Apache Tomcat Multiple Vulnerabilities (CVE-2019-12418/CVE-2019-17563)

Apache Software Foundation has announced the following multiple critical vulnerabilities for Apache Tomcat:

• CVE-2019-12418 
  Insufficiently protected credentials may cause information leakage.

• CVE-2019-17563
  There was a narrow window where an attacker could perform a session fixation attack.

These vulnerabilities exist in the following versions of Apache Tomcat:

• CVE-2019-12418
  　　Apache Tomcat 9.0.0.M1 to 9.0.28
  　　Apache Tomcat 8.5.0 to 8.5.47
  　　Apache Tomcat 7.0.0 to 7.0.97
  
  
• CVE-2019-17563
  　　Apache Tomcat 9.0.0.M1 to 9.0.29
  　　Apache Tomcat 8.5.0 to 8.5.49
  　　Apache Tomcat 7.0.0 to 7.0.98

For more detail, contact Apache Software Foundation. 

Impact on the WingArc1st Products

CVE-2019-17563 can affect following products: 

CVE-2019-12418 has no effect on our products.

Solution

For SVF and SPA, we will release following service packs to address the issues.

For Dr. Sum, we confirmed the vulnerability has no effect.

For MotionBoard, we confirmed the vulnerability has no effect.