<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for tomcat</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2017:1382-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2017-05-23T13:38:30Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2017-05-23T13:38:30Z</InitialReleaseDate>
    <CurrentReleaseDate>2017-05-23T13:38:30Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for tomcat</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">
This update for tomcat fixes the following issues:

 - CVE-2017-5647 Pipelined requests could lead to information disclosure (bsc#1033448)
 - CVE-2017-5648 Untrusted application could retain listener leading to information disclosure (bsc#1033447)
 - CVE-2016-8745 shared Processor on Connector code could lead to information disclosure (bsc#1015119)

</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-SLE-SERVER-12-SP1-2017-848</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171382-1/</URL>
      <Description>Link for SUSE-SU-2017:1382-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2017-May/002909.html</URL>
      <Description>E-Mail link for SUSE-SU-2017:1382-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1015119</URL>
      <Description>SUSE Bug 1015119</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1033447</URL>
      <Description>SUSE Bug 1033447</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1033448</URL>
      <Description>SUSE Bug 1033448</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2016-8745/</URL>
      <Description>SUSE CVE CVE-2016-8745 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-5647/</URL>
      <Description>SUSE CVE CVE-2017-5647 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2017-5648/</URL>
      <Description>SUSE CVE CVE-2017-5648 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 12 SP1">
        <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1" CPE="cpe:/o:suse:sles:12:sp1">SUSE Linux Enterprise Server 12 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1" CPE="cpe:/o:suse:sles_sap:12:sp1">SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-8.0.43-10.19.1">
      <FullProductName ProductID="tomcat-8.0.43-10.19.1">tomcat-8.0.43-10.19.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-admin-webapps-8.0.43-10.19.1">
      <FullProductName ProductID="tomcat-admin-webapps-8.0.43-10.19.1">tomcat-admin-webapps-8.0.43-10.19.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-docs-webapp-8.0.43-10.19.1">
      <FullProductName ProductID="tomcat-docs-webapp-8.0.43-10.19.1">tomcat-docs-webapp-8.0.43-10.19.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-el-3_0-api-8.0.43-10.19.1">
      <FullProductName ProductID="tomcat-el-3_0-api-8.0.43-10.19.1">tomcat-el-3_0-api-8.0.43-10.19.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-javadoc-8.0.43-10.19.1">
      <FullProductName ProductID="tomcat-javadoc-8.0.43-10.19.1">tomcat-javadoc-8.0.43-10.19.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-jsp-2_3-api-8.0.43-10.19.1">
      <FullProductName ProductID="tomcat-jsp-2_3-api-8.0.43-10.19.1">tomcat-jsp-2_3-api-8.0.43-10.19.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-lib-8.0.43-10.19.1">
      <FullProductName ProductID="tomcat-lib-8.0.43-10.19.1">tomcat-lib-8.0.43-10.19.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-servlet-3_1-api-8.0.43-10.19.1">
      <FullProductName ProductID="tomcat-servlet-3_1-api-8.0.43-10.19.1">tomcat-servlet-3_1-api-8.0.43-10.19.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="tomcat-webapps-8.0.43-10.19.1">
      <FullProductName ProductID="tomcat-webapps-8.0.43-10.19.1">tomcat-webapps-8.0.43-10.19.1</FullProductName>
    </Branch>
    <Relationship ProductReference="tomcat-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:tomcat-8.0.43-10.19.1">tomcat-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-admin-webapps-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:tomcat-admin-webapps-8.0.43-10.19.1">tomcat-admin-webapps-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-docs-webapp-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:tomcat-docs-webapp-8.0.43-10.19.1">tomcat-docs-webapp-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-el-3_0-api-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:tomcat-el-3_0-api-8.0.43-10.19.1">tomcat-el-3_0-api-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-javadoc-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:tomcat-javadoc-8.0.43-10.19.1">tomcat-javadoc-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-jsp-2_3-api-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:tomcat-jsp-2_3-api-8.0.43-10.19.1">tomcat-jsp-2_3-api-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-lib-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:tomcat-lib-8.0.43-10.19.1">tomcat-lib-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-servlet-3_1-api-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:tomcat-servlet-3_1-api-8.0.43-10.19.1">tomcat-servlet-3_1-api-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-webapps-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server 12 SP1:tomcat-webapps-8.0.43-10.19.1">tomcat-webapps-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.43-10.19.1">tomcat-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-admin-webapps-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.43-10.19.1">tomcat-admin-webapps-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-docs-webapp-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.43-10.19.1">tomcat-docs-webapp-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-el-3_0-api-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.43-10.19.1">tomcat-el-3_0-api-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-javadoc-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.43-10.19.1">tomcat-javadoc-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-jsp-2_3-api-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.43-10.19.1">tomcat-jsp-2_3-api-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-lib-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.43-10.19.1">tomcat-lib-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-servlet-3_1-api-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.43-10.19.1">tomcat-servlet-3_1-api-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="tomcat-webapps-8.0.43-10.19.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 12 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.43-10.19.1">tomcat-webapps-8.0.43-10.19.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.</Note>
    </Notes>
    <CVE>CVE-2016-8745</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-admin-webapps-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-docs-webapp-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-el-3_0-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-javadoc-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-jsp-2_3-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-lib-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-servlet-3_1-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-webapps-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.43-10.19.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.6</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171382-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-8745.html</URL>
        <Description>CVE-2016-8745</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1015119</URL>
        <Description>SUSE Bug 1015119</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.</Note>
    </Notes>
    <CVE>CVE-2017-5647</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-admin-webapps-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-docs-webapp-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-el-3_0-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-javadoc-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-jsp-2_3-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-lib-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-servlet-3_1-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-webapps-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.43-10.19.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.9</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:S/C:P/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171382-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-5647.html</URL>
        <Description>CVE-2017-5647</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1033448</URL>
        <Description>SUSE Bug 1033448</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.</Note>
    </Notes>
    <CVE>CVE-2017-5648</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-admin-webapps-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-docs-webapp-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-el-3_0-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-javadoc-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-jsp-2_3-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-lib-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-servlet-3_1-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 12 SP1:tomcat-webapps-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-admin-webapps-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-docs-webapp-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-el-3_0-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-javadoc-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-jsp-2_3-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-lib-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-servlet-3_1-api-8.0.43-10.19.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 12 SP1:tomcat-webapps-8.0.43-10.19.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>1.5</BaseScoreV2>
        <VectorV2>AV:L/AC:M/Au:S/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2017/suse-su-20171382-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-5648.html</URL>
        <Description>CVE-2017-5648</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1033447</URL>
        <Description>SUSE Bug 1033447</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
