https://bugzilla.redhat.com/show_bug.cgi?id=1869672
Bug ID: 1869672
Summary: CVE-2019-0230 struts: possible RCE due to forced
double OGNL evaluation when evaluated on raw user
input in tag attributes
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
bbaranow(a)redhat.com, bmaxwell(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, darran.lofthouse(a)redhat.com,
dbecker(a)redhat.com, dbhole(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
eleandro(a)redhat.com, extras-orphan(a)fedoraproject.org,
gvarsami(a)redhat.com, iweiss(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jjelen(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jperkins(a)redhat.com,
jschluet(a)redhat.com, jwon(a)redhat.com,
kbasil(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com,
loleary(a)redhat.com, lpeer(a)redhat.com,
mburns(a)redhat.com, mkolesni(a)redhat.com,
mmraka(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, nwallace(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, puntogil(a)libero.it,
rguimara(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rwagner(a)redhat.com,
sclewis(a)redhat.com, scohen(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
tom.jenkinson(a)redhat.com
Target Milestone: ---
Classification: Other
The Apache Struts frameworks, when forced, performs double evaluation of
attributes' values assigned to certain tags attributes such as id so it is
possible to pass in a value that will be evaluated again when a tag's
attributes will be rendered. With a carefully crafted request, this can lead to
Remote Code Execution (RCE).
Reference:
https://cwiki.apache.org/confluence/display/WW/S2-059
--
You are receiving this mail because:
You are on the CC list for the bug.