Apache Tomcat 9.0.62 Security Vulnerability Affects Multiple SUSE Linux Distributions

A security vulnerability has been discovered in the packaging of Apache Tomcat on several SUSE Linux distributions, including SUSE Linux Enterprise Server 15-LTSS and earlier versions of SUSE Linux Enterprise Server 12 and 12-SP3. The vulnerability allows local attackers to escalate from group tomcat to root.

The issue affects the following distributions:

* SUSE Linux Enterprise Server 15-LTSS, with Tomcat versions prior to 9.0.35-3.57.3

* SUSE Linux Enterprise Server 12-SP5, with Tomcat versions prior to 9.0.35-3.39.1

* SUSE Linux Enterprise Server 12-SP4, with Tomcat versions prior to 9.0.35-3.39.1

* SUSE Linux Enterprise Server 12-SP3-LTSS, with Tomcat versions prior to 8.0.53-29.32.1

* SUSE Linux Enterprise Server 12-SP3-BCL, with Tomcat versions prior to 8.0.53-29.32.1

* SUSE Linux Enterprise Server 12-SP2-LTSS, with Tomcat versions prior to 8.0.53-29.32.1

* SUSE Linux Enterprise Server 12-SP2-BCL, with Tomcat versions prior to 8.0.53-29.32.1

* This issue also affects SUSE Enterprise Storage 5, with Tomcat versions prior to 8.0.53-29.32.1.

The vulnerability is related to incorrect default permissions in the packaging of Tomcat on these distributions. An attacker can exploit this vulnerability by using a local attack vector to escalate their privileges from group tomcat to root.

To mitigate this issue, administrators are advised to upgrade their Tomcat versions to the latest available version or patch their systems according to SUSE's security advisories.

In addition to the security advisory, Apache provides various distribution packages for its Tomcat software. These include:

* apache-tomcat-9.0.62.tar.gz: The source code of Tomcat

* apache-tomcat-windows-x64.zip: A 64-bit Windows specific distribution that includes the Windows service wrapper and the compiled APR/native library for use with 64-bit JVMs

* apache-tomcat-windows-x86.zip: A 32-bit Windows specific distribution that includes the Windows service wrapper and the compiled APR/native library for use with 32-bit JVMs on both 32-bit and 64-bit Windows platforms

* apache-tomcat-9.0.62.exe: A 32-bit/64-bit Windows installer for Tomcat

These distributions do not include the Windows service wrapper or the compiled APR/native library for Windows.

Apache also provides additional documentation, including the Tomcat documentation bundle, which includes complete javadocs, and the RUNNING.txt file in the distribution, which contains important information about using Tomcat. Release notes are available for each version of Tomcat, providing details on changes and improvements made to the software.

It's worth noting that tar files in this distribution use GNU tar extensions and must be untarred with a GNU compatible version of tar. Additionally, users planning to launch Tomcat through the Windows service wrapper should download the correct distribution package for their platform.

Apache tomcat 9.0 62