-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4118-1 security@xxxxxxxxxx https://www.debian.org/security/ Salvatore Bonaccorso February 17, 2018 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : tomcat-native CVE ID : CVE-2017-15698 Jonas Klempel reported that tomcat-native, a library giving Tomcat access to the Apache Portable Runtime (APR) library's network connection (socket) implementation and random-number generator, does not properly handle fields longer than 127 bytes when parsing the AIA-Extension field of a client certificate. If OCSP checks are used, this could result in client certificates that should have been rejected to be accepted. For the oldstable distribution (jessie), this problem has been fixed in version 1.1.32~repack-2+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 1.2.12-2+deb9u1. We recommend that you upgrade your tomcat-native packages. For the detailed security status of tomcat-native please refer to its security tracker page at: https://security-tracker.debian.org/tracker/tomcat-native Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlqINN9fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0QCFA/+NIKcWWK9+5NHMyYJumS9DE317Lxg/7xo2c46YxFIWX+WbYu7NX+H/YqP 0AhRYNVO5cQJCymGl2LAWuIITMOtvE+cybI5q9Ayjy3fj02LqUHsawKwGtIj8166 X6PH/R08HlMm2rPJdcQzQ+RsALAyToNwABxLdWgDAdBSy1mWoAS3XzCGj46rha0K 1yQay4vG+FszZz9aJA7/E9SOFBdljzeATbrAcdtutsK4ebRvASabJEon2XzDkzJy 2RClV8+qMp9qppPB8Y0dmisLVuIsoVWp1VGmx8ZVEKaj0G9hVvpc1lrNkS6hwJVC 0eTuYvp2d5VJ2tXPAqjqU3KnvEHvKx3VPNDlUVcHkgET/+G3W6AUjR+U10TzRL52 A+aNELQg8FqlE2NPIB3+1dNxSedFhLl5w7kLYvJFTAd27hZaqK66qt28UyRkuS2x YX5g0UvYPbsIO6FshvCOC/ASvqZIrrUHrWZWr5i+9JWvbQYJOb0pCWAQ1jMYZbTp 10b+CSrcKY/FiCrpNFmuAwBiatGBPr9O5y4ybxsVLeQ/VvhIqSuRZF4Q1LMHFa79 S4iquPbTTBBgqPAtybbTjUNgEHvRep2IXa1qRLMDPH3SyEa87mb3XRVIgW2mSG/e rQalkoijLqb7DPAgXn+2Zuaw/Ld97lj+0i9N5IesMfhX9XmE194= =KKIX -----END PGP SIGNATURE-----
