Amazon Linux AMI : tomcat6 / tomcat7,tomcat8 (ALAS-2016-722) (httpoxy)
Medium Nessus Plugin ID 92469
SynopsisThe remote Amazon Linux AMI host is missing a security update.
DescriptionTomcat's CGI support used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request (known as the 'httpoxy' class of vulnerabilities).
SolutionRun 'yum update tomcat6' to update your system.
Run 'yum update tomcat7' to update your system.
Run 'yum update tomcat8' to update your system.