https://bugzilla.redhat.com/show_bug.cgi?id=1701056
Bug ID: 1701056
Summary: CVE-2019-0232 tomcat: Remote Code Execution on Windows
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=important,public=20190410,reported=20190416,sou
rce=cve,cvss3=5.9/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N
/I:N/A:H,cwe=CWE-20,fedora-all/tomcat=notaffected,rhsc
l-3/rh-java-common-tomcat=notaffected,bpms-6/tomcat=no
taffected,brms-6/tomcat=notaffected,epel-all/tomcat=no
taffected,brms-5/jbossweb=notaffected,eap-6/jbossweb=n
otaffected,eap-5/jbossweb=notaffected,jdg-6/jbossweb=n
otaffected,jdg-7/tomcat=notaffected,jdv-6/jbossweb=not
affected,fuse-6/tomcat=notaffected,fuse-7/tomcat=notaf
fected,fsw-6/jbossweb=notaffected,soap-5/jbossweb=nota
ffected,springboot-1/tomcat=notaffected,jbews-2/tomcat
6=new,jws-3/tomcat7=new,rhel-7/tomcat=notaffected,jbew
s-2/tomcat7=new,jws-3/tomcat8=new,rhel-6/tomcat6=notaf
fected,jon-3/jbossweb=notaffected,jws-5/tomcat=new,rhe
l-8/pki-deps:10.6/pki-servlet-container=notaffected
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, anstephe(a)redhat.com,
avibelli(a)redhat.com, bgeorges(a)redhat.com,
bmaxwell(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, cmoulliard(a)redhat.com,
coolsvap(a)gmail.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, fgavrilo(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hhorak(a)redhat.com, ibek(a)redhat.com,
ikanello(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdoyle(a)redhat.com, jochrist(a)redhat.com,
jolee(a)redhat.com, jondruse(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jschatte(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, loleary(a)redhat.com,
lpetrovi(a)redhat.com, lthon(a)redhat.com,
mbabacek(a)redhat.com, mizdebsk(a)redhat.com,
mszynkie(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pgallagh(a)redhat.com, pgier(a)redhat.com,
pjurak(a)redhat.com, ppalaga(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
rhcs-maint(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sdaley(a)redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
trogers(a)redhat.com, twalsh(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com,
weli(a)redhat.com
Blocks: 1700240
Target Milestone: ---
Classification: Other
Blocks: 1700240
A vulnerability was found in in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to
8.5.39 and 7.0.0 to 7.0.93. When running on Windows with enableCmdLineArguments
enabled, the CGI Servlet is vulnerable to Remote Code Execution due to a bug in
the way the JRE passes command line arguments to Windows. The CGI Servlet is
disabled by default. The CGI option enableCmdLineArguments is disable by
default in Tomcat 9.0.x (and will be disabled by default in all versions in
response to this vulnerability).
References:
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-8.html
http://tomcat.apache.org/security-9.html
Upstream Patch:
https://github.com/apache/tomcat/commit/7f0221b
--
You are receiving this mail because:
You are on the CC list for the bug.