Bug 71177
Summary: | Content-type not set for errors | ||||||
---|---|---|---|---|---|---|---|
Product: | [Retired] Stronghold Cross Platform | Reporter: | Gary Benson <gbenson> | ||||
Component: | tomcat | Assignee: | Gary Benson <gbenson> | ||||
Status: | CLOSED ERRATA | QA Contact: | Stronghold Engineering List <stronghold-eng-list> | ||||
Severity: | medium | Docs Contact: | |||||
Priority: | medium | ||||||
Version: | 4.0 | CC: | stronghold-eng-list | ||||
Target Milestone: | --- | ||||||
Target Release: | --- | ||||||
Hardware: | All | ||||||
OS: | Linux | ||||||
Whiteboard: | |||||||
Fixed In Version: | Doc Type: | Bug Fix | |||||
Doc Text: | Story Points: | --- | |||||
Clone Of: | Environment: | ||||||
Last Closed: | 2002-11-07 17:41:12 UTC | Type: | --- | ||||
Regression: | --- | Mount Type: | --- | ||||
Documentation: | --- | CRM: | |||||
Verified Versions: | Category: | --- | |||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
Cloudforms Team: | --- | Target Upstream Version: | |||||
Embargoed: | |||||||
Attachments: |
|
Description
Gary Benson
2002-08-09 16:29:18 UTC
Note that this bug neatly makes SH4 invulnerable to the cross-site scripting attack detailed in http://www.westpoint.ltd.uk/advisories/wp-02-0008.txt. This must obviously be remedied before we fix this bug. The advisory mentioned above has been classified as http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0682. Even without the above bug Stronghold isn't vulnerable to the exploit in the default configuration, but it is vulnerable if the user enables the Tomcat-Standalone service. Created attachment 77007 [details]
Script to check vulnerability
Note that stronghold-tomcat-4.0.3-2 (at least as we ship it) was never vulnerable to the fourth test. I was wrong when I said Stronghold is only vulnerable if the user enables the Tomcat-Standalone service. Replace 'http://localhost:8080/' with 'http://ServerName/stronghold/examples/java/' in the attached test script, for example. An errata has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2002-218.html |