https://bugzilla.redhat.com/show_bug.cgi?id=1494283
Eric Christensen <sparks(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|70921,reported=20170921,sou |70921,reported=20170920,sou
|rce=internet,cvss3=8.1/CVSS |rce=internet,cvss3=8.1/CVSS
|:3.0/AV:N/AC:H/PR:N/UI:N/S: |:3.0/AV:N/AC:H/PR:N/UI:N/S:
|U/C:H/I:H/A:H,cwe=CWE-20,rh |U/C:H/I:H/A:H,cwe=CWE-20,rh
|el-7/tomcat=affected,rhscl- |el-7/tomcat=affected,rhscl-
|2/rh-java-common-tomcat=not |2/rh-java-common-tomcat=not
|affected,jbews-2/tomcat7=af |affected,jbews-2/tomcat7=af
|fected,jws-3/tomcat7=affect |fected,jws-3/tomcat7=affect
|ed,jws-3/tomcat8=affected,j |ed,jws-3/tomcat8=affected,j
|dg-6/jbossweb=notaffected,j |dg-6/jbossweb=notaffected,j
|dv-6/jbossweb=notaffected,e |dv-6/jbossweb=notaffected,e
|ap-6/jbossweb=affected,fuse |ap-6/jbossweb=affected,fuse
|-6/jbossweb=notaffected,jon |-6/jbossweb=notaffected,jon
|-3/jbossweb=notaffected,jpp |-3/jbossweb=notaffected,jpp
|-6/jbossweb=notaffected,ope |-6/jbossweb=notaffected,ope
|nshift-1/jbossweb=notaffect |nshift-1/jbossweb=notaffect
|ed,fedora-all/tomcat=affect |ed,fedora-all/tomcat=affect
|ed,epel-6/tomcat=affected,r |ed,epel-6/tomcat=affected,r
|hel-6/tomcat6=affected,jbew |hel-6/tomcat6=affected,jbew
|s-2/tomcat6=affected,eap-5/ |s-2/tomcat6=affected,eap-5/
|jbossweb=affected |jbossweb=affected
--- Doc Text *updated* ---
A vulnerability was discovered in Tomcat where if a servlet context was configured with
readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to
that context and achieve code execution.
--
You are receiving this mail because:
You are on the CC list for the bug.