Bug 1548289 (CVE-2018-1304)
| Summary: | CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alee, avibelli, bgeorges, bmaxwell, ccoleman, cdewolf, chazlett, cmoulliard, coolsvap, csutherl, darran.lofthouse, dedgar, dimitris, dmcphers, dosoudil, drieden, fgavrilo, gzaronik, hhorak, igueye, ivan.afonichev, java-sig-commits, jawilson, jbalunas, jclere, jdoyle, jgoulding, jolee, jondruse, jorton, jpallich, jschatte, jshepherd, jstastny, krzysztof.daniel, lgao, loleary, lthon, mbabacek, mhatanak, mizdebsk, mszynkie, myarboro, pgallagh, pgier, pjurak, ppalaga, psakar, pslavice, rhcs-maint, rnetuka, rruss, rstancel, rsvoboda, spinder, theute, trogers, twalsh, vhalbert, vtunka, weli, yozone |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | tomcat 7.0.85, tomcat 8.0.50, tomcat 8.5.28 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-08 03:41:02 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1548290, 1548291, 1548974, 1548975, 1550285, 1550286, 1550287, 1552375 | ||
| Bug Blocks: | 1548296 | ||
Created tomcat tracking bugs for this issue: Affects: epel-all [bug 1548291] Affects: fedora-all [bug 1548290] Created tomcat tracking bugs for this issue: Affects: fedora-all [bug 1550285] Affects: epel-all [bug 1550287] This issue has been addressed in the following products: Red Hat JBoss Web Server Via RHSA-2018:0465 https://access.redhat.com/errata/RHSA-2018:0465 This issue has been addressed in the following products: Red Hat JBoss Web Server 3 for RHEL 6 Red Hat JBoss Web Server 3 for RHEL 7 Via RHSA-2018:0466 https://access.redhat.com/errata/RHSA-2018:0466 JBoss EAP 6.x, which includes jbossweb component is no longer included in Openshift Online. Marking as not affected. This issue has been addressed in the following products: Red Hat Openshift Application Runtimes Via RHSA-2018:1320 https://access.redhat.com/errata/RHSA-2018:1320 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2018:1447 https://access.redhat.com/errata/RHSA-2018:1447 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Via RHSA-2018:1448 https://access.redhat.com/errata/RHSA-2018:1448 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Via RHSA-2018:1449 https://access.redhat.com/errata/RHSA-2018:1449 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Via RHSA-2018:1450 https://access.redhat.com/errata/RHSA-2018:1450 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Via RHSA-2018:1451 https://access.redhat.com/errata/RHSA-2018:1451 This issue has been addressed in the following products: Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8 Via RHSA-2018:2939 https://access.redhat.com/errata/RHSA-2018:2939 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2205 https://access.redhat.com/errata/RHSA-2019:2205 |
Apache Tomcat versions 7.0.0 to 7.0.84, 8.0.0.RC1 to 8.0.49 and 8.5.0 to 8.5.27 does not properly handle the URL empty string ("") when used as part of a security constraint definition. This can lead to the security constraint being ignored, leading to unitended exposure of resources. External References: https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.85 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.50 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.28 Upstream Bug Report: https://bz.apache.org/bugzilla/show_bug.cgi?id=62067 Upstream Fixes: Tomcat 7.0.x: http://svn.apache.org/viewvc?view=rev&rev=1823309 Tomcat 8.0.x: http://svn.apache.org/viewvc?view=rev&rev=1814827 Tomcat 8.5.x: http://svn.apache.org/viewvc?view=rev&rev=1823307