https://bugzilla.redhat.com/show_bug.cgi?id=1069911
--- Doc Text *updated* ---
It was found that several application-provided XML files, such as web.xml, content.xml,
*.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity
(XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this
flaw to circumvent security restrictions set by the JSM, and gain access to sensitive
information on the system. Note that this flaw only affected deployments in which Tomcat
is running applications from untrusted sources, such as in a shared hosting environment.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=JyoAcr4fTU&a=cc_unsubscribe