Outstanding low priority security bugs in the tomcat7 packages

Bug #1449975 reported by Andrea Dell'Amico on 2015-04-29
This bug affects 2 people
Affects Status Importance Assigned to Milestone
tomcat7 (Ubuntu)

Bug Description

Some security vulnerabilities have been fixed after the release of tomcat 7.0.52 that is packaged for Trusty: http://tomcat.apache.org/security-7.html

None of them have been backported. I see the same behaviour with older distributions, too. Is there a chance to have the security vulnerabilities fixed or I have to produce a tomcat package by myself?

Marc Deslauriers (mdeslaur) wrote :

Thanks for reporting this issue.

You can track the security updates for tomcat 7 here:

CVE-2014-0075, CVE-2014-0096 and CVE-2014-0099 have been published for trusty in this advisory:

CVE-2014-0119, CVE-2014-0227 and CVE-2014-0230 have been rated as being "low" priority, which means we will include them in a security update once a more important issue comes up.

Robie Basak (racb) wrote :

Renaming so it doesn't look like the sky is falling in my bug lists.

summary: - Security bugs are never fixed in the tomcat packages
+ Outstanding low priority security bugs in the tomcat7 packages
Changed in tomcat7 (Ubuntu):
status: New → Triaged
importance: Undecided → Low
information type: Public → Public Security
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package tomcat7 - 7.0.52-1ubuntu0.3

tomcat7 (7.0.52-1ubuntu0.3) trusty-security; urgency=medium

  * SECURITY UPDATE: arbitrary file disclosure via XML parser
    (LP: #1449975)
    - debian/patches/CVE-2014-0119.patch: add defensive coding and ensure
      TLD parser obtained from cache has correct value of blockExternal in
    - CVE-2014-0119
  * SECURITY UPDATE: HTTP request smuggling or denial of service via
    streaming with malformed chunked transfer encoding (LP: #1449975)
    - debian/patches/CVE-2014-0227.patch: add error flag and improve i18n
      in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java,
    - CVE-2014-0227
  * SECURITY UPDATE: denial of service via aborted upload attempts
    (LP: #1449975)
    - debian/patches/CVE-2014-0230.patch: limit amount of data in
    - CVE-2014-0230
  * SECURITY UPDATE: SecurityManager bypass via Expression Language
    - debian/patches/CVE-2014-7810.patch: handle classes that may not be
      accessible but have accessible interfaces in
      java/javax/el/BeanELResolver.java, remove unnecessary code in
    - CVE-2014-7810
  * Replace expired ssl certs and use TLS to fix tests causing FTBFS:
    - debian/patches/0022-use-tls-in-ssl-unit-tests.patch
    - debian/patches/0023-replace-expired-ssl-certificates.patch
    - debian/source/include-binaries

 -- Marc Deslauriers <email address hidden> Fri, 19 Jun 2015 12:30:21 -0400

Changed in tomcat7 (Ubuntu):
status: Triaged → Fix Released
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers