Bug 1805006 (CVE-2020-6950) - CVE-2020-6950 Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371
Summary: CVE-2020-6950 Mojarra: Path traversal via either the loc parameter or the con...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-6950
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1805008 (view as bug list)
Depends On:
Blocks: 1783879
TreeView+ depends on / blocked
 
Reported: 2020-02-20 05:34 UTC by Ted Jongseok Won
Modified: 2021-08-12 02:06 UTC (History)
74 users (show)

Fixed In Version: glassfish-jsf-impl 2.3.14, glassfish-jsf-impl 3.0.0-RC1
Clone Of:
Environment:
Last Closed: 2020-05-12 22:32:03 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:2113 0 None None None 2020-05-12 17:17:44 UTC
Red Hat Product Errata RHSA-2020:2511 0 None None None 2020-06-10 19:06:04 UTC
Red Hat Product Errata RHSA-2020:2512 0 None None None 2020-06-11 07:17:25 UTC
Red Hat Product Errata RHSA-2020:2513 0 None None None 2020-06-11 07:09:08 UTC
Red Hat Product Errata RHSA-2020:2515 0 None None None 2020-06-10 19:24:21 UTC
Red Hat Product Errata RHSA-2020:2905 0 None None None 2020-07-23 07:04:43 UTC
Red Hat Product Errata RHSA-2020:3585 0 None None None 2020-08-31 15:41:02 UTC
Red Hat Product Errata RHSA-2020:3637 0 None None None 2020-09-07 12:56:08 UTC
Red Hat Product Errata RHSA-2020:3638 0 None None None 2020-09-07 13:02:13 UTC
Red Hat Product Errata RHSA-2020:3639 0 None None None 2020-09-07 12:59:05 UTC
Red Hat Product Errata RHSA-2020:3642 0 None None None 2020-09-07 13:06:27 UTC
Red Hat Product Errata RHSA-2021:3140 0 None None None 2021-08-11 18:22:42 UTC

Description Ted Jongseok Won 2020-02-20 05:34:11 UTC 
Eclipse Mojarra before version 2.3.14 is vulnerable to a path traversal flaw via either the loc parameter or the con parameter. An attacker could exploit this to read arbitrary files. It was reported as CVE-2019-0199, but it was an incomplete fix.

Upstream Patch:
https://github.com/eclipse-ee4j/mojarra/commit/1b434748d9239f42eae8aa7d37d7a0930c061e24
https://github.com/eclipse-ee4j/mojarra/commit/cefbb9447e7be560e59da2da6bd7cb93776f7741
Comment 1 Ted Jongseok Won 2020-02-20 05:34:21 UTC 
External References:

https://github.com/javaserverfaces/mojarra/issues/4364
https://github.com/eclipse-ee4j/mojarra/commit/1b434748d9239f42eae8aa7d37d7a0930c061e24
https://bugs.eclipse.org/bugs/show_bug.cgi?id=550943
https://github.com/eclipse-ee4j/mojarra/commit/cefbb9447e7be560e59da2da6bd7cb93776f7741
https://github.com/eclipse-ee4j/mojarra/issues/4571
Comment 2 Ted Jongseok Won 2020-02-21 04:48:28 UTC 
*** Bug 1805008 has been marked as a duplicate of this bug. ***
Comment 3 Ted Jongseok Won 2020-02-21 04:59:56 UTC 
Acknowledgments:

Name: An Trinh
Comment 13 Jonathan Christison 2020-03-23 17:27:59 UTC 
This vulnerability is out of security support scope for the following products:
 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notesfor more details.
Comment 17 Chess Hazlett 2020-05-12 15:18:32 UTC 
Mitigation:

There is no currently known mitigation for this flaw.
Comment 18 errata-xmlrpc 2020-05-12 17:17:40 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign On 7.3

Via RHSA-2020:2113 https://access.redhat.com/errata/RHSA-2020:2113
Comment 19 Product Security DevOps Team 2020-05-12 22:32:03 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-6950
Comment 20 errata-xmlrpc 2020-06-10 19:06:00 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2020:2511 https://access.redhat.com/errata/RHSA-2020:2511
Comment 21 errata-xmlrpc 2020-06-10 19:24:17 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:2515 https://access.redhat.com/errata/RHSA-2020:2515
Comment 22 errata-xmlrpc 2020-06-11 07:09:03 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2020:2513 https://access.redhat.com/errata/RHSA-2020:2513
Comment 23 errata-xmlrpc 2020-06-11 07:17:19 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2020:2512 https://access.redhat.com/errata/RHSA-2020:2512
Comment 24 errata-xmlrpc 2020-07-23 07:04:39 UTC 
This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:2905 https://access.redhat.com/errata/RHSA-2020:2905
Comment 26 errata-xmlrpc 2020-08-31 15:40:58 UTC 
This issue has been addressed in the following products:

  EAP-CD 20 Tech Preview

Via RHSA-2020:3585 https://access.redhat.com/errata/RHSA-2020:3585
Comment 27 errata-xmlrpc 2020-09-07 12:56:03 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

Via RHSA-2020:3637 https://access.redhat.com/errata/RHSA-2020:3637
Comment 28 errata-xmlrpc 2020-09-07 12:59:00 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2020:3639 https://access.redhat.com/errata/RHSA-2020:3639
Comment 29 errata-xmlrpc 2020-09-07 13:02:08 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

Via RHSA-2020:3638 https://access.redhat.com/errata/RHSA-2020:3638
Comment 30 errata-xmlrpc 2020-09-07 13:06:20 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:3642 https://access.redhat.com/errata/RHSA-2020:3642
Comment 33 errata-xmlrpc 2021-08-11 18:22:37 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.9

Via RHSA-2021:3140 https://access.redhat.com/errata/RHSA-2021:3140
Note You need to log in before you can comment on or make changes to this bug.