Bug 1990252 (CVE-2021-3688)

Summary: CVE-2021-3688 Red Hat JBCS: URL normalization issue with dot-dot-semicolon(s) leads to information disclosure
Product: [Other] Security Response Reporter: Ted Jongseok Won <jwon>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aogburn, asoldano, bbaranow, bmaxwell, brian.stansberry, cdewolf, chazlett, csutherl, darran.lofthouse, dkreling, dosoudil, eleandro, fjuma, gzaronik, hhorak, iweiss, jclere, jochrist, jorton, jpallich, jperkins, jwon, kwills, lgao, luhliari, msochure, msvehla, nwallace, pjindal, pmackay, rguimara, rhcs-maint, rstancel, rsvoboda, smaestri, szappis, tom.jenkinson, yborgess
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains dot-dot-semicolon(s). This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1966279    

Description Ted Jongseok Won 2021-08-05 06:53:54 UTC 
Red Hat JBoss Core Services(JBCS) HTTP Server does not properly normalize the path component of a request URL contains dot-dot-semicolon(s) before forwarding to the backend server. For instance, JBCS forwards a request URL '/A/..;/B' to the backend server without proper URL normalization only if the path '/A' is mapped in the JBCS configuration. The flaw causes the path '/B' to be proxied to the client. But normally it must not be proxied.
Comment 4 Huzaifa S. Sidhpurwala 2021-11-15 10:21:48 UTC 
This flaw is essentially a product of interaction of tomcat with httpd. ASF does not consider this issue as CVE worthy at this point.
Comment 7 Ted Jongseok Won 2022-07-01 03:23:09 UTC 
CVE-2021-3688 added for the JBCS fix on https://access.redhat.com/errata/RHSA-2021:4613 and https://access.redhat.com/errata/RHSA-2021:4614.