[Bug 1571050] New: CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1571050
Bug ID: 1571050
Summary: CVE-2018-1271 spring-framework: Directory traversal
vulnerability with static resources on Windows
filesystems
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, apevec(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
chrisw(a)redhat.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dchen(a)redhat.com,
dffrench(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
drusso(a)redhat.com, etirelli(a)redhat.com,
gvarsami(a)redhat.com, hghasemb(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jjoyce(a)redhat.com, jmadigan(a)redhat.com,
jolee(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, lgriffin(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, lpetrovi(a)redhat.com,
markmc(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, myarboro(a)redhat.com,
ngough(a)redhat.com, nwallace(a)redhat.com,
nyechiel(a)redhat.com, paradhya(a)redhat.com,
pavelp(a)redhat.com, pgier(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
pszubiak(a)redhat.com, puntogil(a)libero.it,
pwright(a)redhat.com, rbryant(a)redhat.com,
rhel8-maint(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sclewis(a)redhat.com,
sdaley(a)redhat.com, sisharma(a)redhat.com,
slinaber(a)redhat.com, smohan(a)redhat.com,
ssaha(a)redhat.com, tcunning(a)redhat.com,
tdecacqu(a)redhat.com, tjay(a)redhat.com,
tkirby(a)redhat.com, trepel(a)redhat.com,
twalsh(a)redhat.com, vbellur(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com
Spring Framework versions 5.0 to 5.0.4, 4.3 to 4.3.14, and older unsupported
versions allow applications to configure Spring MVC to serve static resources
(e.g. CSS, JS, images). When static resources are served from a file system on
Windows (as opposed to the classpath, or the ServletContext), a malicious user
can send a request using a specially crafted URL that can lead a directory
traversal attack.
This vulnerability does not affect applications that use versions of Spring
Security patched for CVE-2018-1199.
External Reference:
https://pivotal.io/security/cve-2018-1271
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1595639] New: CVE-2017-7656 jetty: HTTP request smuggling using the range header
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1595639
Bug ID: 1595639
Summary: CVE-2017-7656 jetty: HTTP request smuggling using the
range header
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abergmann(a)suse.com, aileenc(a)redhat.com,
bkearney(a)redhat.com, chazlett(a)redhat.com,
ggainey(a)redhat.com, gvarsami(a)redhat.com,
hghasemb(a)redhat.com, hhorak(a)redhat.com,
java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjohnstn(a)redhat.com,
jorton(a)redhat.com, kconner(a)redhat.com,
krzysztof.daniel(a)gmail.com, ldimaggi(a)redhat.com,
meissner(a)suse.de, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, nwallace(a)redhat.com,
rwagner(a)redhat.com, sochotni(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com
Blocks: 1595623
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and
9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is
handled poorly. An HTTP/1 style request line (i.e. method space URI space
version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9
request. If deployed behind an intermediary that also accepted and passed
through the 0.9 version (but did not act on it), then the response sent could
be interpreted by the intermediary as HTTP/1 headers. This could be used to
poison the cache if the server allowed the origin client to generate arbitrary
content in the response.
Upstream issue:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=535667
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1595621] New: CVE-2017-7658 jetty: Incorrect header handling
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1595621
Bug ID: 1595621
Summary: CVE-2017-7658 jetty: Incorrect header handling
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abergmann(a)suse.com, aileenc(a)redhat.com,
bkearney(a)redhat.com, chazlett(a)redhat.com,
ggainey(a)redhat.com, gvarsami(a)redhat.com,
hghasemb(a)redhat.com, hhorak(a)redhat.com,
java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjohnstn(a)redhat.com,
jorton(a)redhat.com, kconner(a)redhat.com,
krzysztof.daniel(a)gmail.com, ldimaggi(a)redhat.com,
meissner(a)suse.de, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, nwallace(a)redhat.com,
rwagner(a)redhat.com, sochotni(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x
configurations), and 9.4.x (all HTTP/1.x configurations), when presented with
two content-lengths headers, Jetty ignored the second. When presented with a
content-length and a chunked encoding header, the content-length was ignored
(as per RFC 2616). If an intermediary decided on the shorter length, but still
passed on the longer body, then body content could be interpreted by Jetty as a
pipelined request. If the intermediary was imposing authorization, the fake
pipelined request would bypass that authorization.
Upstream issue:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1595620] CVE-2017-7657 jetty: HTTP request smuggling
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1595620
Cedric Buissart <cbuissar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0607,reported=20180626,sour |0607,reported=20180626,sour
|ce=cve,cvss3=5.3/CVSS:3.0/A |ce=cve,cvss3=5.3/CVSS:3.0/A
|V:N/AC:L/PR:N/UI:N/S:U/C:N/ |V:N/AC:L/PR:N/UI:N/S:U/C:N/
|I:L/A:N,cwe=CWE-444,fedora- |I:L/A:N,cwe=CWE-444,fedora-
|all/jetty=affected,rhel-6/j |all/jetty=affected,rhel-6/j
|etty-eclipse=wontfix,rhel-7 |etty-eclipse=wontfix,rhel-7
|/jetty=affected,rhscl-3/rh- |/jetty=affected,rhscl-3/rh-
|java-common-jetty=new,fuse- |java-common-jetty=affected,
|7/jetty=affected,fuse-6/jet |fuse-7/jetty=affected,fuse-
|ty=wontfix,fsw-6/jetty=wont |6/jetty=wontfix,fsw-6/jetty
|fix,rhn_satellite_5/nutch=w |=wontfix,rhn_satellite_5/nu
|ontfix |tch=wontfix
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1595620] CVE-2017-7657 jetty: HTTP request smuggling
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1595620
Cedric Buissart <cbuissar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0607,reported=20180626,sour |0607,reported=20180626,sour
|ce=cve,cvss3=5.3/CVSS:3.0/A |ce=cve,cvss3=5.3/CVSS:3.0/A
|V:N/AC:L/PR:N/UI:N/S:U/C:N/ |V:N/AC:L/PR:N/UI:N/S:U/C:N/
|I:L/A:N,cwe=CWE-444,fedora- |I:L/A:N,cwe=CWE-444,fedora-
|all/jetty=affected,rhel-6/j |all/jetty=affected,rhel-6/j
|etty-eclipse=affected,rhel- |etty-eclipse=wontfix,rhel-7
|7/jetty=affected,rhscl-3/rh |/jetty=affected,rhscl-3/rh-
|-java-common-jetty=new,fuse |java-common-jetty=new,fuse-
|-7/jetty=affected,fuse-6/je |7/jetty=affected,fuse-6/jet
|tty=wontfix,fsw-6/jetty=won |ty=wontfix,fsw-6/jetty=wont
|tfix,rhn_satellite_5/nutch= |fix,rhn_satellite_5/nutch=w
|wontfix |ontfix
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months