{"id":"SUSE-SU-2023:3232-1","aliases":[],"status":"published","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- Remove the log4j dependency as it is not used by the tomcat package (bsc#1196137)\n    \nSecurity hardening, related to Spring Framework vulnerabilities:    \n- Deprecate getResources() and always return null (bsc#1198136).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-08-08T14:47:59Z","modified":"2023-08-08T14:47:59Z","fixes":[{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"tomcat","fixed_in":["8.0.53-29.54.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"tomcat","fixed_in":["8.0.53-29.54.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"javapackages-tools","fixed_in":["5.3.1-14.7.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.54.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.54.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-14.7.3"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233232-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196137","tags":["report"]},{"url":"https://bugzilla.suse.com/1198136","tags":["report"]}],"sources":{"osv":[{"id":"SUSE-SU-2023:3232-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- Remove the log4j dependency as it is not used by the tomcat package (bsc#1196137)\n    \nSecurity hardening, related to Spring Framework vulnerabilities:    \n- Deprecate getResources() and always return null (bsc#1198136).\n","status":"published","published":"2023-08-08T14:47:59Z","modified":"2023-08-08T14:47:59Z","updated_at":"2026-11-02T15:53:53.440387Z"}]}}