When using a RequestDispatcher the target path was normalised before the query string was removed. A request that included a specially crafted request parameter could be used to access content that would otherwise be protected by a security constraint or by locating it in under the WEB-INF directory.
Patch for Tomcat 5.5.x available upstream: http://svn.apache.org/viewvc?rev=680949&view=rev
Example: For a page that contains: <% pageContext.forward("/page2.jsp?somepar=someval&par="+request.getParameter("blah")); %> an attacker can use: http://host/page.jsp?blah=/../WEB-INF/web.xml
tomcat6-6.0.18-1.1.fc9 has been submitted as an update for Fedora 9. http://admin.fedoraproject.org/updates/tomcat6-6.0.18-1.1.fc9
tomcat6-6.0.18-1.1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
tomcat5-5.5.27-0jpp.1.fc8 has been submitted as an update for Fedora 8. http://admin.fedoraproject.org/updates/tomcat5-5.5.27-0jpp.1.fc8
tomcat5-5.5.27-0jpp.2.fc9 has been submitted as an update for Fedora 9. http://admin.fedoraproject.org/updates/tomcat5-5.5.27-0jpp.2.fc9
tomcat5-5.5.27-0jpp.2.fc8 has been submitted as an update for Fedora 8. http://admin.fedoraproject.org/updates/tomcat5-5.5.27-0jpp.2.fc8
tomcat5-5.5.27-0jpp.2.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
tomcat5-5.5.27-0jpp.2.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in following products: Red Hat Certificate System 7.3 Via RHSA-2010:0602 https://rhn.redhat.com/errata/RHSA-2010-0602.html