Security Advisory WSO2-2017-0255

Published: 4th September 2017

Severity: Please refer https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.77

AFFECTED PRODUCTS

WSO2 API Manager 2.1.0

WSO2 API Manager Analytics 2.1.0

WSO2 App Manager 1.2.0

WSO2 Application Server 5.3.0

WSO2 Business Process Server 3.6.0

WSO2 Business Rules Server 2.2.0

WSO2 Complex Event Processor 4.2.0

WSO2 Dashboard Server 2.0.0

WSO2 Data Analytics Server 3.1.0

WSO2 Data Services Server 3.5.1

WSO2 Enterprise Mobility Manager 2.2.0

WSO2 Governance Registry 5.4.0

WSO2 Identity Server 5.3.0

WSO2 Identity Server Analytics 5.3.0

WSO2 IoT Server 3.0.0

WSO2 Machine Learner 1.2.0

WSO2 Storage Server 1.5.0

OVERVIEW

Upgrade the embedded Apache Tomcat version to 7.0.77 to support Tomcat level security fixes.

DESCRIPTION

With the Apache Tomcat upgrade, following Common Vulnerability Exposure is fixed.

CVE-2017-5647: Information Disclosure

IMPACT 

The WSO2 servers are exposed to known vulnerabilities of Apache Tomcat versions prior to 7.0.77

SOLUTION

Apply the following patches based on your product version by following the instructions in the README file. If you have any questions, post them to security@wso2.com.

Please download the relevant patches based on the products you use following the matrix below. Patches can also be downloaded from http://wso2.com/security-patch-releases/.

NOTES

If you are using newer versions of the products than the ones mentioned in the “SOLUTION” section, this vulnerability is fixed.