Bug 1088342 (CVE-2014-0096)
Summary: | CVE-2014-0096 Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Arun Babu Neelicattu <aneelica> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | low | Docs Contact: | |
Priority: | low | ||
Version: | unspecified | CC: | anil.saldhana, bdawidow, cdewolf, chazlett, chuffman, csutherl, darran.lofthouse, epp-bugs, erich, fnasser, grocha, huwang, ivan.afonichev, jawilson, jclere, jcoleman, jdg-bugs, jdoyle, jkurik, jpallich, kconner, kejohnso, krzysztof.daniel, lgao, mjc, mmiura, mweiler, myarboro, pgier, pslavice, rhq-maint, rsvoboda, security-response-team, soa-p-jira, spinder, theute, ttarrant, vtunka, weli |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | tomcat 7.0.53, tomcat 6.0.41 | Doc Type: | Bug Fix |
Doc Text: |
It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2019-06-08 02:32:35 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1102163, 1102124, 1102125, 1102126, 1102128, 1102129, 1102130, 1102148, 1102149, 1102150, 1102151, 1102152, 1102153, 1102154, 1102155, 1102156, 1102157, 1102158, 1102159, 1102160, 1102161, 1102162, 1102164, 1102165, 1102166, 1102167, 1102171, 1102172, 1113319, 1113326, 1113339, 1160690 | ||
Bug Blocks: | 1079805, 1082938, 1097027, 1102015, 1103878, 1105099, 1105100, 1105275, 1108465, 1181883, 1182400, 1182419, 1200191 |
Description
Arun Babu Neelicattu
2014-04-16 13:19:53 UTC
Upstream Patch Commits: [tc6] http://svn.apache.org/viewvc?view=revision&revision=1585853 [tc7 part 1] http://svn.apache.org/viewvc?view=revision&revision=1578637 [tc7 part 2] http://svn.apache.org/viewvc?view=revision&revision=1578655 [jboss-web] https://source.jboss.org/changelog/JBossWeb?cs=2427 Created tomcat tracking bugs for this issue: Affects: fedora-all [bug 1102152] Tomcat 6 fix: http://svn.apache.org/viewvc?view=revision&revision=1585853 Tomcat 7 fix: http://svn.apache.org/viewvc?view=revision&revision=1578637 and http://svn.apache.org/viewvc?view=revision&revision=1578655 This issue has been addressed in following products: Red Hat Enterprise Linux 7 Via RHSA-2014:0827 https://rhn.redhat.com/errata/RHSA-2014-0827.html This issue has been addressed in following products: JBoss Enterprise Web Server 2.0.1 Via RHSA-2014:0836 https://rhn.redhat.com/errata/RHSA-2014-0836.html This issue has been addressed in following products: JBEWS 2 for RHEL 5 JBEWS 2 for RHEL 6 Via RHSA-2014:0835 https://rhn.redhat.com/errata/RHSA-2014-0835.html This issue has been addressed in following products: JBoss Enterprise Web Server 2.0.1 Via RHSA-2014:0833 https://rhn.redhat.com/errata/RHSA-2014-0833.html This issue has been addressed in following products: JBEWS 2 for RHEL 5 JBEWS 2 for RHEL 6 Via RHSA-2014:0834 https://rhn.redhat.com/errata/RHSA-2014-0834.html This issue has been addressed in following products: JBEAP 6.2 for RHEL 6 JBEAP 6.2 for RHEL 5 Via RHSA-2014:0843 https://rhn.redhat.com/errata/RHSA-2014-0843.html This issue has been addressed in following products: JBoss Enterprise Application Platform 6.2.4 Via RHSA-2014:0842 https://rhn.redhat.com/errata/RHSA-2014-0842.html Statement: This issue does affect JBossWeb as shipped in Red Hat JBoss Enterprise Application Platform 5. Red Hat Product Security has rated this issue as having Low security impact. Red Hat JBoss Enterprise Application Platform 5 is currently in reduced support phase (Phase 2: Maintenance Support), receiving only Critical and Important security updates, hence this issue is not currently planned to be addressed in future updates for Red Hat Enterprise Application Platform 5. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/ and the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2014:0865 https://rhn.redhat.com/errata/RHSA-2014-0865.html This issue has been addressed in following products: JBoss Data Grid 6.3.0 Via RHSA-2014:0895 https://rhn.redhat.com/errata/RHSA-2014-0895.html IssueDescription: It was found that the org.apache.catalina.servlets.DefaultServlet implementation in JBoss Web / Apache Tomcat allowed the definition of XML External Entities (XXEs) in provided XSLTs. A malicious application could use this to circumvent intended security restrictions to disclose sensitive information. This issue has been addressed in the following products: Red Hat JBoss BRMS 6.0.3 Via RHSA-2015:0235 https://rhn.redhat.com/errata/RHSA-2015-0235.html This issue has been addressed in the following products: Red Hat JBoss BPM Suite 6.0.3 Via RHSA-2015:0234 https://rhn.redhat.com/errata/RHSA-2015-0234.html tomcat-7.0.59-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in the following products: JBoss Data Virtualization 6.1.0 Via RHSA-2015:0675 https://rhn.redhat.com/errata/RHSA-2015-0675.html This issue has been addressed in the following products: Red Hat JBoss Fuse Service Works 6.0.0 Via RHSA-2015:0720 https://rhn.redhat.com/errata/RHSA-2015-0720.html This issue has been addressed in the following products: Red Hat JBoss Data Virtualization 6.0.0 Via RHSA-2015:0765 https://rhn.redhat.com/errata/RHSA-2015-0765.html This issue has been addressed in the following products: JBoss Portal 6.2.0 Via RHSA-2015:1009 https://rhn.redhat.com/errata/RHSA-2015-1009.html |