====================================================================


                             CERT-Renater

                 Note d'Information No. 2018/VULN243
_____________________________________________________________________

DATE                : 24/07/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Tomcat versions prior to
                                9.0.10, 8.5.32, 8.0.53, 7.0.90.

=====================================================================
http://mail-archives.apache.org/mod_mbox/tomcat-announce/201807.mbox/%3c20180722090435.GA60759@minotaur.apache.org%3e
http://mail-archives.apache.org/mod_mbox/tomcat-announce/201807.mbox/%3c20180722090623.GA92700@minotaur.apache.org%3e
http://mail-archives.apache.org/mod_mbox/tomcat-announce/201807.mbox/%3c20180722091057.GA70283@minotaur.apache.org%3e
_____________________________________________________________________

CVE-2018-1336 Apache Tomcat - Denial of Service

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 9.0.0.M9 to 9.0.7
Apache Tomcat 8.5.0 to 8.5.30
Apache Tomcat 8.0.0.RC1 to 8.0.51
Apache Tomcat 7.0.28 to 7.0.86

Description:

An improper handing of overflow in the UTF-8 decoder with
supplementary characters can lead to an infinite loop in the
decoder causing a Denial of Service.

Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- - Upgrade to Apache Tomcat 9.0.7 or later.
- - Upgrade to Apache Tomcat 8.5.32 or later.
- - Upgrade to Apache Tomcat 8.0.52 or later.
- - Upgrade to Apache Tomcat 7.0.90 or later.

History:
2018-07-22 Original advisory

References:
[1] http://tomcat.apache.org/security-9.html

_____________________________________________________________________

CVE-2018-8034 Apache Tomcat - Security Constraint Bypass

Severity: Low

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.9
Apache Tomcat 8.5.0 to 8.5.31
Apache Tomcat 8.0.0.RC1 to 8.0.52
Apache Tomcat 7.0.35 to 7.0.88

Description:
The host name verification when using TLS with the WebSocket
client was missing. It is now enabled by default.

Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- - Upgrade to Apache Tomcat 9.0.10 or later.
- - Upgrade to Apache Tomcat 8.5.32 or later.
- - Upgrade to Apache Tomcat 8.0.53 or later.
- - Upgrade to Apache Tomcat 7.0.90 or later.

History:
2018-07-22 Original advisory

References:
[1] http://tomcat.apache.org/security-9.html

_____________________________________________________________________


CVE-2018-8037 Apache Tomcat - Information Disclosure

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 9.0.0.M9 to 9.0.9
Apache Tomcat 8.5.5 to 8.5.31

Description:

A bug in the tracking of connection closures can lead to
reuse of user sessions in a new connection.

Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- - Upgrade to Apache Tomcat 9.0.10 or later.
- - Upgrade to Apache Tomcat 8.5.32 or later.

History:
2018-07-22 Original advisory

References:
[1] http://tomcat.apache.org/security-9.html


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================