| Summary: | <www-servers/tomcat-{8.5.56, 9.0.36}: Denial of service vulnerability (CVE-2020-11996) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | John Helmert III <ajak> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | fordfrog, java |
| Priority: | Normal | Flags: | nattka:
sanity-check-
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://marc.info/?l=apache-announce&m=159312225205518&w=2 | ||
| Whiteboard: | B3 [noglsa cve] | ||
| Package list: |
=dev-java/tomcat-servlet-api-8.5.56 amd64 ppc64 x86
=dev-java/tomcat-servlet-api-9.0.36 amd64
=www-servers/tomcat-8.5.56 amd64
|
Runtime testing required: | --- |
|
Description
John Helmert III
2020-06-25 22:33:11 UTC
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e6588e21ed7b8395bc47c1163c7261eb94f8ec10 commit e6588e21ed7b8395bc47c1163c7261eb94f8ec10 Author: Miroslav Šulc <fordfrog@gentoo.org> AuthorDate: 2020-06-26 07:12:49 +0000 Commit: Miroslav Šulc <fordfrog@gentoo.org> CommitDate: 2020-06-26 07:12:49 +0000 www-servers/tomcat: removed vulnerable 9.0.35 Bug: https://bugs.gentoo.org/729668 Package-Manager: Portage-2.3.103, Repoman-2.3.23 Signed-off-by: Miroslav Šulc <fordfrog@gentoo.org> www-servers/tomcat/Manifest | 1 - www-servers/tomcat/tomcat-9.0.35.ebuild | 181 -------------------------------- 2 files changed, 182 deletions(-) these are ready to stabilize. i also included the api archs, though not necessarily needed, but to get rid of the affected api versions. (In reply to Miroslav Šulc from comment #2) > these are ready to stabilize. i also included the api archs, though not > necessarily needed, but to get rid of the affected api versions. thank you amd64 stable x86 stable Resetting sanity check; package list is empty or all packages are done. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3fb737f93ec72b191d4985bce5a0d25504489046 commit 3fb737f93ec72b191d4985bce5a0d25504489046 Author: Miroslav Šulc <fordfrog@gentoo.org> AuthorDate: 2020-06-29 04:54:40 +0000 Commit: Miroslav Šulc <fordfrog@gentoo.org> CommitDate: 2020-06-29 04:54:40 +0000 www-servers/tomcat: removed vulnerable 8.5.55 Bug: https://bugs.gentoo.org/729668 Package-Manager: Portage-2.3.103, Repoman-2.3.23 Signed-off-by: Miroslav Šulc <fordfrog@gentoo.org> www-servers/tomcat/Manifest | 1 - www-servers/tomcat/tomcat-8.5.55.ebuild | 158 -------------------------------- 2 files changed, 159 deletions(-) There are no packages for ppc@. Removing from CC. my fault, should have been ppc64 ppc64 stable. Maintainer(s), please cleanup. Security, please vote. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=48ac1540787ad049b3cfb639fa0b753d22afea7b commit 48ac1540787ad049b3cfb639fa0b753d22afea7b Author: Miroslav Šulc <fordfrog@gentoo.org> AuthorDate: 2020-07-02 07:19:26 +0000 Commit: Miroslav Šulc <fordfrog@gentoo.org> CommitDate: 2020-07-02 07:19:26 +0000 dev-java/tomcat-servlet-api: removed obsolete {8.5.54,9.0.3[45]} Bug: https://bugs.gentoo.org/729668 Package-Manager: Portage-2.3.103, Repoman-2.3.23 Signed-off-by: Miroslav Šulc <fordfrog@gentoo.org> dev-java/tomcat-servlet-api/Manifest | 3 -- .../tomcat-servlet-api-8.5.54.ebuild | 39 ---------------------- .../tomcat-servlet-api-9.0.34.ebuild | 39 ---------------------- .../tomcat-servlet-api-9.0.35.ebuild | 39 ---------------------- 4 files changed, 120 deletions(-) www-servers/tomcat is already clean and related dev-java/tomcat-servlet-api is up to date too. (In reply to Miroslav Šulc from comment #12) > www-servers/tomcat is already clean and related dev-java/tomcat-servlet-api > is up to date too. Thank you :) Unable to check for sanity:
> no match for package: =www-servers/tomcat-8.5.56
|