[Bug 1869682] New: CVE-2019-0233 struts: access permission override when performing a file upload leads to DoS
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1869682
Bug ID: 1869682
Summary: CVE-2019-0233 struts: access permission override when
performing a file upload leads to DoS
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
bbaranow(a)redhat.com, bmaxwell(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, darran.lofthouse(a)redhat.com,
dbecker(a)redhat.com, dbhole(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
eleandro(a)redhat.com, extras-orphan(a)fedoraproject.org,
gvarsami(a)redhat.com, iweiss(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jjelen(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jperkins(a)redhat.com,
jschluet(a)redhat.com, jwon(a)redhat.com,
kbasil(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com,
loleary(a)redhat.com, lpeer(a)redhat.com,
mburns(a)redhat.com, mkolesni(a)redhat.com,
mmraka(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, nwallace(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, puntogil(a)libero.it,
rguimara(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rwagner(a)redhat.com,
sclewis(a)redhat.com, scohen(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
tom.jenkinson(a)redhat.com
Target Milestone: ---
Classification: Other
When a file upload is performed to an Action that exposes the file with a
getter, an attacker may manipulate the request such that the working copy of
the uploaded file is set to read-only. As a result, subsequent actions on the
file will fail with an error. It might also be possible to set the Servlet
container's temp directory to read only, such that subsequent upload actions
will fail.
Reference:
https://cwiki.apache.org/confluence/display/WW/S2-060
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 7 months
[Bug 1869672] New: CVE-2019-0230 struts: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributes
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1869672
Bug ID: 1869672
Summary: CVE-2019-0230 struts: possible RCE due to forced
double OGNL evaluation when evaluated on raw user
input in tag attributes
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
bbaranow(a)redhat.com, bmaxwell(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, darran.lofthouse(a)redhat.com,
dbecker(a)redhat.com, dbhole(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
eleandro(a)redhat.com, extras-orphan(a)fedoraproject.org,
gvarsami(a)redhat.com, iweiss(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jjelen(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jperkins(a)redhat.com,
jschluet(a)redhat.com, jwon(a)redhat.com,
kbasil(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com,
loleary(a)redhat.com, lpeer(a)redhat.com,
mburns(a)redhat.com, mkolesni(a)redhat.com,
mmraka(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, nwallace(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, puntogil(a)libero.it,
rguimara(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rwagner(a)redhat.com,
sclewis(a)redhat.com, scohen(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
tom.jenkinson(a)redhat.com
Target Milestone: ---
Classification: Other
The Apache Struts frameworks, when forced, performs double evaluation of
attributes' values assigned to certain tags attributes such as id so it is
possible to pass in a value that will be evaluated again when a tag's
attributes will be rendered. With a carefully crafted request, this can lead to
Remote Code Execution (RCE).
Reference:
https://cwiki.apache.org/confluence/display/WW/S2-059
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 7 months