Bug 1811347

Summary:	updated package needed with patch for cve-2020-1938
Product:	[Fedora] Fedora EPEL	Reporter:	philip73811
Component:	tomcat	Assignee:	Orphan Owner <extras-orphan>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	epel7	CC:	alee, coolsvap, csutherl, extras-orphan, ivan.afonichev, java-sig-commits, krzysztof.daniel
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-09 12:57:23 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description philip73811 2020-03-07 21:39:46 UTC

Description of problem:

https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487
Version-Release number of selected component (if applicable):

all current versions

Comment 1 Coty Sutherland 2020-03-09 12:57:23 UTC

I'm marking this as a duplicate of the fedora tracker for CVE-2020-1938. There's already an update in progress to resolve this, see https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-81c37f8ff5.

In the meantime, you don't have to wait for an update to protect mitigate this vulnerability. Please review the guidance provided in https://access.redhat.com/security/cve/CVE-2020-1938 and https://access.redhat.com/solutions/4851251 as soon as you can and update your configurations accordingly.

*** This bug has been marked as a duplicate of bug 1806805 ***