-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 15 Jul 2020 13:43:33 +0200 Source: tomcat9 Binary: libtomcat9-embed-java libtomcat9-java tomcat9 tomcat9-admin tomcat9-common tomcat9-docs tomcat9-examples tomcat9-user Architecture: source all Version: 9.0.31-1~deb10u2 Distribution: buster-security Urgency: high Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> Changed-By: Markus Koschany <apo@debian.org> Description: libtomcat9-embed-java - Apache Tomcat 9 - Servlet and JSP engine -- embed libraries libtomcat9-java - Apache Tomcat 9 - Servlet and JSP engine -- core libraries tomcat9 - Apache Tomcat 9 - Servlet and JSP engine tomcat9-admin - Apache Tomcat 9 - Servlet and JSP engine -- admin web application tomcat9-common - Apache Tomcat 9 - Servlet and JSP engine -- common files tomcat9-docs - Apache Tomcat 9 - Servlet and JSP engine -- documentation tomcat9-examples - Apache Tomcat 9 - Servlet and JSP engine -- example web applicati tomcat9-user - Apache Tomcat 9 - Servlet and JSP engine -- tools to create user Changes: tomcat9 (9.0.31-1~deb10u2) buster-security; urgency=high . * Team upload. . [ Emmanuel Bourg ] * Fixed CVE-2020-13935: WebSocket Denial of Service. The payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. * Fixed CVE-2020-13934: HTTP/2 Denial of Service. An h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service. . [ Markus Koschany ] * Fix CVE-2020-9484: When using Apache Tomcat an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed. * Fix CVE-2020-11996: A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. Checksums-Sha1: b84e0525a8c3760c4874ff999aa53c2efc42c618 2889 tomcat9_9.0.31-1~deb10u2.dsc 8ce808d6a49bef5c1dacd07de8e99e15844a27f0 37556 tomcat9_9.0.31-1~deb10u2.debian.tar.xz 346c2a30e28d7a42cfe44de01defa798c65606dc 4098384 libtomcat9-embed-java_9.0.31-1~deb10u2_all.deb 5dd6634f6b1b6a2bdbf122e8f3201a31a5d2b9b3 5845240 libtomcat9-java_9.0.31-1~deb10u2_all.deb 5d0e261ab22512d4c4b12045a3e6c69fb9d76d55 34076 tomcat9-admin_9.0.31-1~deb10u2_all.deb c1db452444b361cd442c2d4a4b7d0343426f7321 69308 tomcat9-common_9.0.31-1~deb10u2_all.deb 2ba22305ecf76b21ece5afb18b98cf8d638f5341 705272 tomcat9-docs_9.0.31-1~deb10u2_all.deb b459288f4099fc5c297423fa8563916841f42314 191160 tomcat9-examples_9.0.31-1~deb10u2_all.deb f35aaeff36487debd306373c0d0072eaf3016535 42228 tomcat9-user_9.0.31-1~deb10u2_all.deb 60cff2aaecfc4aa1405102d4e55cddba1694d619 45976 tomcat9_9.0.31-1~deb10u2_all.deb 24882af651574c8959fc09d10d8e5647d821dcfa 13743 tomcat9_9.0.31-1~deb10u2_amd64.buildinfo Checksums-Sha256: 366ee20e916ab6c3d4519f2070dee21e4e18aad1251b072c29d7760ec97b4f95 2889 tomcat9_9.0.31-1~deb10u2.dsc 4c41d556bfeae640e8089a8b9a6013fb54f957c69a3690aa2070c93dd856098b 37556 tomcat9_9.0.31-1~deb10u2.debian.tar.xz 7d98635b773c578580069799be206e9025ddb229c32f974f6be7a0ba61eb2b8e 4098384 libtomcat9-embed-java_9.0.31-1~deb10u2_all.deb 155a5ac2a645b43e224c0e138f664364fecaea5a749d89b12e6a4cc6baab8415 5845240 libtomcat9-java_9.0.31-1~deb10u2_all.deb 9f8dcc99fe85cd8a61bb25145ac0ba085a84bf48ed117c408cd8f2714529720a 34076 tomcat9-admin_9.0.31-1~deb10u2_all.deb 79b545acc04b040c3ec5eddcb9a5bfa60183f87ba296cdf0d359a119cecf19a4 69308 tomcat9-common_9.0.31-1~deb10u2_all.deb d14f480de4ed0f63304b9366e0235c4e7b0f3381224aed6ad7ae1f80bf151859 705272 tomcat9-docs_9.0.31-1~deb10u2_all.deb 723e8a5bea9089d0bb451929d9190da1196912bc23a325bc6ec5c27c89008725 191160 tomcat9-examples_9.0.31-1~deb10u2_all.deb 0e1c88727711adbb7280fe60fb88408949400ea25050c43c083bf8c86c2a27c6 42228 tomcat9-user_9.0.31-1~deb10u2_all.deb 231778dcf3d05daf470b887a2d05619861620188e28fb604382c911fa8089275 45976 tomcat9_9.0.31-1~deb10u2_all.deb c9da58a30ada0367a35e24b09809f6d626cb8a241eb55315b9da816b1bf8716f 13743 tomcat9_9.0.31-1~deb10u2_amd64.buildinfo Files: f135194010be661a07926d3aacab04e0 2889 java optional tomcat9_9.0.31-1~deb10u2.dsc 4c00461d9e8855cbcdd64956c21bbec0 37556 java optional tomcat9_9.0.31-1~deb10u2.debian.tar.xz 5483c771c6e993dbdcee355579e46a74 4098384 java optional libtomcat9-embed-java_9.0.31-1~deb10u2_all.deb 9db7da5e9dae2c7f6338f273ac077a0c 5845240 java optional libtomcat9-java_9.0.31-1~deb10u2_all.deb 5db1238011ea189b79e13cab0e5d8645 34076 java optional tomcat9-admin_9.0.31-1~deb10u2_all.deb 9824c2c178eda915ad3c7658a25af2de 69308 java optional tomcat9-common_9.0.31-1~deb10u2_all.deb f5349c662837c266885080f19ff55342 705272 doc optional tomcat9-docs_9.0.31-1~deb10u2_all.deb 4b319c3700784d729fa0de005a37297f 191160 java optional tomcat9-examples_9.0.31-1~deb10u2_all.deb e9f56338fe460414f07ab5d541431bf9 42228 java optional tomcat9-user_9.0.31-1~deb10u2_all.deb d32e40f15c1f04f6d55a41dba10f11ed 45976 java optional tomcat9_9.0.31-1~deb10u2_all.deb 91dbd9d6a2db77eb2fcc28499bdd9ee9 13743 java optional tomcat9_9.0.31-1~deb10u2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAl8PISJfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp YW4ub3JnAAoJENmtFLlRO1HkOy4P/jRMVhMrdLvx8sirgA8+kL8N3gN89KMb8nkZ kHbcwmBFfcUIhy6kh7xYD54AVVep9wXDcvSoXmzmLLx08a1LQQF0bXA2vnPsGx9G BT+Ue3HjCouTlp8slb5r7YbhGCkrsoAtOwfu/8tqwc0p+vDNGDdmf1dfQWfMw37K OAsag+Bc6KIi62oROTAmyfb95l5NRer9Rozpi/HtfvVQrVEQkI/U8kp2jY8Nht/F Gso7pTcHHMZgQLSEsuvbutM9k0O02LNbUZS+4q93aNUdfb/vWmCVmQgU1CjPdP0+ 2mhYyjSEXBhHSpcH655314+rIJP2hX789lap5Mq6S/pxpd5lY3qgm2ggQlarsAyD gA8jMaxQeNYrUD282giAkPcdt2/Xr0qswkfaVRKityVdRBntP19HCwwdWKoVbjx9 WbDcwQhJOW7e8BeLUfIEwCpmiOFJpzcgZj1vihzR9pBa9uDbGxkucbM3oOQURj8S EzYpOKVHGoaNT7U+B4RjNyfJ1hJI2VxnsykJjqik4pIkDgJGotHzpOl6W8uK2w3p 68GH7DswNowoOlsgjO810uB+JlOt9FoT+KPCtgM/CulLEH5EZTNkRwffKMMG7+o6 Fe1+Axb/JseDMkGqgjUYTo/974WTtnQderVMOkwoPVfQOeJJktUjXcfECSg3NVQ/ Ow//Vdnz =BKpm -----END PGP SIGNATURE-----
