Security update for tomcat SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1789-1 Final 1 1 2020-06-26T07:42:24Z current 2020-06-26T07:42:24Z 2020-06-26T07:42:24Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tomcat This update for tomcat fixes the following issues: - CVE-2020-8022: Fixed a local root exploit due to improper permissions (bsc#1172405) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1789,SUSE-SLE-Product-HPC-15-2020-1789,SUSE-SLE-Product-SLES-15-2020-1789,SUSE-SLE-Product-SLES_SAP-15-2020-1789 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201789-1/ Link for SUSE-SU-2020:1789-1 https://lists.suse.com/pipermail/sle-security-updates/2020-June/007045.html E-Mail link for SUSE-SU-2020:1789-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1172405 SUSE Bug 1172405 https://www.suse.com/security/cve/CVE-2020-8022/ SUSE CVE CVE-2020-8022 page SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 tomcat-9.0.35-3.57.3 tomcat-admin-webapps-9.0.35-3.57.3 tomcat-docs-webapp-9.0.35-3.57.3 tomcat-el-3_0-api-9.0.35-3.57.3 tomcat-embed-9.0.35-3.57.3 tomcat-javadoc-9.0.35-3.57.3 tomcat-jsp-2_3-api-9.0.35-3.57.3 tomcat-jsvc-9.0.35-3.57.3 tomcat-lib-9.0.35-3.57.3 tomcat-servlet-4_0-api-9.0.35-3.57.3 tomcat-webapps-9.0.35-3.57.3 tomcat-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS tomcat-admin-webapps-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS tomcat-el-3_0-api-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS tomcat-jsp-2_3-api-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS tomcat-lib-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS tomcat-servlet-4_0-api-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS tomcat-webapps-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS tomcat-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS tomcat-admin-webapps-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS tomcat-el-3_0-api-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS tomcat-jsp-2_3-api-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS tomcat-lib-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS tomcat-servlet-4_0-api-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS tomcat-webapps-9.0.35-3.57.3 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS tomcat-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server 15-LTSS tomcat-admin-webapps-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server 15-LTSS tomcat-el-3_0-api-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server 15-LTSS tomcat-jsp-2_3-api-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server 15-LTSS tomcat-lib-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server 15-LTSS tomcat-servlet-4_0-api-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server 15-LTSS tomcat-webapps-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server 15-LTSS tomcat-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server for SAP Applications 15 tomcat-admin-webapps-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server for SAP Applications 15 tomcat-el-3_0-api-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server for SAP Applications 15 tomcat-jsp-2_3-api-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server for SAP Applications 15 tomcat-lib-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server for SAP Applications 15 tomcat-servlet-4_0-api-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server for SAP Applications 15 tomcat-webapps-9.0.35-3.57.3 as a component of SUSE Linux Enterprise Server for SAP Applications 15 A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1. CVE-2020-8022 SUSE Linux Enterprise High Performance Computing 15-ESPOS:tomcat-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-ESPOS:tomcat-admin-webapps-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-ESPOS:tomcat-el-3_0-api-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-ESPOS:tomcat-jsp-2_3-api-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-ESPOS:tomcat-lib-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-ESPOS:tomcat-servlet-4_0-api-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-ESPOS:tomcat-webapps-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-LTSS:tomcat-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-LTSS:tomcat-admin-webapps-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-LTSS:tomcat-el-3_0-api-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-LTSS:tomcat-jsp-2_3-api-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-LTSS:tomcat-lib-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-LTSS:tomcat-servlet-4_0-api-9.0.35-3.57.3 SUSE Linux Enterprise High Performance Computing 15-LTSS:tomcat-webapps-9.0.35-3.57.3 SUSE Linux Enterprise Server 15-LTSS:tomcat-9.0.35-3.57.3 SUSE Linux Enterprise Server 15-LTSS:tomcat-admin-webapps-9.0.35-3.57.3 SUSE Linux Enterprise Server 15-LTSS:tomcat-el-3_0-api-9.0.35-3.57.3 SUSE Linux Enterprise Server 15-LTSS:tomcat-jsp-2_3-api-9.0.35-3.57.3 SUSE Linux Enterprise Server 15-LTSS:tomcat-lib-9.0.35-3.57.3 SUSE Linux Enterprise Server 15-LTSS:tomcat-servlet-4_0-api-9.0.35-3.57.3 SUSE Linux Enterprise Server 15-LTSS:tomcat-webapps-9.0.35-3.57.3 SUSE Linux Enterprise Server for SAP Applications 15:tomcat-9.0.35-3.57.3 SUSE Linux Enterprise Server for SAP Applications 15:tomcat-admin-webapps-9.0.35-3.57.3 SUSE Linux Enterprise Server for SAP Applications 15:tomcat-el-3_0-api-9.0.35-3.57.3 SUSE Linux Enterprise Server for SAP Applications 15:tomcat-jsp-2_3-api-9.0.35-3.57.3 SUSE Linux Enterprise Server for SAP Applications 15:tomcat-lib-9.0.35-3.57.3 SUSE Linux Enterprise Server for SAP Applications 15:tomcat-servlet-4_0-api-9.0.35-3.57.3 SUSE Linux Enterprise Server for SAP Applications 15:tomcat-webapps-9.0.35-3.57.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201789-1/ https://www.suse.com/security/cve/CVE-2020-8022.html CVE-2020-8022 https://bugzilla.suse.com/1172405 SUSE Bug 1172405 https://bugzilla.suse.com/1172562 SUSE Bug 1172562