https://bugzilla.redhat.com/show_bug.cgi?id=1069911
--- Doc Text *updated* ---
It was found that several application-provided XML files, such as web.xml, content.xml,
*.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity
(XXE) attacks. A remote attacker could use this flaw to circumvent security restrictions
set by the Java Security Manager, and gain access to sensitive information on the system.
Note that this flaw only affected deployments in which Tomcat is running web applications
from untrusted sources, such as in a shared hosting environment.
--- Comment #29 from Martin Prpic <mprpic(a)redhat.com> ---
IssueDescription:
It was found that several application-provided XML files, such as web.xml,
content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting
XML External Entity (XXE) attacks. A remote attacker could use this flaw to
circumvent security restrictions set by the Java Security Manager, and gain
access to sensitive information on the system. Note that this flaw only
affected deployments in which Tomcat is running web applications from untrusted
sources, such as in a shared hosting environment.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=MeoSndJ713&a=cc_unsubscribe