Bug 1811347 - updated package needed with patch for cve-2020-1938
Summary: updated package needed with patch for cve-2020-1938
Keywords:
Status: CLOSED DUPLICATE of bug 1806805
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: tomcat
Version: epel7
Hardware: All
OS: Linux
unspecified
urgent
Target Milestone: ---
Assignee: Orphan Owner
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-03-07 21:39 UTC by philip73811
Modified: 2020-03-09 12:57 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2020-03-09 12:57:23 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description philip73811 2020-03-07 21:39:46 UTC 
Description of problem:

https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487
Version-Release number of selected component (if applicable):

all current versions
Comment 1 Coty Sutherland 2020-03-09 12:57:23 UTC 
I'm marking this as a duplicate of the fedora tracker for CVE-2020-1938. There's already an update in progress to resolve this, see https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-81c37f8ff5.

In the meantime, you don't have to wait for an update to protect mitigate this vulnerability. Please review the guidance provided in https://access.redhat.com/security/cve/CVE-2020-1938 and https://access.redhat.com/solutions/4851251 as soon as you can and update your configurations accordingly.

*** This bug has been marked as a duplicate of bug 1806805 ***
Note You need to log in before you can comment on or make changes to this bug.