-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4118-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
February 17, 2018                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : tomcat-native
CVE ID         : CVE-2017-15698

Jonas Klempel reported that tomcat-native, a library giving Tomcat
access to the Apache Portable Runtime (APR) library's network connection
(socket) implementation and random-number generator, does not properly
handle fields longer than 127 bytes when parsing the AIA-Extension field
of a client certificate. If OCSP checks are used, this could result in
client certificates that should have been rejected to be accepted.

For the oldstable distribution (jessie), this problem has been fixed
in version 1.1.32~repack-2+deb8u1.

For the stable distribution (stretch), this problem has been fixed in
version 1.2.12-2+deb9u1.

We recommend that you upgrade your tomcat-native packages.

For the detailed security status of tomcat-native please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/tomcat-native

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqINN9fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0QCFA/+NIKcWWK9+5NHMyYJumS9DE317Lxg/7xo2c46YxFIWX+WbYu7NX+H/YqP
0AhRYNVO5cQJCymGl2LAWuIITMOtvE+cybI5q9Ayjy3fj02LqUHsawKwGtIj8166
X6PH/R08HlMm2rPJdcQzQ+RsALAyToNwABxLdWgDAdBSy1mWoAS3XzCGj46rha0K
1yQay4vG+FszZz9aJA7/E9SOFBdljzeATbrAcdtutsK4ebRvASabJEon2XzDkzJy
2RClV8+qMp9qppPB8Y0dmisLVuIsoVWp1VGmx8ZVEKaj0G9hVvpc1lrNkS6hwJVC
0eTuYvp2d5VJ2tXPAqjqU3KnvEHvKx3VPNDlUVcHkgET/+G3W6AUjR+U10TzRL52
A+aNELQg8FqlE2NPIB3+1dNxSedFhLl5w7kLYvJFTAd27hZaqK66qt28UyRkuS2x
YX5g0UvYPbsIO6FshvCOC/ASvqZIrrUHrWZWr5i+9JWvbQYJOb0pCWAQ1jMYZbTp
10b+CSrcKY/FiCrpNFmuAwBiatGBPr9O5y4ybxsVLeQ/VvhIqSuRZF4Q1LMHFa79
S4iquPbTTBBgqPAtybbTjUNgEHvRep2IXa1qRLMDPH3SyEa87mb3XRVIgW2mSG/e
rQalkoijLqb7DPAgXn+2Zuaw/Ld97lj+0i9N5IesMfhX9XmE194=
=KKIX
-----END PGP SIGNATURE-----