MGASA-2017-0352

Advisory lineage Upstream: 2 Downstream: 0
Published: 21 Sept 2017, 13:43
Last modified:16 Apr 2026, 06:23

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

21 Sept 2017, 13:43
Published
Vulnerability first disclosed
16 Apr 2026, 06:23
Last Modified
Vulnerability information updated

Description

Updated tomcat packages fix security vulnerability The CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances (CVE-2017-7674). When using a VirtualDirContext it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request (CVE-2017-12616). Note that CVE-2017-12616 only affected tomcat 7 in Mageia 5.

Affected Systems

  • mageia•tomcat

    < 7.0.81-1.mga5

  • mageia•tomcat

    < 8.0.46-1.mga6

References (7)