Solution
Please Install the Updated Packages.
Insight
Apache Tomcat is a servlet container for
the Java Servlet and JavaServer Pages (JSP) technologies.
It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same Apache Tomcat instance. (CVE-2014-0119)
All Tomcat users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Tomcat must be restarted for this update to take effect.
Affected
tomcat on CentOS 7
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2014-0119 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:P/I:N/A:N
Related Vulnerabilities