Bug 1131350 (CVE-2014-4172)
| Summary: | CVE-2014-4172 cas-client: Bypass of security constraints via URL parameter injection | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | David Jorm <djorm> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | bazulay, bdawidow, bmcclain, chazlett, dblechte, ecohen, epp-bugs, fedora, gklein, grocha, hfnukal, idith, iheim, java-sig-commits, jpallich, lsurette, michal.skrivanek, mjc, mweiler, rbalakri, Rhev-m-bugs, theute, yeylon, ylavi |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | cas-client 3.3.2, cas-client-core 3.3.2 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-01-22 18:25:50 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1131351, 1131352, 1131353, 1131354, 1131355, 1131356, 1131371 | ||
| Bug Blocks: | 1131366 | ||
|
Description
David Jorm
2014-08-19 05:53:16 UTC
External References: https://www.mail-archive.com/cas-user@lists.jasig.org/msg17338.html Created cas-client tracking bugs for this issue: Affects: fedora-all [bug 1131371] Upstream Issue: https://issues.jasig.org/browse/CASC-228 Upstream Commits: java-cas-client/master https://github.com/Jasig/java-cas-client/commit/ae37092100c8eaec610dab6d83e5e05a8ee58814 cas-client-3.3.3-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. As noted in the Debian bug, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718, php-cas 1.3.3 fixed this issue there. php-pear-CAS 1.3.3 is already in Fedora and EPEL. (In reply to Murray McAllister from comment #10) > As noted in the Debian bug, > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718, php-cas 1.3.3 > fixed this issue there. > > php-pear-CAS 1.3.3 is already in Fedora and EPEL. https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog This issue has been addressed in the following products: JBoss Portal 6.2.0 Via RHSA-2015:1009 https://rhn.redhat.com/errata/RHSA-2015-1009.html This issue does not affect JasperReports as used in Red Hat Enterprise Virtualization Manager, marking wontfix. |