Bug 1805006 (CVE-2020-6950)

Summary: CVE-2020-6950 Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371
Product: [Other] Security Response Reporter: Ted Jongseok Won <jwon>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, asoldano, atangrin, avibelli, bbaranow, bgeorges, bkearney, bmaxwell, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dkreling, dosoudil, drieden, etirelli, extras-orphan, ggaughan, gvarsami, ibek, iweiss, janstey, java-sig-commits, jawilson, jbalunas, jcoleman, jochrist, jpallich, jperkins, jstastny, jwon, kconner, krathod, kverlaen, kwills, ldimaggi, lef, lgao, loleary, lthon, mnovotny, msochure, msvehla, mszynkie, nwallace, paradhya, pdrozd, pgallagh, pjindal, pmackay, psotirop, puntogil, rguimara, rrajasek, rruss, rstancel, rsvoboda, rsynek, rwagner, sdaley, smaestri, spinder, sthorger, tcunning, theute, tkirby, tlestach, tom.jenkinson, ytale
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: glassfish-jsf-impl 2.3.14, glassfish-jsf-impl 3.0.0-RC1 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Eclipse Mojarra before version 2.3.14, where it is vulnerable to a path traversal flaw via the loc parameter or the con parameter. An attacker could exploit this flaw to read arbitrary files.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-05-12 22:32:03 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1783879    

Description Ted Jongseok Won 2020-02-20 05:34:11 UTC
Eclipse Mojarra before version 2.3.14 is vulnerable to a path traversal flaw via either the loc parameter or the con parameter. An attacker could exploit this to read arbitrary files. It was reported as CVE-2019-0199, but it was an incomplete fix.

Upstream Patch:
https://github.com/eclipse-ee4j/mojarra/commit/1b434748d9239f42eae8aa7d37d7a0930c061e24
https://github.com/eclipse-ee4j/mojarra/commit/cefbb9447e7be560e59da2da6bd7cb93776f7741

Comment 2 Ted Jongseok Won 2020-02-21 04:48:28 UTC
*** Bug 1805008 has been marked as a duplicate of this bug. ***

Comment 3 Ted Jongseok Won 2020-02-21 04:59:56 UTC
Acknowledgments:

Name: An Trinh

Comment 13 Jonathan Christison 2020-03-23 17:27:59 UTC
This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notesfor more details.

Comment 17 Chess Hazlett 2020-05-12 15:18:32 UTC
Mitigation:

There is no currently known mitigation for this flaw.

Comment 18 errata-xmlrpc 2020-05-12 17:17:40 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign On 7.3

Via RHSA-2020:2113 https://access.redhat.com/errata/RHSA-2020:2113

Comment 19 Product Security DevOps Team 2020-05-12 22:32:03 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-6950

Comment 20 errata-xmlrpc 2020-06-10 19:06:00 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2020:2511 https://access.redhat.com/errata/RHSA-2020:2511

Comment 21 errata-xmlrpc 2020-06-10 19:24:17 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:2515 https://access.redhat.com/errata/RHSA-2020:2515

Comment 22 errata-xmlrpc 2020-06-11 07:09:03 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2020:2513 https://access.redhat.com/errata/RHSA-2020:2513

Comment 23 errata-xmlrpc 2020-06-11 07:17:19 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2020:2512 https://access.redhat.com/errata/RHSA-2020:2512

Comment 24 errata-xmlrpc 2020-07-23 07:04:39 UTC
This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:2905 https://access.redhat.com/errata/RHSA-2020:2905

Comment 26 errata-xmlrpc 2020-08-31 15:40:58 UTC
This issue has been addressed in the following products:

  EAP-CD 20 Tech Preview

Via RHSA-2020:3585 https://access.redhat.com/errata/RHSA-2020:3585

Comment 27 errata-xmlrpc 2020-09-07 12:56:03 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

Via RHSA-2020:3637 https://access.redhat.com/errata/RHSA-2020:3637

Comment 28 errata-xmlrpc 2020-09-07 12:59:00 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2020:3639 https://access.redhat.com/errata/RHSA-2020:3639

Comment 29 errata-xmlrpc 2020-09-07 13:02:08 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

Via RHSA-2020:3638 https://access.redhat.com/errata/RHSA-2020:3638

Comment 30 errata-xmlrpc 2020-09-07 13:06:20 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:3642 https://access.redhat.com/errata/RHSA-2020:3642

Comment 33 errata-xmlrpc 2021-08-11 18:22:37 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.9

Via RHSA-2021:3140 https://access.redhat.com/errata/RHSA-2021:3140