Bug 429834

Summary:	CVE-2008-0128 tomcat5 SSO cookie login information disclosure [rhn_satellite_4.2]
Product:	Red Hat Satellite 5	Reporter:	Marc Schoenefeld <mschoene>
Component:	Other	Assignee:	Miroslav Suchý <msuchy>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Preethi Thomas <pthomas>
Severity:	low	Docs Contact:
Priority:	low
Version:	420	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	sat423	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-06-30 18:28:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	135141, 429821, 439866

Description Marc Schoenefeld 2008-01-23 11:11:59 UTC

rhn_satellite_4.2 tracking bug: see blocks bug list for full details of the security issue(s).

This bug is never intended to be made public, please put any public notes in the 'blocks' bugs.

For the security issues handling process overview see: http://intranet.corp.redhat.com/ic/intranet/SecurityZStreamFAQ

[bug automatically created by: add-tracking-bugs]

Comment 1 Miroslav Suchý 2008-04-16 11:59:50 UTC

Promoted tomcat5-5.0.30-0jpp_10rh.noarch.rpm from support-satellite-5.0-4AS-java
collection, where we fixed it.

Comment 2 Miroslav Suchý 2008-04-29 12:18:42 UTC

QA push for 4.2.3 complete: satellite-4.2.3-1 and proxy-4.2.3-1 are
now on webqa. Note that there is _no_ ISO planned for the 4.2.3
release.

Developers, please move your bugs ON_QA.

Comment 3 Preethi Thomas 2008-05-09 12:11:29 UTC

verified 
tomcat5-5.0.30-0jpp_10rh.noarch.rpm on both rhel3 & rhel4 satellites.

Comment 4 Steve Salevan 2008-06-24 20:22:35 UTC

Verified on Stage 423 RHEL3/4 satellites.  tomcat5-5.0.30-0jpp_10rh package is
available on both.  Moving to RELEASE_PENDING.

Comment 5 Preethi Thomas 2008-06-30 18:28:32 UTC

4.2.3 Satellite is now GA, bugs Closed for Current Release.