Red Hat Bugzilla – Bug 1207099
CVE-2015-0899 Apache Struts 1: input validation bypass in MultiPageValidator
Last modified: 2015-08-25 02:52:39 EDT
The following flaw was found in Apache Struts 1: The Validator in Apache Struts 1.1 and later contains a function to efficiently define rules for input validation across multiple pages during screen transitions. This function contains a vulnerability where input validation may be bypassed. When the Apache Struts 1 Validator is used, the web application may be vulnerable even when this function is not used explicitly. Upstream advisory: http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000042.html https://jvn.jp/en/jp/JVN86448949/index.html Upstream patches: http://en.sourceforge.jp/projects/terasoluna/wiki/StrutsPatch2-EN
While jbews-1 is affected by this issue, it's end of life was reached in June 2012. https://access.redhat.com/support/policy/updates/jboss_notes
Planning to remove struts from Fuse/FSW in next release: https://issues.jboss.org/browse/ENTESB-3567
Satellite 5.x is unaffected by this issue because it doesn't use ValidatorForm. It uses DynaActionForm instead, and validates in the Action classes.
We won't fix this issue in JBoss Operation Network because it doesn't use multipage forms. Also, all forms are only accessible from authenticated sections of JON. We won't fix this issue for EPEL and Fedora as they are unsupported, and we're unlikely to consume these packages in supported products in future.
Created struts tracking bugs for this issue: Affects: fedora-all [bug 1256620] Affects: epel-7 [bug 1256621]