Security Advisory WSO2-2017-0255¶
Published: September 04, 2017
Severity: Please refer[^1]
AFFECTED PRODUCTS¶
- WSO2 API Manager 2.1.0
- WSO2 API Manager Analytics 2.1.0
- WSO2 App Manager 1.2.0
- WSO2 Application Server 5.3.0
- WSO2 Business Process Server 3.6.0
- WSO2 Business Rules Server 2.2.0
- WSO2 Complex Event Processor 4.2.0
- WSO2 Dashboard Server 2.0.0
- WSO2 Data Analytics Server 3.1.0
- WSO2 Data Services Server 3.5.1
- WSO2 Enterprise Mobility Manager 2.2.0
- WSO2 Governance Registry 5.4.0
- WSO2 Identity Server 5.3.0
- WSO2 Identity Server Analytics 5.3.0
- WSO2 IoT Server 3.0.0
- WSO2 Machine Learner 1.2.0
- WSO2 Storage Server 1.5.0
OVERVIEW¶
Upgrade the embedded Apache Tomcat version to 7.0.77 to support Tomcat-level security fixes.
DESCRIPTION¶
With the Apache Tomcat upgrade, the following Common Vulnerability Exposure is fixed.
CVE-2017-5647: Information Disclosure
IMPACT¶
The WSO2 servers are exposed to known vulnerabilities of Apache Tomcat versions prior to 7.0.77.
SOLUTION¶
Apply the following patches based on your product version by following the instructions in the README file. If you have any questions, post them to security@wso2.com.
Download the relevant patches based on the products you use by following the matrix below. Patches can also be downloaded from Security Patch Releases.
| Code | Product | Version | Patch |
|---|---|---|---|
| AM | WSO2 API Manager | 2.1.0 | WSO2-CARBON-PATCH-4.4.0-1158 WSO2-CARBON-PATCH-4.4.0-0941 |
| AM-Analytics | WSO2 API Manager Analytics | 2.1.0 | WSO2-CARBON-PATCH-4.4.0-1178 |
| AppM | WSO2 App Manager | 1.2.0 | WSO2-CARBON-PATCH-4.4.0-1145 |
| AS | WSO2 Application Server | 5.3.0 | WSO2-CARBON-PATCH-4.4.0-1134 WSO2-CARBON-PATCH-4.4.0-0829 WSO2-CARBON-PATCH-4.4.0-0237 |
| BPS | WSO2 Business Process Server | 3.6.0 | WSO2-CARBON-PATCH-4.4.0-1145 |
| BRS | WSO2 Business Rules Server | 2.2.0 | WSO2-CARBON-PATCH-4.4.0-1134 WSO2-CARBON-PATCH-4.4.0-0887 WSO2-CARBON-PATCH-4.4.0-0235 |
| CEP | WSO2 Complex Event Processor | 4.2.0 | WSO2-CARBON-PATCH-4.4.0-1152 WSO2-CARBON-PATCH-4.4.0-0831 |
| DAS | WSO2 Data Analytics Server | 3.1.0 | WSO2-CARBON-PATCH-4.4.0-1152 WSO2-CARBON-PATCH-4.4.0-0831 |
| DS | WSO2 Dashboard Server | 2.0.0 | WSO2-CARBON-PATCH-4.4.0-1134 WSO2-CARBON-PATCH-4.4.0-0887 WSO2-CARBON-PATCH-4.4.0-0235 |
| DSS | WSO2 Data Services Server | 3.5.1 | WSO2-CARBON-PATCH-4.4.0-1152 WSO2-CARBON-PATCH-4.4.0-0831 |
| EMM | WSO2 Enterprise Mobility Manager | 2.2.0 | WSO2-CARBON-PATCH-4.4.0-1200 |
| GREG | WSO2 Governance Registry | 5.4.0 | WSO2-CARBON-PATCH-4.4.0-1159 |
| IoTS | WSO2 IoT Server | 3.0.0 | WSO2-CARBON-PATCH-4.4.0-1158 WSO2-CARBON-PATCH-4.4.0-0941 |
| IS | WSO2 Identity Server | 5.3.0 | WSO2-CARBON-PATCH-4.4.0-1158 WSO2-CARBON-PATCH-4.4.0-0941 |
| IS-Analytics | WSO2 Identity Server Analytics | 5.3.0 | WSO2-CARBON-PATCH-4.4.0-1178 |
| ML | WSO2 Machine Learner | 1.2.0 | WSO2-CARBON-PATCH-4.4.0-1152 WSO2-CARBON-PATCH-4.4.0-0831 |
| SS | WSO2 Storage Server | 1.5.0 | WSO2-CARBON-PATCH-4.3.0-0020 WSO2-CARBON-PATCH-4.3.0-0006 |
Info
If you are using newer versions of the products than the ones mentioned in the "SOLUTION" section, this vulnerability is fixed.