Bug 1375757 (CVE-2016-7041)

Summary: CVE-2016-7041 Drools Workbench: Path traversal vulnerability
Product: [Other] Security Response Reporter: Pavel Polischouk <pavelp>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: alazarot, csadilek, eignatow, etirelli, jcoleman, kverlaen, lpetrovi, mbaluch, mwinkler, nwallace, pavelp, prego, rrajasek, rzhang, security-response-team, tkirby
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20161128,reported=20160626,source=researcher,cvss2=6.8/AV:N/AC:L/Au:S/C:C/I:N/A:N,cvss3=6.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N,cwe=CWE-22,bpms-6/workbench=affected,brms-6/workbench=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host.
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-12-08 21:36:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 1350342    

Description Pavel Polischouk 2016-09-13 23:43:25 UTC
Drools Workbench contains the path traversal vulnerability. The vulnerability allows a remote authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected host.

Comment 1 Pavel Polischouk 2016-09-13 23:43:34 UTC
Acknowledgments:

Name: Jonas Bauters (NVISO)

Comment 6 errata-xmlrpc 2016-11-28 17:55:59 UTC
This issue has been addressed in the following products:

  Red Hat JBoss BRMS 6.4.0

Via RHSA-2016:2823 https://rhn.redhat.com/errata/RHSA-2016-2823.html

Comment 7 errata-xmlrpc 2016-11-28 17:56:50 UTC
This issue has been addressed in the following products:

  Red Hat JBoss BPM Suite 6.4.0

Via RHSA-2016:2822 https://rhn.redhat.com/errata/RHSA-2016-2822.html

Comment 8 errata-xmlrpc 2016-12-08 19:57:08 UTC
This issue has been addressed in the following products:

  Red Hat JBoss BRMS 6.3.4

Via RHSA-2016:2938 https://rhn.redhat.com/errata/RHSA-2016-2938.html

Comment 9 errata-xmlrpc 2016-12-08 19:57:21 UTC
This issue has been addressed in the following products:

  Red Hat JBoss BPM Suite 6.3.4

Via RHSA-2016:2937 https://rhn.redhat.com/errata/RHSA-2016-2937.html