Bug 1224787 (CVE-2015-3198)

Summary: CVE-2015-3198 JBOSS: JSP source code leak when a slash added at the end of the URL
Product: [Other] Security Response Reporter: Fabio Olive Leite <fleite>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: anmiller, bdawidow, cdewolf, dandread, darran.lofthouse, jawilson, jboss-set, lgao, myarboro, pgier, pskopek, pslavice, rsvoboda, twalsh, vtunka
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-07-22 12:14:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Fabio Olive Leite 2015-05-25 17:48:17 UTC 
A flaw was reported in the Undertow module of WildFly that leaks the
source code of a JSP page when a trailing slash (/) is added to the
end of its URL.

This issue did not affect any versions of Red Hat JBoss Enterprise
Application Platform because this flaw only affects the Undertow web
module; JBoss EAP uses JBoss Web.
Comment 1 Fabio Olive Leite 2015-05-25 17:53:32 UTC 
References:
https://issues.jboss.org/browse/WFLY-4595
Comment 3 Timothy Walsh 2015-07-22 12:11:00 UTC 
Confirmed this is not a problem for EAP 6.4.x.
Comment 4 Timothy Walsh 2015-07-22 12:14:21 UTC 
Marking this as closed.  It has been fixed in WildFly 9.0.0.CR2, 10.0.0.Alpha1.