Name : tomcat Product : Fedora 24 Version : 8.0.38 Release : 1.fc24 URL : http://tomcat.apache.org/ Summary : Apache Servlet/JSP Engine, RI for Servlet 3.1/JSP 2.3 API Description : Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.
Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.
This updates includes a rebase from tomcat 8.0.36 up to 8.0.38 which resolves multiple CVEs and a problem that 8.0.37 introduces to freeipa: * rhbz#1375581 - CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header * rhbz#1390532 - CVE-2016-0762 CVE-2016-5018 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 tomcat: various flaws and includes two additional CVE fixes along with one bug fix: * rhbz#1383210 - CVE-2016-5425 tomcat: Local privilege escalation via systemd-tmpfiles service * rhbz#1383216 - CVE-2016-6325 tomcat: tomcat writable config files allow privilege escalation * rhbz#1370262 - catalina.out is no longer in use in the main package, but still gets rotated ------------------------------------------------------------------------------- - References: