https://bugzilla.redhat.com/show_bug.cgi?id=1869682
Bug ID: 1869682
Summary: CVE-2019-0233 struts: access permission override when
performing a file upload leads to DoS
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
bbaranow(a)redhat.com, bmaxwell(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, darran.lofthouse(a)redhat.com,
dbecker(a)redhat.com, dbhole(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
eleandro(a)redhat.com, extras-orphan(a)fedoraproject.org,
gvarsami(a)redhat.com, iweiss(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jjelen(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jperkins(a)redhat.com,
jschluet(a)redhat.com, jwon(a)redhat.com,
kbasil(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com,
loleary(a)redhat.com, lpeer(a)redhat.com,
mburns(a)redhat.com, mkolesni(a)redhat.com,
mmraka(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, nwallace(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, puntogil(a)libero.it,
rguimara(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rwagner(a)redhat.com,
sclewis(a)redhat.com, scohen(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
tom.jenkinson(a)redhat.com
Target Milestone: ---
Classification: Other
When a file upload is performed to an Action that exposes the file with a
getter, an attacker may manipulate the request such that the working copy of
the uploaded file is set to read-only. As a result, subsequent actions on the
file will fail with an error. It might also be possible to set the Servlet
container's temp directory to read only, such that subsequent upload actions
will fail.
Reference:
https://cwiki.apache.org/confluence/display/WW/S2-060
--
You are receiving this mail because:
You are on the CC list for the bug.