Bug 1548282 (CVE-2018-1305)
| Summary: | CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alee, avibelli, bgeorges, bmaxwell, ccoleman, cdewolf, chazlett, cmoulliard, coolsvap, csutherl, darran.lofthouse, dedgar, dimitris, dmcphers, dosoudil, drieden, fgavrilo, gzaronik, hhorak, igueye, ivan.afonichev, java-sig-commits, jawilson, jbalunas, jclere, jdoyle, jgoulding, jolee, jondruse, jorton, jpallich, jschatte, jshepherd, jstastny, krzysztof.daniel, lgao, loleary, lthon, mbabacek, mhatanak, mizdebsk, mszynkie, myarboro, pgallagh, pgier, ppalaga, psakar, pslavice, rhcs-maint, rnetuka, rruss, rstancel, rsvoboda, spinder, theute, trogers, twalsh, vhalbert, vtunka, weli, yozone |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | tomcat 7.0.85, tomcat 8.0.50, tomcat 8.5.28 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-08-06 13:18:40 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1548283, 1548284, 1550282, 1550283, 1550284, 1552374 | ||
| Bug Blocks: | 1548296 | ||
|
Description
Sam Fowler
2018-02-23 04:05:06 UTC
Created tomcat tracking bugs for this issue: Affects: epel-all [bug 1548283] Affects: fedora-all [bug 1548284] Created tomcat tracking bugs for this issue: Affects: fedora-all [bug 1550284] Affects: epel-all [bug 1550282] This issue has been addressed in the following products: Red Hat JBoss Web Server Via RHSA-2018:0465 https://access.redhat.com/errata/RHSA-2018:0465 This issue has been addressed in the following products: Red Hat JBoss Web Server 3 for RHEL 6 Red Hat JBoss Web Server 3 for RHEL 7 Via RHSA-2018:0466 https://access.redhat.com/errata/RHSA-2018:0466 This issue has been addressed in the following products: Red Hat Openshift Application Runtimes Via RHSA-2018:1320 https://access.redhat.com/errata/RHSA-2018:1320 This issue has been addressed in the following products: Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8 Via RHSA-2018:2939 https://access.redhat.com/errata/RHSA-2018:2939 This vulnerability is out of security support scope for the following products: * Red Hat JBoss Web Server 3 * Red Hat JBoss Web Server 3 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details. This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2205 https://access.redhat.com/errata/RHSA-2019:2205 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-1305 |