what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Debian Security Advisory 4118-1

Debian Security Advisory 4118-1
Posted Feb 19, 2018
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4118-1 - Jonas Klempel reported that tomcat-native, a library giving Tomcat access to the Apache Portable Runtime (APR) library's network connection (socket) implementation and random-number generator, does not properly handle fields longer than 127 bytes when parsing the AIA-Extension field of a client certificate. If OCSP checks are used, this could result in client certificates that should have been rejected to be accepted.

tags | advisory
systems | linux, debian
advisories | CVE-2017-15698
SHA-256 | b0c115257c6baf6fbce5ba322e1b25311ec19b86eef9ab44de646421e383c4d0

Debian Security Advisory 4118-1

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4118-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
February 17, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : tomcat-native
CVE ID : CVE-2017-15698

Jonas Klempel reported that tomcat-native, a library giving Tomcat
access to the Apache Portable Runtime (APR) library's network connection
(socket) implementation and random-number generator, does not properly
handle fields longer than 127 bytes when parsing the AIA-Extension field
of a client certificate. If OCSP checks are used, this could result in
client certificates that should have been rejected to be accepted.

For the oldstable distribution (jessie), this problem has been fixed
in version 1.1.32~repack-2+deb8u1.

For the stable distribution (stretch), this problem has been fixed in
version 1.2.12-2+deb9u1.

We recommend that you upgrade your tomcat-native packages.

For the detailed security status of tomcat-native please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/tomcat-native

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqINN9fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0QCFA/+NIKcWWK9+5NHMyYJumS9DE317Lxg/7xo2c46YxFIWX+WbYu7NX+H/YqP
0AhRYNVO5cQJCymGl2LAWuIITMOtvE+cybI5q9Ayjy3fj02LqUHsawKwGtIj8166
X6PH/R08HlMm2rPJdcQzQ+RsALAyToNwABxLdWgDAdBSy1mWoAS3XzCGj46rha0K
1yQay4vG+FszZz9aJA7/E9SOFBdljzeATbrAcdtutsK4ebRvASabJEon2XzDkzJy
2RClV8+qMp9qppPB8Y0dmisLVuIsoVWp1VGmx8ZVEKaj0G9hVvpc1lrNkS6hwJVC
0eTuYvp2d5VJ2tXPAqjqU3KnvEHvKx3VPNDlUVcHkgET/+G3W6AUjR+U10TzRL52
A+aNELQg8FqlE2NPIB3+1dNxSedFhLl5w7kLYvJFTAd27hZaqK66qt28UyRkuS2x
YX5g0UvYPbsIO6FshvCOC/ASvqZIrrUHrWZWr5i+9JWvbQYJOb0pCWAQ1jMYZbTp
10b+CSrcKY/FiCrpNFmuAwBiatGBPr9O5y4ybxsVLeQ/VvhIqSuRZF4Q1LMHFa79
S4iquPbTTBBgqPAtybbTjUNgEHvRep2IXa1qRLMDPH3SyEa87mb3XRVIgW2mSG/e
rQalkoijLqb7DPAgXn+2Zuaw/Ld97lj+0i9N5IesMfhX9XmE194=
=KKIX
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close