Security update for tomcat

Announcement ID:	SUSE-SU-2020:0632-1
Rating:	important
References:	bsc#1139924 bsc#1159723 bsc#1159729 bsc#1164692 bsc#1164825 bsc#1164860
Cross-References:	CVE-2019-10072 CVE-2019-12418 CVE-2019-17563 CVE-2019-17569 CVE-2020-1935 CVE-2020-1938
CVSS scores:	CVE-2019-10072 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2019-10072 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-12418 ( SUSE ): 7.1 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-12418 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-17563 ( SUSE ): 3.4 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N CVE-2019-17563 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-17569 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-1935 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-1938 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L CVE-2020-1938 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5

An update that solves six vulnerabilities can now be installed.

Description:

This update for tomcat to version 9.0.31 fixes the following issues:

Security issues fixed:

• CVE-2019-10072: Fixed a denial-of-service that could have been caused by clients omitting WINDOW_UPDATE messages in HTTP/2 streams (bsc#1139924).
• CVE-2019-12418: Fixed a local privilege escalation by manipulating the RMI registry (bsc#1159723).
• CVE-2019-17563: Fixed a session fixation attack when using FORM authentication (bsc#1159729).
• CVE-2019-17569: Fixed a regression in the handling of Transfer-Encoding headers that would have allowed HTTP Request Smuggling (bsc#1164825).
• CVE-2020-1935: Fixed an HTTP Request Smuggling issue (bsc#1164860).
• CVE-2020-1938: Fixed a file contents disclosure vulnerability (bsc#1164692).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise High Performance Computing 12 SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-2020-632=1
• SUSE Linux Enterprise Server 12 SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-2020-632=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-2020-632=1
• SUSE Linux Enterprise High Performance Computing 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-632=1
• SUSE Linux Enterprise Server 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-632=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-632=1

Package List:

• SUSE Linux Enterprise High Performance Computing 12 SP4 (noarch)
  • tomcat-el-3_0-api-9.0.31-3.25.1
  • tomcat-lib-9.0.31-3.25.1
  • tomcat-docs-webapp-9.0.31-3.25.1
  • tomcat-admin-webapps-9.0.31-3.25.1
  • tomcat-jsp-2_3-api-9.0.31-3.25.1
  • tomcat-javadoc-9.0.31-3.25.1
  • tomcat-servlet-4_0-api-9.0.31-3.25.1
  • tomcat-webapps-9.0.31-3.25.1
  • tomcat-9.0.31-3.25.1
• SUSE Linux Enterprise Server 12 SP4 (noarch)
  • tomcat-el-3_0-api-9.0.31-3.25.1
  • tomcat-lib-9.0.31-3.25.1
  • tomcat-docs-webapp-9.0.31-3.25.1
  • tomcat-admin-webapps-9.0.31-3.25.1
  • tomcat-jsp-2_3-api-9.0.31-3.25.1
  • tomcat-javadoc-9.0.31-3.25.1
  • tomcat-servlet-4_0-api-9.0.31-3.25.1
  • tomcat-webapps-9.0.31-3.25.1
  • tomcat-9.0.31-3.25.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4 (noarch)
  • tomcat-el-3_0-api-9.0.31-3.25.1
  • tomcat-lib-9.0.31-3.25.1
  • tomcat-docs-webapp-9.0.31-3.25.1
  • tomcat-admin-webapps-9.0.31-3.25.1
  • tomcat-jsp-2_3-api-9.0.31-3.25.1
  • tomcat-javadoc-9.0.31-3.25.1
  • tomcat-servlet-4_0-api-9.0.31-3.25.1
  • tomcat-webapps-9.0.31-3.25.1
  • tomcat-9.0.31-3.25.1
• SUSE Linux Enterprise High Performance Computing 12 SP5 (noarch)
  • tomcat-el-3_0-api-9.0.31-3.25.1
  • tomcat-lib-9.0.31-3.25.1
  • tomcat-docs-webapp-9.0.31-3.25.1
  • tomcat-admin-webapps-9.0.31-3.25.1
  • tomcat-jsp-2_3-api-9.0.31-3.25.1
  • tomcat-javadoc-9.0.31-3.25.1
  • tomcat-servlet-4_0-api-9.0.31-3.25.1
  • tomcat-webapps-9.0.31-3.25.1
  • tomcat-9.0.31-3.25.1
• SUSE Linux Enterprise Server 12 SP5 (noarch)
  • tomcat-el-3_0-api-9.0.31-3.25.1
  • tomcat-lib-9.0.31-3.25.1
  • tomcat-docs-webapp-9.0.31-3.25.1
  • tomcat-admin-webapps-9.0.31-3.25.1
  • tomcat-jsp-2_3-api-9.0.31-3.25.1
  • tomcat-javadoc-9.0.31-3.25.1
  • tomcat-servlet-4_0-api-9.0.31-3.25.1
  • tomcat-webapps-9.0.31-3.25.1
  • tomcat-9.0.31-3.25.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5 (noarch)
  • tomcat-el-3_0-api-9.0.31-3.25.1
  • tomcat-lib-9.0.31-3.25.1
  • tomcat-docs-webapp-9.0.31-3.25.1
  • tomcat-admin-webapps-9.0.31-3.25.1
  • tomcat-jsp-2_3-api-9.0.31-3.25.1
  • tomcat-javadoc-9.0.31-3.25.1
  • tomcat-servlet-4_0-api-9.0.31-3.25.1
  • tomcat-webapps-9.0.31-3.25.1
  • tomcat-9.0.31-3.25.1

References:

• https://www.suse.com/security/cve/CVE-2019-10072.html
• https://www.suse.com/security/cve/CVE-2019-12418.html
• https://www.suse.com/security/cve/CVE-2019-17563.html
• https://www.suse.com/security/cve/CVE-2019-17569.html
• https://www.suse.com/security/cve/CVE-2020-1935.html
• https://www.suse.com/security/cve/CVE-2020-1938.html
• https://bugzilla.suse.com/show_bug.cgi?id=1139924
• https://bugzilla.suse.com/show_bug.cgi?id=1159723
• https://bugzilla.suse.com/show_bug.cgi?id=1159729
• https://bugzilla.suse.com/show_bug.cgi?id=1164692
• https://bugzilla.suse.com/show_bug.cgi?id=1164825
• https://bugzilla.suse.com/show_bug.cgi?id=1164860