http://marc.info/?l=tomcat-dev&m=124449799021570&w=2 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2008-5515: Apache Tomcat information disclosure vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Tomcat 4.1.0 to 4.1.39 Tomcat 5.5.0 to 5.5.27 Tomcat 6.0.0 to 6.0.18 The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected Description: When using a RequestDispatcher obtained from the Request, the target path was normalised before the query string was removed. A request that included a specially crafted request parameter could be used to access content that would otherwise be protected by a security constraint or by locating it in under the WEB-INF directory. Mitigation: 6.0.x users should upgrade to 6.0.20 or apply this patch: http://svn.apache.org/viewvc?view=rev&revision=734734 5.5.x users should upgrade to 5.5.28 when released or apply this patch: http://svn.apache.org/viewvc?view=rev&revision=782757 4.1.x users should upgrade to 4.1.40 when released or apply this patch: http://svn.apache.org/viewvc?view=rev&revision=782763 Example: For a page that contains: <% request.getRequestDispatcher( "bar.jsp?somepar=someval&par=" + request.getParameter( "blah" ) ).forward( request, response ); %> an attacker can use: http://host/page.jsp?blah=/../WEB-INF/web.xml Credit: This issue was discovered by Iida Minehiko, Fujitsu Limited References: http://tomcat.apache.org/security.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkotiBQACgkQb7IeiTPGAkMi6QCgnlzEt/7byUJo2YXGHMLj2ckH rF8AoK8dmpZcxd5pV9VvEaPqm4xhXJPO =bDV5 -----END PGP SIGNATURE-----
5.5.x revision have been extended to: This was fixed in revision 782757 and revision 783291. (http://tomcat.apache.org/security-5.html) 4.1.x revisions have been extended to: This was fixed in revision 782763 and revision 783292. (http://tomcat.apache.org/security-4.html)
This issue has been addressed in following products: JBEAP 4.3.0 for RHEL 5 Via RHSA-2009:1145 https://rhn.redhat.com/errata/RHSA-2009-1145.html
This issue has been addressed in following products: JBEAP 4.3.0 for RHEL 4 Via RHSA-2009:1146 https://rhn.redhat.com/errata/RHSA-2009-1146.html
This issue has been addressed in following products: JBEAP 4.2.0 for RHEL 5 Via RHSA-2009:1143 https://rhn.redhat.com/errata/RHSA-2009-1143.html
This issue has been addressed in following products: JBEAP 4.2.0 for RHEL 4 Via RHSA-2009:1144 https://rhn.redhat.com/errata/RHSA-2009-1144.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2009:1164 https://rhn.redhat.com/errata/RHSA-2009-1164.html
This issue has been addressed in following products: JBEWS 1.0.0 for RHEL 4 JBEWS 1.0.0 for RHEL 5 Via RHSA-2009:1454 https://rhn.redhat.com/errata/RHSA-2009-1454.html
This issue has been addressed in following products: JBEWS 1.0.0 for RHEL 5 JBEWS 1.0.0 for RHEL 4 Via RHSA-2009:1506 https://rhn.redhat.com/errata/RHSA-2009-1506.html
This issue has been addressed in following products: RHAPS Version 2 for RHEL 4 Via RHSA-2009:1562 https://rhn.redhat.com/errata/RHSA-2009-1562.html
This issue has been addressed in following products: Red Hat Developer Suite V.3 Via RHSA-2009:1563 https://rhn.redhat.com/errata/RHSA-2009-1563.html
This issue has been addressed in following products: Red Hat Network Satellite Server v 5.2 Red Hat Network Satellite Server v 5.3 Via RHSA-2009:1616 https://rhn.redhat.com/errata/RHSA-2009-1616.html
This issue has been addressed in following products: Red Hat Network Satellite Server v 5.1 Via RHSA-2009:1617 https://rhn.redhat.com/errata/RHSA-2009-1617.html
This issue has been addressed in following products: Red Hat Certificate System 7.3 Via RHSA-2010:0602 https://rhn.redhat.com/errata/RHSA-2010-0602.html
All children bugs are closed, closing parent bug