https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Bug ID: 1397484 Summary: CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: aileenc@redhat.com, alee@redhat.com, aszczucz@redhat.com, bbaranow@redhat.com, bdawidow@redhat.com, bgollahe@redhat.com, bmaxwell@redhat.com, ccoleman@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, csutherl@redhat.com, dandread@redhat.com, darran.lofthouse@redhat.com, dedgar@redhat.com, dmcphers@redhat.com, dosoudil@redhat.com, epp-bugs@redhat.com, felias@redhat.com, fnasser@redhat.com, gzaronik@redhat.com, hchiorea@redhat.com, hfnukal@redhat.com, hhorak@redhat.com, ivan.afonichev@gmail.com, jason.greene@redhat.com, java-sig-commits@lists.fedoraproject.org, jawilson@redhat.com, jboss-set@redhat.com, jclere@redhat.com, jcoleman@redhat.com, jdg-bugs@redhat.com, jdoyle@redhat.com, jgoulding@redhat.com, jialiu@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, jolee@redhat.com, jorton@redhat.com, jpallich@redhat.com, jshepherd@redhat.com, kanderso@redhat.com, krzysztof.daniel@gmail.com, lgao@redhat.com, lmeyer@redhat.com, mbabacek@redhat.com, mbaluch@redhat.com, me@coolsvap.net, miburman@redhat.com, mizdebsk@redhat.com, mmccomas@redhat.com, mnewsome@redhat.com, mweiler@redhat.com, myarboro@redhat.com, nwallace@redhat.com, ohudlick@redhat.com, pavelp@redhat.com, pgier@redhat.com, psakar@redhat.com, pslavice@redhat.com, rnetuka@redhat.com, rsvoboda@redhat.com, rzima@redhat.com, spinder@redhat.com, theute@redhat.com, trick@vanstaveren.us, ttarrant@redhat.com, twalsh@redhat.com, vhalbert@redhat.com, vtunka@redhat.com, weli@redhat.com
The code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.
Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6
Upstream patches:
Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767683 Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767675 Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767653 Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767645
External References:
https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1397488
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Adam Mariš amaris@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1397493 Depends On| |1397495 Depends On| |1397496
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1397493 [Bug 1397493] CVE-2016-6816 CVE-2016-6817 CVE-2016-8735 tomcat: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1397495 [Bug 1397495] CVE-2016-6816 CVE-2016-8735 tomcat: various flaws [epel-6]
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #2 from Adam Mariš amaris@redhat.com ---
Created tomcat tracking bugs for this issue:
Affects: fedora-all [bug 1397493] Affects: epel-6 [bug 1397495]
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1397645
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-7/tomcat=new,rhel- |ted,rhel-7/tomcat=new,rhel- |6/tomcat6=new,dts-3.1/devto |6/tomcat6=new,dts-3.1/devto |olset-3-tomcat=new,rhscl-2/ |olset-3-tomcat=new,rhscl-2/ |rh-java-common-tomcat=new,j |rh-java-common-tomcat=new,j |ws-3/tomcat8=new,jbews-2/to |ws-3/tomcat8=affected,jbews |mcat7=new,jbews-2/tomcat6=n |-2/tomcat7=affected,jbews-2 |ew,eap-6/tomcat7=new,jws-3/ |/tomcat6=affected,eap-6/jbo |tomcat7=new,jdg-6/jbossweb= |ssweb=new,jws-3/tomcat7=aff |new,jdv-6/jbossweb=new,eap- |ected,jdg-6/jbossweb=new,jd |6/jbossweb=new,fuse-6/jboss |v-6/jbossweb=new,fuse-6/jbo |web=new,jon-3/jbossweb=new, |ssweb=new,jon-3/jbossweb=ne |jpp-6/jbossweb=new,openshif |w,jpp-6/jbossweb=new,opensh |t-1/jbossweb=affected |ift-1/jbossweb=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-7/tomcat=new,rhel- |ted,rhel-7/tomcat=new,rhel- |6/tomcat6=new,dts-3.1/devto |6/tomcat6=new,dts-3.1/devto |olset-3-tomcat=new,rhscl-2/ |olset-3-tomcat=new,rhscl-2/ |rh-java-common-tomcat=new,j |rh-java-common-tomcat=new,j |ws-3/tomcat8=affected,jbews |ws-3/tomcat8=affected,jbews |-2/tomcat7=affected,jbews-2 |-2/tomcat7=affected,jbews-2 |/tomcat6=affected,eap-6/jbo |/tomcat6=affected,eap-5/jbo |ssweb=new,jws-3/tomcat7=aff |ssweb=new,eap-6/jbossweb=ne |ected,jdg-6/jbossweb=new,jd |w,jws-3/tomcat7=affected,jd |v-6/jbossweb=new,fuse-6/jbo |g-6/jbossweb=new,jdv-6/jbos |ssweb=new,jon-3/jbossweb=ne |sweb=new,fuse-6/jbossweb=ne |w,jpp-6/jbossweb=new,opensh |w,jon-3/jbossweb=new,jpp-6/ |ift-1/jbossweb=affected |jbossweb=new,openshift-1/jb | |ossweb=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1398253 Depends On| |1398254
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-7/tomcat=new,rhel- |ted,rhel-7/tomcat=new,rhel- |6/tomcat6=new,dts-3.1/devto |6/tomcat6=new,dts-3.1/devto |olset-3-tomcat=new,rhscl-2/ |olset-3-tomcat=new,rhscl-2/ |rh-java-common-tomcat=new,j |rh-java-common-tomcat=new,j |ws-3/tomcat8=affected,jbews |ws-3/tomcat8=affected,jbews |-2/tomcat7=affected,jbews-2 |-2/tomcat7=affected,jbews-3 |/tomcat6=affected,eap-5/jbo |/tomcat7=affected,jbews-2/t |ssweb=new,eap-6/jbossweb=ne |omcat6=affected,eap-5/jboss |w,jws-3/tomcat7=affected,jd |web=new,eap-6/jbossweb=new, |g-6/jbossweb=new,jdv-6/jbos |jws-3/tomcat7=affected,jdg- |sweb=new,fuse-6/jbossweb=ne |6/jbossweb=new,jdv-6/jbossw |w,jon-3/jbossweb=new,jpp-6/ |eb=new,fuse-6/jbossweb=new, |jbossweb=new,openshift-1/jb |jon-3/jbossweb=new,jpp-6/jb |ossweb=affected |ossweb=new,openshift-1/jbos | |sweb=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-7/tomcat=new,rhel- |ted,rhel-7/tomcat=new,rhel- |6/tomcat6=new,dts-3.1/devto |6/tomcat6=new,dts-3.1/devto |olset-3-tomcat=new,rhscl-2/ |olset-3-tomcat=new,rhscl-2/ |rh-java-common-tomcat=new,j |rh-java-common-tomcat=new,j |ws-3/tomcat8=affected,jbews |ws-3/tomcat8=affected,jbews |-2/tomcat7=affected,jbews-3 |-2/tomcat7=affected,jbews-3 |/tomcat7=affected,jbews-2/t |/tomcat7=affected,jbews-3/t |omcat6=affected,eap-5/jboss |omcat8=affected,jbews-2/tom |web=new,eap-6/jbossweb=new, |cat6=affected,eap-5/jbosswe |jws-3/tomcat7=affected,jdg- |b=new,eap-6/jbossweb=new,jw |6/jbossweb=new,jdv-6/jbossw |s-3/tomcat7=affected,jdg-6/ |eb=new,fuse-6/jbossweb=new, |jbossweb=new,jdv-6/jbossweb |jon-3/jbossweb=new,jpp-6/jb |=new,fuse-6/jbossweb=new,jo |ossweb=new,openshift-1/jbos |n-3/jbossweb=new,jpp-6/jbos |sweb=affected |sweb=new,openshift-1/jbossw | |eb=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Horia Chiorean hchiorea@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC|hchiorea@redhat.com |
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Horia Chiorean hchiorea@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC|hchiorea@redhat.com |
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-7/tomcat=new,rhel- |ted,rhel-7/tomcat=new,rhel- |6/tomcat6=new,dts-3.1/devto |6/tomcat6=new,dts-3.1/devto |olset-3-tomcat=new,rhscl-2/ |olset-3-tomcat=new,rhscl-2/ |rh-java-common-tomcat=new,j |rh-java-common-tomcat=new,j |ws-3/tomcat8=affected,jbews |ws-3/tomcat8=affected,jbews |-2/tomcat7=affected,jbews-3 |-2/tomcat7=affected,jbews-3 |/tomcat7=affected,jbews-3/t |/tomcat7=affected,jbews-3/t |omcat8=affected,jbews-2/tom |omcat8=affected,jbews-2/tom |cat6=affected,eap-5/jbosswe |cat6=affected,eap-5/jbosswe |b=new,eap-6/jbossweb=new,jw |b=wontfix,eap-6/jbossweb=af |s-3/tomcat7=affected,jdg-6/ |fected,jws-3/tomcat7=affect |jbossweb=new,jdv-6/jbossweb |ed,jdg-6/jbossweb=new,jdv-6 |=new,fuse-6/jbossweb=new,jo |/jbossweb=new,fuse-6/jbossw |n-3/jbossweb=new,jpp-6/jbos |eb=new,jon-3/jbossweb=new,j |sweb=new,openshift-1/jbossw |pp-6/jbossweb=new,openshift |eb=affected |-1/jbossweb=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1399014 Depends On| |1399016
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Masafumi Miura mmiura@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |mmiura@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Yasuhiro Ozone yozone@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |yozone@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Apurbita Mukherjee apmukher@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |apmukher@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-7/tomcat=new,rhel- |ted,rhel-5/tomcat5=notaffec |6/tomcat6=new,dts-3.1/devto |ted,rhel-7/tomcat=affected, |olset-3-tomcat=new,rhscl-2/ |rhel-6/tomcat6=affected,dts |rh-java-common-tomcat=new,j |-3.1/devtoolset-3-tomcat=ne |ws-3/tomcat8=affected,jbews |w,rhscl-2/rh-java-common-to |-2/tomcat7=affected,jbews-3 |mcat=new,jws-3/tomcat8=affe |/tomcat7=affected,jbews-3/t |cted,jbews-2/tomcat7=affect |omcat8=affected,jbews-2/tom |ed,jbews-3/tomcat7=affected |cat6=affected,eap-5/jbosswe |,jbews-3/tomcat8=affected,j |b=wontfix,eap-6/jbossweb=af |bews-2/tomcat6=affected,eap |fected,jws-3/tomcat7=affect |-5/jbossweb=wontfix,eap-6/j |ed,jdg-6/jbossweb=new,jdv-6 |bossweb=affected,jws-3/tomc |/jbossweb=new,fuse-6/jbossw |at7=affected,jdg-6/jbossweb |eb=new,jon-3/jbossweb=new,j |=new,jdv-6/jbossweb=new,fus |pp-6/jbossweb=new,openshift |e-6/jbossweb=new,jon-3/jbos |-1/jbossweb=affected |sweb=new,jpp-6/jbossweb=new | |,openshift-1/jbossweb=affec | |ted
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1402662 Depends On| |1402663 Depends On| |1402664 Depends On| |1402665
https://bugzilla.redhat.com/show_bug.cgi?id=1397484 Bug 1397484 depends on bug 1397493, which changed state.
Bug 1397493 Summary: CVE-2016-6816 CVE-2016-6817 CVE-2016-8735 tomcat: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1397493
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1397484 Bug 1397484 depends on bug 1397495, which changed state.
Bug 1397495 Summary: CVE-2016-6816 CVE-2016-8735 tomcat: various flaws [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1397495
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |hchiorea@redhat.com Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-5/tomcat5=notaffec |ted,rhel-5/tomcat5=notaffec |ted,rhel-7/tomcat=affected, |ted,rhel-7/tomcat=affected, |rhel-6/tomcat6=affected,dts |rhel-6/tomcat6=affected,dts |-3.1/devtoolset-3-tomcat=ne |-3.1/devtoolset-3-tomcat=ne |w,rhscl-2/rh-java-common-to |w,rhscl-2/rh-java-common-to |mcat=new,jws-3/tomcat8=affe |mcat=new,jws-3/tomcat8=affe |cted,jbews-2/tomcat7=affect |cted,jbews-2/tomcat7=affect |ed,jbews-3/tomcat7=affected |ed,jbews-3/tomcat7=defer,jb |,jbews-3/tomcat8=affected,j |ews-3/tomcat8=defer,jbews-2 |bews-2/tomcat6=affected,eap |/tomcat6=affected,eap-5/jbo |-5/jbossweb=wontfix,eap-6/j |ssweb=wontfix,eap-6/jbosswe |bossweb=affected,jws-3/tomc |b=affected,jws-3/tomcat7=af |at7=affected,jdg-6/jbossweb |fected,jdg-6/jbossweb=new,j |=new,jdv-6/jbossweb=new,fus |dv-6/jbossweb=new,fuse-6/jb |e-6/jbossweb=new,jon-3/jbos |ossweb=new,jon-3/jbossweb=n |sweb=new,jpp-6/jbossweb=new |ew,jpp-6/jbossweb=new,opens |,openshift-1/jbossweb=affec |hift-1/jbossweb=affected |ted |
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Bharti Kundal bkundal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |bkundal@redhat.com
--- Doc Text *updated* --- It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #10 from Coty Sutherland csutherl@redhat.com --- For the record, this fix has been getting some negative responses in the community from users because of the amount of clients that use curly braces ({ and }) and the pipe symbol (|) in their requests without encoding them. Doing so will result in a 400 response after this patch is applied. Additionally, there is no workaround to change the behavior back; see https://bz.apache.org/bugzilla/show_bug.cgi?id=60594 for information on an RFE to add an optional setting.
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #11 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Via RHSA-2017:0247 https://rhn.redhat.com/errata/RHSA-2017-0247.html
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #12 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5
Via RHSA-2017:0246 https://rhn.redhat.com/errata/RHSA-2017-0246.html
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #13 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7
Via RHSA-2017:0245 https://rhn.redhat.com/errata/RHSA-2017-0245.html
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #14 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6
Via RHSA-2017:0244 https://rhn.redhat.com/errata/RHSA-2017-0244.html
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #15 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6
Via RHSA-2017:0250 https://rhn.redhat.com/errata/RHSA-2017-0250.html
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #16 from Timothy Walsh twalsh@redhat.com --- Mitigation:
Why does Tomcat return 400 status after updating to mitigate CVE-2016-6816? For more information, refer to https://access.redhat.com/solutions/2891171
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Doc Text *updated* by Tomas Hoger thoger@redhat.com --- It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other then their own.
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1428325
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #18 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Via RHSA-2017:0457 https://rhn.redhat.com/errata/RHSA-2017-0457.html
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #19 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Web Server 3 for RHEL 7
Via RHSA-2017:0456 https://access.redhat.com/errata/RHSA-2017:0456
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #20 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Web Server 3 for RHEL 6
Via RHSA-2017:0455 https://access.redhat.com/errata/RHSA-2017:0455
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Tomas Hoger thoger@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-5/tomcat5=notaffec |ted,rhel-5/tomcat5=notaffec |ted,rhel-7/tomcat=affected, |ted,rhel-6/tomcat6=affected |rhel-6/tomcat6=affected,dts |,rhel-7/tomcat=affected,dts |-3.1/devtoolset-3-tomcat=ne |-3.1/devtoolset-3-tomcat=no |w,rhscl-2/rh-java-common-to |taffected,rhscl-2/rh-java-c |mcat=new,jws-3/tomcat8=affe |ommon-tomcat=notaffected,jw |cted,jbews-2/tomcat7=affect |s-3/tomcat8=affected,jbews- |ed,jbews-3/tomcat7=defer,jb |2/tomcat7=affected,jbews-3/ |ews-3/tomcat8=defer,jbews-2 |tomcat7=defer,jbews-3/tomca |/tomcat6=affected,eap-5/jbo |t8=defer,jbews-2/tomcat6=af |ssweb=wontfix,eap-6/jbosswe |fected,eap-5/jbossweb=wontf |b=affected,jws-3/tomcat7=af |ix,eap-6/jbossweb=affected, |fected,jdg-6/jbossweb=new,j |jws-3/tomcat7=affected,jdg- |dv-6/jbossweb=new,fuse-6/jb |6/jbossweb=new,jdv-6/jbossw |ossweb=new,jon-3/jbossweb=n |eb=new,fuse-6/jbossweb=new, |ew,jpp-6/jbossweb=new,opens |jon-3/jbossweb=new,jpp-6/jb |hift-1/jbossweb=affected |ossweb=new,openshift-1/jbos | |sweb=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #21 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2017:0527 https://rhn.redhat.com/errata/RHSA-2017-0527.html
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-5/tomcat5=notaffec |ted,rhel-5/tomcat5=affected |ted,rhel-6/tomcat6=affected |,rhel-6/tomcat6=affected,rh |,rhel-7/tomcat=affected,dts |el-7/tomcat=affected,dts-3. |-3.1/devtoolset-3-tomcat=no |1/devtoolset-3-tomcat=notaf |taffected,rhscl-2/rh-java-c |fected,rhscl-2/rh-java-comm |ommon-tomcat=notaffected,jw |on-tomcat=notaffected,jws-3 |s-3/tomcat8=affected,jbews- |/tomcat8=affected,jbews-2/t |2/tomcat7=affected,jbews-3/ |omcat7=affected,jbews-3/tom |tomcat7=defer,jbews-3/tomca |cat7=defer,jbews-3/tomcat8= |t8=defer,jbews-2/tomcat6=af |defer,jbews-2/tomcat6=affec |fected,eap-5/jbossweb=wontf |ted,eap-5/jbossweb=wontfix, |ix,eap-6/jbossweb=affected, |eap-6/jbossweb=affected,jws |jws-3/tomcat7=affected,jdg- |-3/tomcat7=affected,jdg-6/j |6/jbossweb=new,jdv-6/jbossw |bossweb=new,jdv-6/jbossweb= |eb=new,fuse-6/jbossweb=new, |new,fuse-6/jbossweb=new,jon |jon-3/jbossweb=new,jpp-6/jb |-3/jbossweb=new,jpp-6/jboss |ossweb=new,openshift-1/jbos |web=new,openshift-1/jbosswe |sweb=affected |b=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Tomas Hoger thoger@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-5/tomcat5=affected |ted,rhel-5/tomcat5=wontfix, |,rhel-6/tomcat6=affected,rh |rhel-6/tomcat6=affected,rhe |el-7/tomcat=affected,dts-3. |l-7/tomcat=affected,dts-3.1 |1/devtoolset-3-tomcat=notaf |/devtoolset-3-tomcat=notaff |fected,rhscl-2/rh-java-comm |ected,rhscl-2/rh-java-commo |on-tomcat=notaffected,jws-3 |n-tomcat=notaffected,jws-3/ |/tomcat8=affected,jbews-2/t |tomcat8=affected,jbews-2/to |omcat7=affected,jbews-3/tom |mcat7=affected,jbews-3/tomc |cat7=defer,jbews-3/tomcat8= |at7=defer,jbews-3/tomcat8=d |defer,jbews-2/tomcat6=affec |efer,jbews-2/tomcat6=affect |ted,eap-5/jbossweb=wontfix, |ed,eap-5/jbossweb=wontfix,e |eap-6/jbossweb=affected,jws |ap-6/jbossweb=affected,jws- |-3/tomcat7=affected,jdg-6/j |3/tomcat7=affected,jdg-6/jb |bossweb=new,jdv-6/jbossweb= |ossweb=new,jdv-6/jbossweb=n |new,fuse-6/jbossweb=new,jon |ew,fuse-6/jbossweb=new,jon- |-3/jbossweb=new,jpp-6/jboss |3/jbossweb=new,jpp-6/jbossw |web=new,openshift-1/jbosswe |eb=new,openshift-1/jbossweb |b=affected |=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |psotirop@redhat.com Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-5/tomcat5=wontfix, |ted,rhel-5/tomcat5=wontfix, |rhel-6/tomcat6=affected,rhe |rhel-6/tomcat6=affected,rhe |l-7/tomcat=affected,dts-3.1 |l-7/tomcat=affected,dts-3.1 |/devtoolset-3-tomcat=notaff |/devtoolset-3-tomcat=notaff |ected,rhscl-2/rh-java-commo |ected,rhscl-2/rh-java-commo |n-tomcat=notaffected,jws-3/ |n-tomcat=notaffected,jws-3/ |tomcat8=affected,jbews-2/to |tomcat8=affected,jbews-2/to |mcat7=affected,jbews-3/tomc |mcat7=affected,jbews-3/tomc |at7=defer,jbews-3/tomcat8=d |at7=defer,jbews-3/tomcat8=d |efer,jbews-2/tomcat6=affect |efer,jbews-2/tomcat6=affect |ed,eap-5/jbossweb=wontfix,e |ed,eap-5/jbossweb=wontfix,e |ap-6/jbossweb=affected,jws- |ap-6/jbossweb=affected,jws- |3/tomcat7=affected,jdg-6/jb |3/tomcat7=affected,jdg-6/jb |ossweb=new,jdv-6/jbossweb=n |ossweb=new,jdv-6/jbossweb=w |ew,fuse-6/jbossweb=new,jon- |ontfix,fuse-6/jbossweb=new, |3/jbossweb=new,jpp-6/jbossw |jon-3/jbossweb=new,jpp-6/jb |eb=new,openshift-1/jbossweb |ossweb=new,openshift-1/jbos |=affected |sweb=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
--- Comment #24 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2017:0935 https://access.redhat.com/errata/RHSA-2017:0935
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-5/tomcat5=wontfix, |ted,rhel-5/tomcat5=wontfix, |rhel-6/tomcat6=affected,rhe |rhel-6/tomcat6=affected,rhe |l-7/tomcat=affected,dts-3.1 |l-7/tomcat=affected,dts-3.1 |/devtoolset-3-tomcat=notaff |/devtoolset-3-tomcat=notaff |ected,rhscl-2/rh-java-commo |ected,rhscl-2/rh-java-commo |n-tomcat=notaffected,jws-3/ |n-tomcat=notaffected,jws-3/ |tomcat8=affected,jbews-2/to |tomcat8=affected,jbews-2/to |mcat7=affected,jbews-3/tomc |mcat7=affected,jbews-3/tomc |at7=defer,jbews-3/tomcat8=d |at7=defer,jbews-3/tomcat8=d |efer,jbews-2/tomcat6=affect |efer,jbews-2/tomcat6=affect |ed,eap-5/jbossweb=wontfix,e |ed,eap-5/jbossweb=wontfix,e |ap-6/jbossweb=affected,jws- |ap-6/jbossweb=affected,jws- |3/tomcat7=affected,jdg-6/jb |3/tomcat7=affected,jdg-6/jb |ossweb=new,jdv-6/jbossweb=w |ossweb=new,jdv-6/jbossweb=w |ontfix,fuse-6/jbossweb=new, |ontfix,fuse-6/jbossweb=new, |jon-3/jbossweb=new,jpp-6/jb |jon-3/jbossweb=new,jpp-6/jb |ossweb=new,openshift-1/jbos |ossweb=new,openshift-1/jbos |sweb=affected |sweb=affected,jon-3/Core | |Server=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-5/tomcat5=wontfix, |ted,rhel-5/tomcat5=wontfix, |rhel-6/tomcat6=affected,rhe |rhel-6/tomcat6=affected,rhe |l-7/tomcat=affected,dts-3.1 |l-7/tomcat=affected,dts-3.1 |/devtoolset-3-tomcat=notaff |/devtoolset-3-tomcat=notaff |ected,rhscl-2/rh-java-commo |ected,rhscl-2/rh-java-commo |n-tomcat=notaffected,jws-3/ |n-tomcat=notaffected,jws-3/ |tomcat8=affected,jbews-2/to |tomcat8=affected,jbews-2/to |mcat7=affected,jbews-3/tomc |mcat7=affected,jbews-3/tomc |at7=defer,jbews-3/tomcat8=d |at7=defer,jbews-3/tomcat8=d |efer,jbews-2/tomcat6=affect |efer,jbews-2/tomcat6=affect |ed,eap-5/jbossweb=wontfix,e |ed,eap-5/jbossweb=wontfix,e |ap-6/jbossweb=affected,jws- |ap-6/jbossweb=affected,jws- |3/tomcat7=affected,jdg-6/jb |3/tomcat7=affected,jdg-6/jb |ossweb=new,jdv-6/jbossweb=w |ossweb=new,jdv-6/jbossweb=w |ontfix,fuse-6/jbossweb=new, |ontfix,fuse-6/jbossweb=new, |jon-3/jbossweb=new,jpp-6/jb |jpp-6/jbossweb=new,openshif |ossweb=new,openshift-1/jbos |t-1/jbossweb=affected,jon-3 |sweb=affected,jon-3/Core |/Core Server=wontfix |Server=wontfix |
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1415638
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks|1415638 |
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1482229
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161122,sour |1122,reported=20161121,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-5/tomcat5=wontfix, |ted,rhel-5/tomcat5=wontfix, |rhel-6/tomcat6=affected,rhe |rhel-6/tomcat6=affected,rhe |l-7/tomcat=affected,dts-3.1 |l-7/tomcat=affected,dts-3.1 |/devtoolset-3-tomcat=notaff |/devtoolset-3-tomcat=notaff |ected,rhscl-2/rh-java-commo |ected,rhscl-2/rh-java-commo |n-tomcat=notaffected,jws-3/ |n-tomcat=notaffected,jws-3/ |tomcat8=affected,jbews-2/to |tomcat8=affected,jbews-2/to |mcat7=affected,jbews-3/tomc |mcat7=affected,jbews-3/tomc |at7=defer,jbews-3/tomcat8=d |at7=defer,jbews-3/tomcat8=d |efer,jbews-2/tomcat6=affect |efer,jbews-2/tomcat6=affect |ed,eap-5/jbossweb=wontfix,e |ed,eap-5/jbossweb=wontfix,e |ap-6/jbossweb=affected,jws- |ap-6/jbossweb=affected,jws- |3/tomcat7=affected,jdg-6/jb |3/tomcat7=affected,jdg-6/jb |ossweb=new,jdv-6/jbossweb=w |ossweb=new,jdv-6/jbossweb=w |ontfix,fuse-6/jbossweb=new, |ontfix,fuse-6/jbossweb=new, |jpp-6/jbossweb=new,openshif |jpp-6/jbossweb=wontfix,open |t-1/jbossweb=affected,jon-3 |shift-1/jbossweb=affected,j |/Core Server=wontfix |on-3/Core Server=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161121,sour |1122,reported=20161121,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-5/tomcat5=wontfix, |ted,rhel-5/tomcat5=wontfix, |rhel-6/tomcat6=affected,rhe |rhel-6/tomcat6=affected,rhe |l-7/tomcat=affected,dts-3.1 |l-7/tomcat=affected,dts-3.1 |/devtoolset-3-tomcat=notaff |/devtoolset-3-tomcat=notaff |ected,rhscl-2/rh-java-commo |ected,rhscl-2/rh-java-commo |n-tomcat=notaffected,jws-3/ |n-tomcat=notaffected,jws-3/ |tomcat8=affected,jbews-2/to |tomcat8=affected,jbews-2/to |mcat7=affected,jbews-3/tomc |mcat7=affected,jbews-3/tomc |at7=defer,jbews-3/tomcat8=d |at7=defer,jbews-3/tomcat8=d |efer,jbews-2/tomcat6=affect |efer,jbews-2/tomcat6=affect |ed,eap-5/jbossweb=wontfix,e |ed,eap-5/jbossweb=wontfix,e |ap-6/jbossweb=affected,jws- |ap-6/jbossweb=affected,jws- |3/tomcat7=affected,jdg-6/jb |3/tomcat7=affected,jdg-6/jb |ossweb=new,jdv-6/jbossweb=w |ossweb=wontfix,jdv-6/jbossw |ontfix,fuse-6/jbossweb=new, |eb=wontfix,fuse-6/jbossweb= |jpp-6/jbossweb=wontfix,open |new,jpp-6/jbossweb=wontfix, |shift-1/jbossweb=affected,j |openshift-1/jbossweb=affect |on-3/Core Server=wontfix |ed,jon-3/Core | |Server=wontfix
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Viliam Križan vkrizan@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |1122,reported=20161121,sour |1122,reported=20161122,sour |ce=internet,cvss2=5.8/AV:N/ |ce=internet,cvss2=5.8/AV:N/ |AC:M/Au:N/C:P/I:P/A:N,cvss3 |AC:M/Au:N/C:P/I:P/A:N,cvss3 |=6.5/CVSS:3.0/AV:N/AC:L/PR: |=6.5/CVSS:3.0/AV:N/AC:L/PR: |N/UI:N/S:U/C:L/I:L/A:N,cwe= |N/UI:N/S:U/C:L/I:L/A:N,cwe= |CWE-444,fedora-all/tomcat=a |CWE-444,fedora-all/tomcat=a |ffected,epel-6/tomcat=affec |ffected,epel-6/tomcat=affec |ted,rhel-5/tomcat5=wontfix, |ted,rhel-5/tomcat5=wontfix, |rhel-6/tomcat6=affected,rhe |rhel-6/tomcat6=affected,rhe |l-7/tomcat=affected,dts-3.1 |l-7/tomcat=affected,dts-3.1 |/devtoolset-3-tomcat=notaff |/devtoolset-3-tomcat=notaff |ected,rhscl-2/rh-java-commo |ected,rhscl-2/rh-java-commo |n-tomcat=notaffected,jws-3/ |n-tomcat=notaffected,jws-3/ |tomcat8=affected,jbews-2/to |tomcat8=affected,jbews-2/to |mcat7=affected,jbews-3/tomc |mcat7=affected,jbews-3/tomc |at7=defer,jbews-3/tomcat8=d |at7=defer,jbews-3/tomcat8=d |efer,jbews-2/tomcat6=affect |efer,jbews-2/tomcat6=affect |ed,eap-5/jbossweb=wontfix,e |ed,eap-5/jbossweb=wontfix,e |ap-6/jbossweb=affected,jws- |ap-6/jbossweb=affected,jws- |3/tomcat7=affected,jdg-6/jb |3/tomcat7=affected,jdg-6/jb |ossweb=wontfix,jdv-6/jbossw |ossweb=wontfix,jdv-6/jbossw |eb=wontfix,fuse-6/jbossweb= |eb=wontfix,fuse-6/jbossweb= |new,jpp-6/jbossweb=wontfix, |new,jpp-6/jbossweb=wontfix, |openshift-1/jbossweb=affect |openshift-1/jbossweb=affect |ed,jon-3/Core |ed,jon-3/Core |Server=wontfix |Server=wontfix
java-sig-commits@lists.fedoraproject.org