摘要:
tomcat security update
安全等级: Medium
公告ID: KylinSec-SA-2023-1752
发布日期: 2023年11月3日
关联CVE: CVE-2023-45648
The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project
Security Fix(es):
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially
crafted, invalid trailer header could cause Tomcat to treat a single
request as multiple requests leading to the possibility of request
smuggling when behind a reverse proxy.
Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.
(CVE-2023-45648)
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2023-45648 | KY3.4-4A | tomcat | Fixed |
| CVE-2023-45648 | KY3.4-5A | tomcat | Fixed |
| CVE-2023-45648 | KY3.5.1 | tomcat | Fixed |
| CVE-2023-45648 | KY3.5.2 | tomcat | Fixed |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| tomcat-jsvc | noarch | 9.0.10-30.kb2.ky3_5 |
| tomcat | noarch | 9.0.10-30.kb2.ky3_5 |
| tomcat-help | noarch | 9.0.10-30.kb2.ky3_5 |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| tomcat-jsvc | noarch | 9.0.10-30.kb1.ky3_4 |
| tomcat | noarch | 9.0.10-30.kb1.ky3_4 |
| tomcat-help | noarch | 9.0.10-30.kb1.ky3_4 |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| tomcat-jsvc | noarch | 9.0.10-30.kb1.ky3_4 |
| tomcat-help | noarch | 9.0.10-30.kb1.ky3_4 |
| tomcat | noarch | 9.0.10-30.kb1.ky3_4 |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| tomcat-help | noarch | 9.0.10-32.ky3_5 |
| tomcat | noarch | 9.0.10-32.ky3_5 |
| tomcat-jsvc | noarch | 9.0.10-32.ky3_5 |
方法一：下载安装包进行升级安装
1、通过下载链接下载需要升级的升级包保存，如 xxx.rpm
2、通过rpm命令升级，如 rpm -Uvh xxx.rpm
方法二：通过软件源进行升级安装
1、保持能够连接上互联网
2、通过yum命令升级指定的包，如 yum install 包名
