MGASA-2023-0138 - Updated tomcat packages fix security vulnerability

Publication date: 15 Apr 2023
URL: https://advisories.mageia.org/MGASA-2023-0138.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2021-43980,
     CVE-2022-23181,
     CVE-2022-29885,
     CVE-2022-34305,
     CVE-2022-42252,
     CVE-2022-45143,
     CVE-2023-24998,
     CVE-2023-28708

Information disclosure due to concurrency bug (CVE-2021-43980)
Fix for CVE-2020-9484 introduced a time of check, time of use
vulnerability (CVE-2022-23181)
Correct documentation to warn of use over untrusted networks.
(CVE-2022-29885)
Correct documentation showing use of XSS vulnerability. (CVE-2022-34305)
Fix to reject invalid Content-Length header (CVE-2022-42252)
Fix escaping of the type, message or description values. (CVE-2022-45143)
Fix FileUpload limiting of the number of request parts to be processed
to prevent the possibility of an attacker triggering a DoS (CVE-2023-24998)
Fix setting of session cookie secure attribute when using RemoteIpFilter
with X-Forwarded-Proto header set to https (CVE-2023-28708)
Obsolete tomcat-jsvc

References:
- https://bugs.mageia.org/show_bug.cgi?id=30113
- https://lists.suse.com/pipermail/sle-security-updates/2022-March/010339.html
- https://lists.suse.com/pipermail/sle-security-updates/2022-April/010734.html
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.65
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.62
- https://www.debian.org/lts/security/2022/dla-3160
- https://www.debian.org/security/2022/dsa-5265
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.68
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.69
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.71
- https://lists.suse.com/pipermail/sle-security-updates/2023-March/014018.html
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.72
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43980
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23181
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29885
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34305
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42252
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45143
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24998
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28708

SRPMS:
- 8/core/tomcat-9.0.73-1.1.mga8