Bug 1493222 (CVE-2017-12616)

Summary:	CVE-2017-12616 tomcat: Information Disclosure when using VirtualDirContext
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akurtako, alee, bmaxwell, ccoleman, cdewolf, chazlett, coolsvap, csutherl, darran.lofthouse, dedgar, dimitris, dmcphers, dosoudil, fgavrilo, gzaronik, hhorak, ivan.afonichev, java-sig-commits, jawilson, jclere, jcoleman, jdoyle, jgoulding, jolee, jondruse, jorton, jshepherd, kbost, krzysztof.daniel, lgao, loleary, mbabacek, mizdebsk, myarboro, nwallace, pgier, ppalaga, pslavice, rnetuka, rstancel, rsvoboda, spinder, theute, twalsh, vhalbert, vtunka, weli, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	tomcat 7.0.81	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-20 21:16:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1493224, 1493225
Bug Blocks:	1493229

Description Adam Mariš 2017-09-19 16:10:55 UTC

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.

Affected versions: 7.0.0 to 7.0.80

Upstream patch:

https://svn.apache.org/viewvc?view=revision&revision=1804729

External References:

https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81

Comment 1 Adam Mariš 2017-09-19 16:11:32 UTC

Created jbossweb tracking bugs for this issue:

Affects: openshift-1 [bug 1493224]


Created tomcat tracking bugs for this issue:

Affects: epel-6 [bug 1493225]

Comment 3 Jason Shepherd 2017-09-21 01:06:47 UTC

VirtualDirContext is not designed to be used in Production. Also, because the information disclosed is only the source code for JSP setting this issue to WONTFIX.

Comment 6 Doran Moppert 2017-09-25 05:33:24 UTC

Statement:

VirtualDirContext is not designed to be used in production, but only to ease development with IDEs without needing to fully republish jars in WEB-INF/lib.

Comment 7 Doran Moppert 2017-10-03 01:52:54 UTC

Tomcat 5, provided with Red Hat Enterprise Linux 5, is not affected by this issue.

Comment 8 errata-xmlrpc 2018-03-07 15:10:21 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2018:0465 https://access.redhat.com/errata/RHSA-2018:0465

Comment 9 errata-xmlrpc 2018-03-07 15:24:00 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3 for RHEL 6
  Red Hat JBoss Web Server 3 for RHEL 7

Via RHSA-2018:0466 https://access.redhat.com/errata/RHSA-2018:0466

Comment 12 Joshua Padman 2019-08-06 04:32:48 UTC

This vulnerability is out of security support scope for the following product:
 * Red Hat JBoss Web Server 3 

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 13 Product Security DevOps Team 2020-05-20 21:16:30 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-12616