https://bugzilla.redhat.com/show_bug.cgi?id=1493220
Bug ID: 1493220
Summary: CVE-2017-12615 tomcat: Remote Code Execution via JSP
Upload
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: akurtako(a)redhat.com, alee(a)redhat.com,
apintea(a)redhat.com, bkundal(a)redhat.com,
bmaxwell(a)redhat.com, ccoleman(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dedgar(a)redhat.com, dimitris(a)redhat.com,
dmcphers(a)redhat.com, dosoudil(a)redhat.com,
felias(a)redhat.com, fgavrilo(a)redhat.com,
gzaronik(a)redhat.com, hchiorea(a)redhat.com,
hhorak(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jclere(a)redhat.com,
jcoleman(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, jolee(a)redhat.com,
jondruse(a)redhat.com, jorton(a)redhat.com,
jshepherd(a)redhat.com, krzysztof.daniel(a)gmail.com,
lgao(a)redhat.com, loleary(a)redhat.com,
mbabacek(a)redhat.com, me(a)coolsvap.net,
mizdebsk(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, pjurak(a)redhat.com,
ppalaga(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
spinder(a)redhat.com, sstavrev(a)redhat.com,
theute(a)redhat.com, twalsh(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com,
weli(a)redhat.com
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled
(e.g. via setting the readonly initialisation parameter of the Default to
false) it was possible to upload a JSP file to the server via a specially
crafted request. This JSP could then be requested and any code it contained
would be executed by the server.
Affected versions: 7.0.0 to 7.0.79
External References:
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81
--
You are receiving this mail because:
You are on the CC list for the bug.