[Bug 1582494] fop-2.4 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1582494
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Fixed In Version| |fop-2.4-1.fc31
Resolution|--- |ERRATA
Last Closed| |2020-02-29 22:31:50
--- Comment #5 from Fedora Update System <updates(a)fedoraproject.org> ---
fop-2.4-1.fc31 has been pushed to the Fedora 31 stable repository. If problems
still persist, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month
[Bug 1806398] CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1806398
--- Comment #62 from Ted (Jong Seok) Won <jwon(a)redhat.com> ---
Mitigation:
The issue can be mitigated as follows:
1. If your site is not actively using the AJP Connector, simply comment it out
from the <TOMCAT_HOME>/conf/server.xml file as
~~~
<!-- <Connector port = "8009" protocol = "AJP / 1.3" redirectPort = "8443" />
-->
~~~
2. If AJP connector is a requirement and cannot be commented/deactivated, then,
it is recommended to configure requiredSecret for the AJPConnector to set the
AJP protocol authentication credentials. For example (note that
YOUR_TOMCAT_AJP_SECRET must be changed to a value that is highly secure and
cannot be easily guessed):
~~~
<Connector port = "8009"
protocol = "AJP / 1.3"
redirectPort = "8443"
address = "YOUR_TOMCAT_IP_ADDRESS"
requiredSecret = "YOUR_TOMCAT_AJP_SECRET" />
~~~
When the above setting is configured, the same secret value on the front-end
proxy (mod_proxy_ajp or mod_jk) will be required to be configured.
* mod_proxy_ajp
secret can be added to ProxyPass. secret property support was added since
JBCS httpd 2.4.37 or since RHEL 7 httpd-2.4.6-67.el7.x86_64 (by
https://bugzilla.redhat.com/show_bug.cgi?id=1397241)
~~~
ProxyPass /example/ ajp://localhost:8009/example/ secret=YOUR_TOMCAT_AJP_SECRET
~~~
* mod_jk
secret can be specified to worker in workers.properties. secret support was
added in mod_jk 1.2.12 onwards.
~~~
worker.<WORKER_NAME>.secret=YOUR_TOMCAT_AJP_SECRET
~~~
Note that mod_cluster does not support secret property.
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month
[Bug 1806398] CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1806398
--- Comment #60 from Doran Moppert <dmoppert(a)redhat.com> ---
Mitigation:
The issue can be mitigated as follows:
1. If your site is not actively using the AJP Connector, simply comment it out
from the /conf/server.xml file as
~~~
<!-- <Connector port = "8009" protocol = "AJP / 1.3" redirectPort = "8443" />
-->
~~~
2. If AJP connector is a requirement and cannot be commented/deactivated, then,
it is recommended to configure requiredSecret for the AJPConnector to set the
AJP protocol authentication credentials. For example (note that
YOUR_TOMCAT_AJP_SECRET must be changed to a value that is highly secure and
cannot be easily guessed):
~~~
<Connector port = "8009"
protocol = "AJP / 1.3"
redirectPort = "8443"
address = "YOUR_TOMCAT_IP_ADDRESS"
requiredSecret = "YOUR_TOMCAT_AJP_SECRET" />
~~~
When the above setting is configured, the same secret value on the front-end
proxy (mod_proxy_ajp/mod_jk) will be required to be configured.
- mod_proxy_ajp
secret can be added to ProxyPass. secret property support was added since
JBCS httpd 2.4.37 or since RHEL 7 httpd-2.4.6-67.el7.x86_64 (by
https://bugzilla.redhat.com/show_bug.cgi?id=1397241)
~~~
ProxyPass /example/ ajp://localhost:8009/example/ secret=mysecret
~~~
- mod_jk
secret can be specified to worker in workers.properties. secret support was
added in mod_jk 1.2.12 onwards.
~~~
worker.<worker name>.secret=mysecret
~~~
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month
[Bug 1806398] CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1806398
--- Comment #58 from Anten Skrabec <askrabec(a)redhat.com> ---
From skitt(a)redhat.com regarding OpenStack:
"As you say, ODL doesn’t enable AJP by default, but it probably is
configurable. At least, there’s an embedded Tomcat available in Karaf,
thanks to Pax, so users could enable that. They would also need to
explicitly enable the AJP connector since it’s not listed in the
included default server.xml.
In any case, as you also mention, all the recommendations around AJP
were always to never expose the AJP port (not just with my ODL hat on;
in previous jobs I deployed Tomcat with AJP). ODL never supported
setups where admin ports of any kind are accessible to the wider
public..."
As such, marking Red Hat Openstack 13 as wontfix.
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month