||
Skip to end of metadata
Go to start of metadata

Published: 19th December 2017

Severity: Please refer https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81


AFFECTED PRODUCTS


WSO2 API Manager 2.1.0

WSO2 App Manager 1.2.0

WSO2 Application Server 5.3.0

WSO2 Business Process Server 3.6.0

WSO2 Business Rules Server 2.2.0

WSO2 Complex Event Processor 4.2.0

WSO2 Dashboard Server 2.0.0

WSO2 Data Analytics Server 3.1.0

WSO2 Data Services Server 3.5.1

WSO2 Enterprise Integrator  6.1.1

WSO2 Governance Registry 5.4.0

WSO2 IoT Server 3.1.0

WSO2 Machine Learner 1.2.0

WSO2 Message Broker 3.2.0


OVERVIEW


Upgrade the embedded Apache Tomcat version of WSO2 products to 7.0.81 version, in order to support Tomcat level security fixes.



DESCRIPTION


With the Apache Tomcat upgrade, following Common Vulnerability Exposure is fixed.

CVE-2017-12616: Information Disclosure


IMPACT 


The WSO2 servers are exposed to known vulnerabilities of Apache Tomcat versions prior to 7.0.81.


SOLUTION


Apply the following patches based on your product version by following the instructions in the README file. If you have any questions, post them to security@wso2.com.

Please download the relevant patches based on the products you use following the matrix below. Patches can also be downloaded from https://wso2.com/security-patch-releases/.


Code

Product

Version

Patch

AMWSO2 API Manager2.1.0WSO2-CARBON-PATCH-4.4.0-1664
APPMWSO2 App Manager1.2.0WSO2-CARBON-PATCH-4.4.0-1668
ASWSO2 Application Server5.3.0WSO2-CARBON-PATCH-4.4.0-1670
BPSWSO2 Business Process Server3.6.0WSO2-CARBON-PATCH-4.4.0-1668
BRSWSO2 Business Rules Server2.2.0WSO2-CARBON-PATCH-4.4.0-1670
CEPWSO2 Complex Event Processor4.2.0WSO2-CARBON-PATCH-4.4.0-1665
DSWSO2 Dashboard Server2.0.0WSO2-CARBON-PATCH-4.4.0-1670
DASWSO2 Data Analytics Server3.1.0WSO2-CARBON-PATCH-4.4.0-1665
DSSWSO2 Data Services Server3.5.1WSO2-CARBON-PATCH-4.4.0-1665
EIWSO2 Enterprise Integrator6.1.1WSO2-CARBON-PATCH-4.4.0-1662
GREGWSO2 Governance Registry5.4.0WSO2-CARBON-PATCH-4.4.0-1654
IOTWSO2 IoT Server3.1.0WSO2-CARBON-PATCH-4.4.0-1663
MBWSO2 Message Broker3.2.0WSO2-CARBON-PATCH-4.4.0-1659
MLWSO2 Machine Learner1.2.0WSO2-CARBON-PATCH-4.4.0-1665


NOTES


If you are using newer versions of the products than the ones mentioned in the “SOLUTION” section, this vulnerability is fixed. Please apply the relevant patches in WSO2-2017-0255 security advisory as well, if you have not already applied.

The latest version of Apache Tomcat is 7.0.82 at the moment of this patch release, which addresses the CVE-2017-12617 reported on 7.0.81 version. However, WSO2 products are not affected by the reported vulnerabilities on 7.0.81 version.



  • No labels