<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for tomcat</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2020:0029-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2020-01-07T14:44:20Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2020-01-07T14:44:20Z</InitialReleaseDate>
    <CurrentReleaseDate>2020-01-07T14:44:20Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for tomcat</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for tomcat to version 9.0.30 fixes the following issues:

Security issue fixed:

- CVE-2019-12418: Fixed a local privilege escalation through by manipulating the RMI registry and performing a man-in-the-middle attack (bsc#1159723).
- CVE-2019-17563: Fixed a session fixation attack when using FORM authentication (bsc#1159729).
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server-2020-29,Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server-2020-29,Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server-2020-29,SUSE-2020-29,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-29,SUSE-SLE-Module-Web-Scripting-15-SP1-2020-29</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20200029-1/</URL>
      <Description>Link for SUSE-SU-2020:0029-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2020-January/006307.html</URL>
      <Description>E-Mail link for SUSE-SU-2020:0029-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1139924</URL>
      <Description>SUSE Bug 1139924</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1159723</URL>
      <Description>SUSE Bug 1159723</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1159729</URL>
      <Description>SUSE Bug 1159729</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-10072/</URL>
      <Description>SUSE CVE CVE-2019-10072 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-12418/</URL>
      <Description>SUSE CVE CVE-2019-12418 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-17563/</URL>
      <Description>SUSE CVE CVE-2019-17563 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server">
      <Branch Type="Product Name" Name="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server">
        <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server">Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server">
      <Branch Type="Product Name" Name="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server">
        <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server">Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server">
      <Branch Type="Product Name" Name="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server">
        <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server">Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Web and Scripting 15 SP1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Web and Scripting 15 SP1">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Web and Scripting 15 SP1" CPE="cpe:/o:suse:sle-module-web-scripting:15:sp1">SUSE Linux Enterprise Module for Web and Scripting 15 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-9.0.30-4.10.1">
      <FullProductName ProductID="tomcat-9.0.30-4.10.1">tomcat-9.0.30-4.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-el-3_0-api-9.0.30-4.10.1">
      <FullProductName ProductID="tomcat-el-3_0-api-9.0.30-4.10.1">tomcat-el-3_0-api-9.0.30-4.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-jsp-2_3-api-9.0.30-4.10.1">
      <FullProductName ProductID="tomcat-jsp-2_3-api-9.0.30-4.10.1">tomcat-jsp-2_3-api-9.0.30-4.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-lib-9.0.30-4.10.1">
      <FullProductName ProductID="tomcat-lib-9.0.30-4.10.1">tomcat-lib-9.0.30-4.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-servlet-4_0-api-9.0.30-4.10.1">
      <FullProductName ProductID="tomcat-servlet-4_0-api-9.0.30-4.10.1">tomcat-servlet-4_0-api-9.0.30-4.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-admin-webapps-9.0.30-4.10.1">
      <FullProductName ProductID="tomcat-admin-webapps-9.0.30-4.10.1">tomcat-admin-webapps-9.0.30-4.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-docs-webapp-9.0.30-4.10.1">
      <FullProductName ProductID="tomcat-docs-webapp-9.0.30-4.10.1">tomcat-docs-webapp-9.0.30-4.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-embed-9.0.30-4.10.1">
      <FullProductName ProductID="tomcat-embed-9.0.30-4.10.1">tomcat-embed-9.0.30-4.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-javadoc-9.0.30-4.10.1">
      <FullProductName ProductID="tomcat-javadoc-9.0.30-4.10.1">tomcat-javadoc-9.0.30-4.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-jsvc-9.0.30-4.10.1">
      <FullProductName ProductID="tomcat-jsvc-9.0.30-4.10.1">tomcat-jsvc-9.0.30-4.10.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-webapps-9.0.30-4.10.1">
      <FullProductName ProductID="tomcat-webapps-9.0.30-4.10.1">tomcat-webapps-9.0.30-4.10.1</FullProductName>
    </Branch>
    <Relationship ProductReference="tomcat-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-9.0.30-4.10.1">tomcat-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-el-3_0-api-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-el-3_0-api-9.0.30-4.10.1">tomcat-el-3_0-api-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-jsp-2_3-api-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-jsp-2_3-api-9.0.30-4.10.1">tomcat-jsp-2_3-api-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-lib-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-lib-9.0.30-4.10.1">tomcat-lib-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-servlet-4_0-api-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-servlet-4_0-api-9.0.30-4.10.1">tomcat-servlet-4_0-api-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-9.0.30-4.10.1">tomcat-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-el-3_0-api-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-el-3_0-api-9.0.30-4.10.1">tomcat-el-3_0-api-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-jsp-2_3-api-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-jsp-2_3-api-9.0.30-4.10.1">tomcat-jsp-2_3-api-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-lib-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-lib-9.0.30-4.10.1">tomcat-lib-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-servlet-4_0-api-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-servlet-4_0-api-9.0.30-4.10.1">tomcat-servlet-4_0-api-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-9.0.30-4.10.1">tomcat-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-el-3_0-api-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-el-3_0-api-9.0.30-4.10.1">tomcat-el-3_0-api-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-jsp-2_3-api-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-jsp-2_3-api-9.0.30-4.10.1">tomcat-jsp-2_3-api-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-lib-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-lib-9.0.30-4.10.1">tomcat-lib-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-servlet-4_0-api-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server">
      <FullProductName ProductID="Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-servlet-4_0-api-9.0.30-4.10.1">tomcat-servlet-4_0-api-9.0.30-4.10.1 as a component of Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Web and Scripting 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-9.0.30-4.10.1">tomcat-9.0.30-4.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-admin-webapps-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Web and Scripting 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-admin-webapps-9.0.30-4.10.1">tomcat-admin-webapps-9.0.30-4.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-el-3_0-api-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Web and Scripting 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-el-3_0-api-9.0.30-4.10.1">tomcat-el-3_0-api-9.0.30-4.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-jsp-2_3-api-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Web and Scripting 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-jsp-2_3-api-9.0.30-4.10.1">tomcat-jsp-2_3-api-9.0.30-4.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-lib-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Web and Scripting 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-lib-9.0.30-4.10.1">tomcat-lib-9.0.30-4.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-servlet-4_0-api-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Web and Scripting 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-servlet-4_0-api-9.0.30-4.10.1">tomcat-servlet-4_0-api-9.0.30-4.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-webapps-9.0.30-4.10.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Web and Scripting 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-webapps-9.0.30-4.10.1">tomcat-webapps-9.0.30-4.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.</Note>
    </Notes>
    <CVE>CVE-2019-10072</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-el-3_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-jsp-2_3-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-lib-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-servlet-4_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-el-3_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-jsp-2_3-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-lib-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-servlet-4_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-el-3_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-jsp-2_3-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-lib-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-servlet-4_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-admin-webapps-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-el-3_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-jsp-2_3-api-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-lib-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-servlet-4_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-webapps-9.0.30-4.10.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20200029-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-10072.html</URL>
        <Description>CVE-2019-10072</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1139924</URL>
        <Description>SUSE Bug 1139924</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1154162</URL>
        <Description>SUSE Bug 1154162</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.</Note>
    </Notes>
    <CVE>CVE-2019-12418</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-el-3_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-jsp-2_3-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-lib-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-servlet-4_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-el-3_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-jsp-2_3-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-lib-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-servlet-4_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-el-3_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-jsp-2_3-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-lib-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-servlet-4_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-admin-webapps-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-el-3_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-jsp-2_3-api-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-lib-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-servlet-4_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-webapps-9.0.30-4.10.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.4</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.1</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20200029-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-12418.html</URL>
        <Description>CVE-2019-12418</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1159723</URL>
        <Description>SUSE Bug 1159723</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.</Note>
    </Notes>
    <CVE>CVE-2019-17563</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-el-3_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-jsp-2_3-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-lib-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-Azure-BYOS-Server:tomcat-servlet-4_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-el-3_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-jsp-2_3-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-lib-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-EC2-HVM-BYOS-Server:tomcat-servlet-4_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-el-3_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-jsp-2_3-api-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-lib-9.0.30-4.10.1</ProductID>
        <ProductID>Image SLES15-SP1-Manager-4-0-GCE-BYOS-Server:tomcat-servlet-4_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-admin-webapps-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-el-3_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-jsp-2_3-api-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-lib-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-servlet-4_0-api-9.0.30-4.10.1</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Web and Scripting 15 SP1:tomcat-webapps-9.0.30-4.10.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5.1</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>3.4</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2020/suse-su-20200029-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-17563.html</URL>
        <Description>CVE-2019-17563</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1159729</URL>
        <Description>SUSE Bug 1159729</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
