910 #1082480
Affected Products:
  • SUSE Linux Enterprise Server 11-SP4
    		•

    An update that fixes two vulnerabilities is now available.

    Description:

    This update for tomcat6 fixes the following security issues:

    - : The error page mechanism of the Java Servlet Specification requires
    that, when an error occurs and an error page is configured for the error
    that occurred, the original request and response are forwarded to the
    error page. This means that the request is presented to the error page
    with the
    original HTTP method. If the error page is a static file, expected
    behaviour is to serve content of the file as if processing a GET
    request, regardless of the actual HTTP method. The Default Servlet in
    Tomcat did not do this. Depending on the original request this could
    lead to unexpected and undesirable results for static error pages
    including, if the DefaultServlet is configured to permit writes, the
    replacement or removal of the custom error page (bsc#1042910).
    - : The URL pattern of "" was not correctly handled when used as part of a
    security constraint definition. This caused the constraint to be
    ignored. It was possible for unauthorised users to gain access to web
    application resources that should have been protected. Only security
    constraints with a URL pattern of the empty string were affected
    (bsc#1082480).

    Patch Instructions:

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Server 11-SP4:
      zypper in -t patch slessp4-tomcat6-13685=1

    Package List:

    • SUSE Linux Enterprise Server 11-SP4 (noarch):
      • tomcat6-6.0.53-0.57.7.1
      • tomcat6-admin-webapps-6.0.53-0.57.7.1
      • tomcat6-docs-webapp-6.0.53-0.57.7.1
      • tomcat6-javadoc-6.0.53-0.57.7.1
      • tomcat6-jsp-2_1-api-6.0.53-0.57.7.1
      • tomcat6-lib-6.0.53-0.57.7.1
      • tomcat6-servlet-2_5-api-6.0.53-0.57.7.1
      • tomcat6-webapps-6.0.53-0.57.7.1

    References: