Bug 1102038 – CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1102038 - (CVE-2014-0119) CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application

Summary:	CVE-2014-0119 Tomcat/JBossWeb: XML parser hijack by malicious web application

Status:	NEW

Aliases:	CVE-2014-0119

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20140527,reported=2...
Keywords:	Security

Depends On:	1109005 1160690 1102182 1102184 1102186 1102188 1102190 1102192 1108995 1108996 1108997 1108998 1108999 1109000 1109001 1109002 1109004 1109006 1109007 1109008 1109009 1109013 1109014 1109474 1109475 1113339
Blocks:	1064757 1082938 1097027 1102039 1103878 1108465 1109261 1109262 1181883 1182400 1182419 1200191
	Show dependency tree / graph

Reported:	2014-05-28 07:28 EDT by Arun Babu Neelicattu
Modified:	2018-06-29 18:01 EDT (History)
CC List:	47 users (show)

See Also:
Fixed In Version:	tomcat 7.0.54, tomcat 6.0.41, jbossweb 7.4.7.Final
Doc Type:	Bug Fix
Doc Text:	It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:0842	normal	SHIPPED_LIVE	Moderate: Red Hat JBoss Enterprise Application Platform 6.2.4 security update	2014-07-07 14:49:59 EDT
Red Hat Product Errata	RHSA-2014:0843	normal	SHIPPED_LIVE	Moderate: Red Hat JBoss Enterprise Application Platform 6.2.4 security update	2014-07-07 14:49:49 EDT
Red Hat Product Errata	RHSA-2014:0895	normal	SHIPPED_LIVE	Moderate: Red Hat JBoss Data Grid 6.3.0 update	2014-07-16 17:12:23 EDT
Red Hat Product Errata	RHSA-2014:1034	normal	SHIPPED_LIVE	Low: tomcat security update	2014-08-07 18:23:30 EDT
Red Hat Product Errata	RHSA-2014:1038	normal	SHIPPED_LIVE	Low: tomcat6 security update	2014-08-11 16:44:40 EDT
Red Hat Product Errata	RHSA-2014:1086	normal	SHIPPED_LIVE	Important: Red Hat JBoss Web Server 2.1.0 update	2014-08-21 15:30:27 EDT
Red Hat Product Errata	RHSA-2014:1087	normal	SHIPPED_LIVE	Important: Red Hat JBoss Web Server 2.1.0 update	2014-08-21 15:29:44 EDT
Red Hat Product Errata	RHSA-2014:1088	normal	SHIPPED_LIVE	Important: Red Hat JBoss Web Server 2.1.0 update	2014-08-21 15:29:14 EDT
Red Hat Product Errata	RHSA-2015:0234	normal	SHIPPED_LIVE	Important: Red Hat JBoss BPM Suite 6.0.3 security update	2015-02-17 22:27:47 EST
Red Hat Product Errata	RHSA-2015:0235	normal	SHIPPED_LIVE	Important: Red Hat JBoss BRMS 6.0.3 security update	2015-02-17 22:27:36 EST
Red Hat Product Errata	RHSA-2015:0675	normal	SHIPPED_LIVE	Important: Red Hat JBoss Data Virtualization 6.1.0 update	2015-03-11 16:51:21 EDT
Red Hat Product Errata	RHSA-2015:0720	normal	SHIPPED_LIVE	Important: Red Hat JBoss Fuse Service Works 6.0.0 security update	2015-03-24 21:05:53 EDT
Red Hat Product Errata	RHSA-2015:0765	normal	SHIPPED_LIVE	Important: Red Hat JBoss Data Virtualization 6.0.0 security update	2015-03-31 17:00:43 EDT
Red Hat Product Errata	RHSA-2015:1009	normal	SHIPPED_LIVE	Important: Red Hat JBoss Portal 6.2.0 update	2015-05-14 15:14:47 EDT

Groups: None (edit)

Description Arun Babu Neelicattu 2014-05-28 07:28:16 EDT

It was found that in limited circumstances it was possible for a malicious web application to replace the XML parsers used by Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs) and tag plugin configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or have visibility of the XML files processed for other web applications deployed on the same Tomcat instance.

Comment 2 Vincent Danen 2014-05-28 23:27:23 EDT

Tomcat 6 fix (3 patches): 

http://svn.apache.org/viewvc?view=revision&revision=1589640
http://svn.apache.org/viewvc?view=revision&revision=1593815
http://svn.apache.org/viewvc?view=revision&revision=1593821

Tomcat 7 fix (4 patches):

http://svn.apache.org/viewvc?view=revision&revision=1588199
http://svn.apache.org/viewvc?view=revision&revision=1589997
http://svn.apache.org/viewvc?view=revision&revision=1590028
http://svn.apache.org/viewvc?view=revision&revision=1590036

Comment 6 Arun Babu Neelicattu 2014-06-13 02:03:02 EDT

JBoss Web includes fix in 7.4.7.Final. Fixed by [1, 2].

[1] https://source.jboss.org/changelog/JBossWeb?cs=2427
[2] https://source.jboss.org/changelog/JBossWeb?cs=2460

Comment 15 errata-xmlrpc 2014-07-07 10:50:21 EDT

This issue has been addressed in following products:

  JBEAP 6.2 for RHEL 6
  JBEAP 6.2 for RHEL 5

Via RHSA-2014:0843 https://rhn.redhat.com/errata/RHSA-2014-0843.html

Comment 16 errata-xmlrpc 2014-07-07 10:51:19 EDT

This issue has been addressed in following products:

  JBoss Enterprise Application Platform 6.2.4

Via RHSA-2014:0842 https://rhn.redhat.com/errata/RHSA-2014-0842.html

Comment 17 errata-xmlrpc 2014-07-16 13:13:19 EDT

This issue has been addressed in following products:

  JBoss Data Grid 6.3.0

Via RHSA-2014:0895 https://rhn.redhat.com/errata/RHSA-2014-0895.html

Comment 18 Martin Prpič 2014-07-17 10:36:01 EDT

IssueDescription:

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs), and tag plug-in configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or gain access to the XML files processed for other web applications deployed on the same JBoss Web / Apache Tomcat instance.

Comment 20 errata-xmlrpc 2014-08-07 14:23:50 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:1034 https://rhn.redhat.com/errata/RHSA-2014-1034.html

Comment 21 errata-xmlrpc 2014-08-11 12:46:37 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:1038 https://rhn.redhat.com/errata/RHSA-2014-1038.html

Comment 22 errata-xmlrpc 2014-08-21 11:31:19 EDT

This issue has been addressed in following products:

  JBEWS 2 for RHEL 5

Via RHSA-2014:1088 https://rhn.redhat.com/errata/RHSA-2014-1088.html

Comment 23 errata-xmlrpc 2014-08-21 11:32:03 EDT

This issue has been addressed in following products:

  JBEWS 2 for RHEL 6

Via RHSA-2014:1087 https://rhn.redhat.com/errata/RHSA-2014-1087.html

Comment 24 errata-xmlrpc 2014-08-21 11:32:31 EDT

This issue has been addressed in following products:

  JBoss Web Server 2.1.0

Via RHSA-2014:1086 https://rhn.redhat.com/errata/RHSA-2014-1086.html

Comment 30 errata-xmlrpc 2015-02-17 17:28:29 EST

This issue has been addressed in the following products:

  Red Hat JBoss BRMS 6.0.3

Via RHSA-2015:0235 https://rhn.redhat.com/errata/RHSA-2015-0235.html

Comment 31 errata-xmlrpc 2015-02-17 17:32:19 EST

This issue has been addressed in the following products:

  Red Hat JBoss BPM Suite 6.0.3

Via RHSA-2015:0234 https://rhn.redhat.com/errata/RHSA-2015-0234.html

Comment 33 errata-xmlrpc 2015-03-11 12:52:50 EDT

This issue has been addressed in the following products:

JBoss Data Virtualization 6.1.0

Via RHSA-2015:0675 https://rhn.redhat.com/errata/RHSA-2015-0675.html

Comment 34 errata-xmlrpc 2015-03-24 17:06:35 EDT

This issue has been addressed in the following products:

  Red Hat JBoss Fuse Service Works 6.0.0

Via RHSA-2015:0720 https://rhn.redhat.com/errata/RHSA-2015-0720.html

Comment 35 errata-xmlrpc 2015-03-31 13:01:34 EDT

This issue has been addressed in the following products:

  Red Hat JBoss Data Virtualization 6.0.0

Via RHSA-2015:0765 https://rhn.redhat.com/errata/RHSA-2015-0765.html

Comment 36 errata-xmlrpc 2015-05-14 11:19:13 EDT

This issue has been addressed in the following products:

  JBoss Portal 6.2.0

Via RHSA-2015:1009 https://rhn.redhat.com/errata/RHSA-2015-1009.html

Note You need to log in before you can comment on or make changes to this bug.

anil.saldhana
bdawidow
bgollahe
ccoleman
cdewolf
chazlett
chuffman
darran.lofthouse
dmcphers
drieden
epp-bugs
erich
fnasser
grocha
huwang
ivan.afonichev
jawilson
jclere
jcoleman
jdg-bugs
jdoyle
jialiu
jkurik
jokerman
jpallich
kconner
kejohnso
krzysztof.daniel
lgao
lkocman
lmeyer
mmccomas
mmcgrath
mmiura
mweiler
myarboro
ohudlick
pgier
pslavice
rhq-maint
rsvoboda
soa-p-jira
spinder
theute
ttarrant
vtunka
weli