SB2017100209 - Amazon Linux AMI update for tomcat7, tomcat8
Published: October 2, 2017 Updated: October 6, 2017
Security Bulletin ID
SB2017100209
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper input validation (CVE-ID: CVE-2017-7674)
The vulnerability allows a remote attacker to conduct client and server side cache poisoning.The weakness exists due to the failure to add an HTTP Vary header indicating that the response varies depending on Origin by the CORS Filter. A remote attacker can trick the victim to follow a specially crafted link and conduct client and server side cache poisoning.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks
Remediation
Install update from vendor's website.