https://bugzilla.redhat.com/show_bug.cgi?id=1540030
Summer Long <slong(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|80129,reported=20180130,sou |80129,reported=20180130,sou
|rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS
|:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S:
|U/C:H/I:N/A:N,cwe=CWE-20,fe |U/C:H/I:N/A:N,cwe=CWE-20,fe
|dora-all/springframework=af |dora-all/springframework=af
|fected,fedora-all/springfra |fected,fedora-all/springfra
|mework-security=affected,rh |mework-security=affected,rh
|el-8/springframework=new,fs |el-8/springframework=new,fs
|w-6/spring=new,fuse-6/sprin |w-6/spring=new,fuse-6/sprin
|g=notaffected,jdv-6/spring= |g=notaffected,jdv-6/spring=
|new,brms-5/spring=new,soap- |new,brms-5/spring=new,soap-
|5/spring=new,openstack-9/op |5/spring=new,openstack-9/op
|endaylight=new,openstack-10 |endaylight=wontfix,openstac
|/opendaylight=new,openstack |k-10/opendaylight=wontfix,o
|-11/opendaylight=new,openst |penstack-11/opendaylight=wo
|ack-12/opendaylight=new,rhe |ntfix,openstack-12/opendayl
|s-3/rhevm-dependencies=nota |ight=wontfix,rhes-3/rhevm-d
|ffected,amq-6/spring=new,ea |ependencies=notaffected,amq
|p-5/spring=new,eap-7/spring |-6/spring=new,eap-5/spring=
|=new,eap-6/spring=new,jpp-6 |new,eap-7/spring=new,eap-6/
|/spring=new,jbews-2/sping=n |spring=new,jpp-6/spring=new
|ew,jws-3/spring=new,rhmap-4 |,jbews-2/sping=new,jws-3/sp
|/spring=new |ring=new,rhmap-4/spring=new
--- Comment #5 from Summer Long <slong(a)redhat.com> ---
For RH OpenStack Platform: Although the spring code contains the flaw,
OpenDaylight uses Tomcat which is not vulnerable. "Tomcat follows the guidance
previously provided by the Servlet Expert group and strips path parameters from
the value returned by getContextPath(), getServletPath() and getPathInfo()
[1]."
[1]
https://www.securityfocus.com/archive/1/archive/1/514517/100/0/threaded <--
2010.
catalina-7.0.27.1 used in ODL is from 2012 after the fixes. Should be ok.
--
You are receiving this mail because:
You are on the CC list for the bug.