CVE-2013-4590 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4590): Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. CVE-2013-4322 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4322): Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544. CVE-2013-4286 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4286): Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090. Maintainers, may we proceed with stabilization of 6.0.39 and 7.0.52?
Arches, please test and mark stable: =www-servers/tomcat-7.0.56 =www-servers/tomcat-6.0.41 =dev-java/tomcat-servlet-api-6.0.41 =dev-java/tomcat-servlet-api-7.0.56 Target keywords : "amd64 ppc ppc64 x86"
amd64 stable
x86 stable
ppc stable
ppc64 stable. Maintainer(s), please cleanup. Security, please vote.
This issue was resolved and addressed in GLSA 201412-29 at http://security.gentoo.org/glsa/glsa-201412-29.xml by GLSA coordinator Sean Amoss (ackle).
Re-opening for cleanup. Maintainers, please drop the vulnerable versions.
+ 22 Dec 2014; Johann Schmitz <ercpe@gentoo.org> + -files/tomcat-6.0.37-build.xml.patch, -files/tomcat-6.0.39-build.xml.patch, + -files/tomcat-7.0.42-build.xml.patch, -files/tomcat-7.0.47-build.xml.patch, + -files/tomcat-7.0.52-build.xml.patch, -tomcat-6.0.37.ebuild, + -tomcat-6.0.39.ebuild, -tomcat-7.0.42.ebuild, -tomcat-7.0.47.ebuild, + -tomcat-7.0.52.ebuild: + Dropped vulnerable versions Sorry for the late response.
+ 03 Jun 2015; Patrice Clement <monsieurp@gentoo.org> + -files/tomcat-7.0.56-build.xml.patch, -files/tomcat-7.0.57-build.xml.patch, + -tomcat-7.0.56.ebuild, -tomcat-7.0.57.ebuild: + Remove vulnerable versions < Tomcat 7.0.59. Fix security bug 549536. + tomcat-7.0.56 was the last bit remaining and has been removed from the tree. See bug 549536 for more info.
Hi security You can close this bug.
Thanks for cleanup, closing.
