Bug 1207099 (CVE-2015-0899) - CVE-2015-0899 Apache Struts 1: input validation bypass in MultiPageValidator
Summary: CVE-2015-0899 Apache Struts 1: input validation bypass in MultiPageValidator
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2015-0899
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20150330,repor...
Depends On: 1256620 1256621
Blocks: 1207110
TreeView+ depends on / blocked
 
Reported: 2015-03-30 08:52 UTC by Martin Prpič
Modified: 2019-07-11 08:52 UTC (History)
36 users (show)

Fixed In Version: Apache Struts 1.2.9 SP2
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-08-25 06:31:13 UTC


Attachments (Terms of Use)

Description Martin Prpič 2015-03-30 08:52:13 UTC
The following flaw was found in Apache Struts 1:

The Validator in Apache Struts 1.1 and later contains a function to efficiently define rules for input validation across multiple pages during screen transitions. This function contains a vulnerability where input validation may be bypassed. When the Apache Struts 1 Validator is used, the web application may be vulnerable even when this function is not used explicitly.

Upstream advisory:

http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000042.html
https://jvn.jp/en/jp/JVN86448949/index.html

Upstream patches:

http://en.sourceforge.jp/projects/terasoluna/wiki/StrutsPatch2-EN

Comment 4 Jason Shepherd 2015-07-06 02:01:17 UTC
While jbews-1 is affected by this issue, it's end of life was reached in June 2012. https://access.redhat.com/support/policy/updates/jboss_notes

Comment 6 Jason Shepherd 2015-07-07 01:18:54 UTC
Planning to remove struts from Fuse/FSW in next release:

  https://issues.jboss.org/browse/ENTESB-3567

Comment 7 Jason Shepherd 2015-08-24 06:18:59 UTC
Satellite 5.x is unaffected by this issue because it doesn't use ValidatorForm. It uses DynaActionForm instead, and validates in the Action classes.

Comment 8 Jason Shepherd 2015-08-25 06:30:44 UTC
We won't fix this issue in JBoss Operation Network because it doesn't use multipage forms. Also, all forms are only accessible from authenticated sections of JON.

We won't fix this issue for EPEL and Fedora as they are unsupported, and we're unlikely to consume these packages in supported products in future.

Comment 9 Jason Shepherd 2015-08-25 06:52:39 UTC
Created struts tracking bugs for this issue:

Affects: fedora-all [bug 1256620]
Affects: epel-7 [bug 1256621]


Note You need to log in before you can comment on or make changes to this bug.