https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Bug ID: 1311093 Summary: CVE-2016-0763 tomcat: security manager bypass via setGlobalContext() Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: anemec@redhat.com CC: aileenc@redhat.com, alazarot@redhat.com, alee@redhat.com, asantos@redhat.com, bbaranow@redhat.com, bdawidow@redhat.com, bmaxwell@redhat.com, brms-jira@redhat.com, ccoleman@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, csutherl@redhat.com, dandread@redhat.com, darran.lofthouse@redhat.com, dknox@redhat.com, dmcphers@redhat.com, epp-bugs@redhat.com, etirelli@redhat.com, fnasser@redhat.com, gvarsami@redhat.com, hfnukal@redhat.com, huwang@redhat.com, ivan.afonichev@gmail.com, jason.greene@redhat.com, java-sig-commits@lists.fedoraproject.org, jawilson@redhat.com, jboss-set@redhat.com, jclere@redhat.com, jcoleman@redhat.com, jdg-bugs@redhat.com, jdoyle@redhat.com, jialiu@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, jpallich@redhat.com, jshepherd@redhat.com, kconner@redhat.com, krzysztof.daniel@gmail.com, kseifried@redhat.com, ldimaggi@redhat.com, lgao@redhat.com, lmeyer@redhat.com, lpetrovi@redhat.com, mbabacek@redhat.com, mbaluch@redhat.com, me@coolsvap.net, miburman@redhat.com, mmccomas@redhat.com, mweiler@redhat.com, mwinkler@redhat.com, myarboro@redhat.com, nwallace@redhat.com, pavelp@redhat.com, pcheung@redhat.com, pgier@redhat.com, psakar@redhat.com, pslavice@redhat.com, rnetuka@redhat.com, rrajasek@redhat.com, rsvoboda@redhat.com, rwagner@redhat.com, rzhang@redhat.com, soa-p-jira@post-office.corp.redhat.com, spinder@redhat.com, tcunning@redhat.com, theute@redhat.com, tkirby@redhat.com, ttarrant@redhat.com, twalsh@redhat.com, vtunka@redhat.com, weli@redhat.com
ResourceLinkFactory.setGlobalContext() is a public method and was accessible by web applications running under a security manager without any checks. This allowed a malicious web application to inject a malicious global context that could in turn be used to disrupt other web applications and/or read and write data owned by other web applications.
External references:
http://seclists.org/bugtraq/2016/Feb/147
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1311095
--- Comment #1 from Andrej Nemec anemec@redhat.com ---
Created tomcat tracking bugs for this issue:
Affects: epel-6 [bug 1311095]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1311095 [Bug 1311095] CVE-2016-0763 tomcat: security manager bypass via setGlobalContext() [epel-6]
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0222,reported=20160222,sour |0222,reported=20160222,sour |ce=bugtraq,cvss2=4.3/AV:A/A |ce=bugtraq,cvss2=4.3/AV:A/A |C:M/Au:N/C:P/I:P/A:N,cwe=CW |C:M/Au:N/C:P/I:P/A:N,cwe=CW |E-592,brms-5/jbossweb=new,e |E-592,brms-5/jbossweb=new,e |ap-4/jbossweb=wontfix,eap-5 |ap-4/jbossweb=wontfix,eap-5 |/jbossweb=wontfix,eap-6/jbo |/jbossweb=wontfix,eap-6/jbo |ssweb=affected,epel-6/tomca |ssweb=affected,epel-6/tomca |t=affected,fedora-all/tomca |t=affected,fedora-all/tomca |t=new,fsw-6/jbossweb=new,jb |t=affected,fsw-6/jbossweb=n |ews-2/tomcat7=affected,jbew |ew,jbews-2/tomcat7=affected |s-3/tomcat7=affected,jbews- |,jbews-3/tomcat7=affected,j |3/tomcat8=affected,jdg-6/jb |bews-3/tomcat8=affected,jdg |ossweb=affected,jon-3/jboss |-6/jbossweb=affected,jon-3/ |web=affected,jpp-6/jbossweb |jbossweb=affected,jpp-6/jbo |=affected,openshift-1/jboss |ssweb=affected,openshift-1/ |web=new,rhel-6/tomcat6=affe |jbossweb=new,rhel-6/tomcat6 |cted,rhel-7/tomcat=affected |=affected,rhel-7/tomcat=aff | |ected
--- Comment #2 from Andrej Nemec anemec@redhat.com --- Upstream patches:
Tomcat7:
http://svn.apache.org/viewvc?view=revision&revision=1725931
Tomcat8:
http://svn.apache.org/viewvc?view=revision&revision=1725929
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1311102
--- Comment #3 from Andrej Nemec anemec@redhat.com ---
Created tomcat tracking bugs for this issue:
Affects: fedora-all [bug 1311102]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1311102 [Bug 1311102] CVE-2016-0763 tomcat: security manager bypass via setGlobalContext() [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1311109
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Md Azhar mdshaikh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |mdshaikh@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1316037 Depends On| |1316038
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
--- Comment #5 from Fedora Update System updates@fedoraproject.org --- tomcat-7.0.68-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1311093 Bug 1311093 depends on bug 1311095, which changed state.
Bug 1311095 Summary: CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1311095
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0222,reported=20160222,sour |0222,reported=20160222,sour |ce=bugtraq,cvss2=4.3/AV:A/A |ce=bugtraq,cvss2=4.3/AV:A/A |C:M/Au:N/C:P/I:P/A:N,cwe=CW |C:M/Au:N/C:P/I:P/A:N,cwe=CW |E-592,brms-5/jbossweb=new,e |E-592,brms-5/jbossweb=new,e |ap-4/jbossweb=wontfix,eap-5 |ap-4/jbossweb=wontfix,eap-5 |/jbossweb=wontfix,eap-6/jbo |/jbossweb=wontfix,eap-6/jbo |ssweb=affected,epel-6/tomca |ssweb=affected,epel-6/tomca |t=affected,fedora-all/tomca |t=affected,fedora-all/tomca |t=affected,fsw-6/jbossweb=n |t=affected,fsw-6/jbossweb=n |ew,jbews-2/tomcat7=affected |ew,jbews-2/tomcat7=wontfix, |,jbews-3/tomcat7=affected,j |jbews-3/tomcat7=affected,jb |bews-3/tomcat8=affected,jdg |ews-3/tomcat8=affected,jdg- |-6/jbossweb=affected,jon-3/ |6/jbossweb=affected,jon-3/j |jbossweb=affected,jpp-6/jbo |bossweb=affected,jpp-6/jbos |ssweb=affected,openshift-1/ |sweb=affected,openshift-1/j |jbossweb=new,rhel-6/tomcat6 |bossweb=new,rhel-6/tomcat6= |=affected,rhel-7/tomcat=aff |affected,rhel-7/tomcat=affe |ected |cted
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1322819 Depends On| |1322820
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service.
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
--- Comment #8 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Via RHSA-2016:1089 https://rhn.redhat.com/errata/RHSA-2016-1089.html
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
--- Comment #9 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
JWS 3.0 for RHEL 7
Via RHSA-2016:1088 https://access.redhat.com/errata/RHSA-2016:1088
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
--- Comment #10 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
JWS 3.0 for RHEL 6
Via RHSA-2016:1087 https://access.redhat.com/errata/RHSA-2016:1087
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0222,reported=20160222,sour |0222,reported=20160222,sour |ce=bugtraq,cvss2=4.3/AV:A/A |ce=bugtraq,cvss2=4.3/AV:A/A |C:M/Au:N/C:P/I:P/A:N,cwe=CW |C:M/Au:N/C:P/I:P/A:N,cwe=CW |E-592,brms-5/jbossweb=new,e |E-592,brms-5/jbossweb=new,e |ap-4/jbossweb=wontfix,eap-5 |ap-4/jbossweb=wontfix,eap-5 |/jbossweb=wontfix,eap-6/jbo |/jbossweb=wontfix,eap-6/jbo |ssweb=affected,epel-6/tomca |ssweb=wontfix,epel-6/tomcat |t=affected,fedora-all/tomca |=affected,fedora-all/tomcat |t=affected,fsw-6/jbossweb=n |=affected,fsw-6/jbossweb=ne |ew,jbews-2/tomcat7=wontfix, |w,jbews-2/tomcat7=wontfix,j |jbews-3/tomcat7=affected,jb |bews-3/tomcat7=affected,jbe |ews-3/tomcat8=affected,jdg- |ws-3/tomcat8=affected,jdg-6 |6/jbossweb=affected,jon-3/j |/jbossweb=affected,jon-3/jb |bossweb=affected,jpp-6/jbos |ossweb=affected,jpp-6/jboss |sweb=affected,openshift-1/j |web=affected,openshift-1/jb |bossweb=new,rhel-6/tomcat6= |ossweb=new,rhel-6/tomcat6=a |affected,rhel-7/tomcat=affe |ffected,rhel-7/tomcat=affec |cted |ted
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Yasuhiro Ozone yozone@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |yozone@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1347145 Depends On| |1347146
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0222,reported=20160222,sour |0222,reported=20160222,sour |ce=bugtraq,cvss2=4.3/AV:A/A |ce=bugtraq,cvss2=4.3/AV:A/A |C:M/Au:N/C:P/I:P/A:N,cwe=CW |C:M/Au:N/C:P/I:P/A:N,cwe=CW |E-592,brms-5/jbossweb=new,e |E-592,brms-5/jbossweb=new,e |ap-4/jbossweb=wontfix,eap-5 |ap-4/jbossweb=wontfix,eap-5 |/jbossweb=wontfix,eap-6/jbo |/jbossweb=wontfix,eap-6/jbo |ssweb=wontfix,epel-6/tomcat |ssweb=wontfix,epel-6/tomcat |=affected,fedora-all/tomcat |=affected,fedora-all/tomcat |=affected,fsw-6/jbossweb=ne |=affected,fsw-6/jbossweb=ne |w,jbews-2/tomcat7=wontfix,j |w,jbews-2/tomcat7=wontfix,j |bews-3/tomcat7=affected,jbe |bews-3/tomcat7=affected,jbe |ws-3/tomcat8=affected,jdg-6 |ws-3/tomcat8=affected,jdg-6 |/jbossweb=affected,jon-3/jb |/jbossweb=affected,jon-3/jb |ossweb=affected,jpp-6/jboss |ossweb=affected,jpp-6/jboss |web=affected,openshift-1/jb |web=affected,openshift-1/jb |ossweb=new,rhel-6/tomcat6=a |ossweb=new,rhel-7/tomcat=af |ffected,rhel-7/tomcat=affec |fected |ted |
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0222,reported=20160222,sour |0222,reported=20160222,sour |ce=bugtraq,cvss2=4.3/AV:A/A |ce=bugtraq,cvss2=4.3/AV:A/A |C:M/Au:N/C:P/I:P/A:N,cwe=CW |C:M/Au:N/C:P/I:P/A:N,cwe=CW |E-592,brms-5/jbossweb=new,e |E-592,brms-5/jbossweb=wontf |ap-4/jbossweb=wontfix,eap-5 |ix,eap-4/jbossweb=wontfix,e |/jbossweb=wontfix,eap-6/jbo |ap-5/jbossweb=wontfix,eap-6 |ssweb=wontfix,epel-6/tomcat |/jbossweb=wontfix,epel-6/to |=affected,fedora-all/tomcat |mcat=affected,fedora-all/to |=affected,fsw-6/jbossweb=ne |mcat=affected,fsw-6/jbosswe |w,jbews-2/tomcat7=wontfix,j |b=wontfix,jbews-2/tomcat7=w |bews-3/tomcat7=affected,jbe |ontfix,jbews-3/tomcat7=affe |ws-3/tomcat8=affected,jdg-6 |cted,jbews-3/tomcat8=affect |/jbossweb=affected,jon-3/jb |ed,jdg-6/jbossweb=affected, |ossweb=affected,jpp-6/jboss |jon-3/jbossweb=affected,jpp |web=affected,openshift-1/jb |-6/jbossweb=affected,opensh |ossweb=new,rhel-7/tomcat=af |ift-1/jbossweb=new,rhel-7/t |fected |omcat=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
svenvdplus@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |svenvdplus@gmail.com
--- Comment #12 from svenvdplus@gmail.com --- Dear,
The latest tomcat on a standard RHEL 7.2 installation doesn't seem to contain this fix as the latest build date is from last year.
[root@localhost ~]# rpm -qi tomcat Name : tomcat Epoch : 0 Version : 7.0.54 Release : 2.el7_1 Architecture: noarch Install Date: Sun 19 Jun 2016 03:10:42 PM EDT Group : System Environment/Daemons Size : 305912 License : ASL 2.0 Signature : RSA/SHA256, Mon 27 Apr 2015 05:00:28 AM EDT, Key ID 199e2f91fd431d51 Source RPM : tomcat-7.0.54-2.el7_1.src.rpm Build Date : Tue 24 Mar 2015 07:51:30 PM EDT Build Host : ppc-015.build.eng.bos.redhat.com Relocations : (not relocatable) Packager : Red Hat, Inc. http://bugzilla.redhat.com/bugzilla Vendor : Red Hat, Inc. URL : http://tomcat.apache.org/ Summary : Apache Servlet/JSP Engine, RI for Servlet 3.0/JSP 2.2 API Description : Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.
Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.
Can someone confirm this cve is or will be fixed in the standard tomcat package in RHEL7?
Thanks
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Coty Sutherland csutherl@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1352009
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1352009 [Bug 1352009] CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 CVE-2016-3092 tomcat: multiple security vulnerabilities [epel-6]
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0222,reported=20160222,sour |0222,reported=20160222,sour |ce=bugtraq,cvss2=4.3/AV:A/A |ce=bugtraq,cvss2=4.3/AV:A/A |C:M/Au:N/C:P/I:P/A:N,cwe=CW |C:M/Au:N/C:P/I:P/A:N,cwe=CW |E-592,brms-5/jbossweb=wontf |E-592,brms-5/jbossweb=wontf |ix,eap-4/jbossweb=wontfix,e |ix,eap-4/jbossweb=wontfix,e |ap-5/jbossweb=wontfix,eap-6 |ap-5/jbossweb=wontfix,eap-6 |/jbossweb=wontfix,epel-6/to |/jbossweb=wontfix,epel-6/to |mcat=affected,fedora-all/to |mcat=affected,fedora-all/to |mcat=affected,fsw-6/jbosswe |mcat=affected,fsw-6/jbosswe |b=wontfix,jbews-2/tomcat7=w |b=wontfix,jbews-2/tomcat7=w |ontfix,jbews-3/tomcat7=affe |ontfix,jbews-3/tomcat7=affe |cted,jbews-3/tomcat8=affect |cted,jbews-3/tomcat8=affect |ed,jdg-6/jbossweb=affected, |ed,jdg-6/jbossweb=affected, |jon-3/jbossweb=affected,jpp |jon-3/jbossweb=affected,jpp |-6/jbossweb=affected,opensh |-6/jbossweb=affected,opensh |ift-1/jbossweb=new,rhel-7/t |ift-1/jbossweb=new,rhel-6/t |omcat=affected |omcat6=notaffected,rhel-7/t | |omcat=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1311093 Bug 1311093 depends on bug 1311102, which changed state.
Bug 1311102 Summary: CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1311102
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |CURRENTRELEASE
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
--- Comment #14 from Fedora Update System updates@fedoraproject.org --- tomcat-7.0.70-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1311093 Bug 1311093 depends on bug 1352009, which changed state.
Bug 1352009 Summary: CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 CVE-2016-3092 tomcat: multiple security vulnerabilities [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1352009
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
--- Comment #15 from Fedora Update System updates@fedoraproject.org --- tomcat-7.0.70-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0222,reported=20160222,sour |0222,reported=20160222,sour |ce=bugtraq,cvss2=4.3/AV:A/A |ce=bugtraq,cvss2=4.3/AV:A/A |C:M/Au:N/C:P/I:P/A:N,cwe=CW |C:M/Au:N/C:P/I:P/A:N,cwe=CW |E-592,brms-5/jbossweb=wontf |E-592,brms-5/jbossweb=wontf |ix,eap-4/jbossweb=wontfix,e |ix,eap-4/jbossweb=wontfix,e |ap-5/jbossweb=wontfix,eap-6 |ap-5/jbossweb=wontfix,eap-6 |/jbossweb=wontfix,epel-6/to |/jbossweb=wontfix,epel-6/to |mcat=affected,fedora-all/to |mcat=affected,fedora-all/to |mcat=affected,fsw-6/jbosswe |mcat=affected,fsw-6/jbosswe |b=wontfix,jbews-2/tomcat7=w |b=wontfix,jbews-2/tomcat7=a |ontfix,jbews-3/tomcat7=affe |ffected,jbews-3/tomcat7=aff |cted,jbews-3/tomcat8=affect |ected,jbews-3/tomcat8=affec |ed,jdg-6/jbossweb=affected, |ted,jdg-6/jbossweb=affected |jon-3/jbossweb=affected,jpp |,jon-3/jbossweb=affected,jp |-6/jbossweb=affected,opensh |p-6/jbossweb=affected,opens |ift-1/jbossweb=new,rhel-6/t |hift-1/jbossweb=new,rhel-6/ |omcat6=notaffected,rhel-7/t |tomcat6=notaffected,rhel-7/ |omcat=affected |tomcat=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1381938
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1382592
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
--- Comment #18 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2016:2599 https://rhn.redhat.com/errata/RHSA-2016-2599.html
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
--- Comment #19 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2016:2599 https://rhn.redhat.com/errata/RHSA-2016-2599.html
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0222,reported=20160222,sour |0222,reported=20160222,sour |ce=bugtraq,cvss2=4.3/AV:A/A |ce=bugtraq,cvss2=4.3/AV:A/A |C:M/Au:N/C:P/I:P/A:N,cwe=CW |C:M/Au:N/C:P/I:P/A:N,cvss3= |E-592,brms-5/jbossweb=wontf |6.3/CVSS:3.0/AV:N/AC:L/PR:L |ix,eap-4/jbossweb=wontfix,e |/UI:N/S:U/C:L/I:L/A:L,cwe=C |ap-5/jbossweb=wontfix,eap-6 |WE-592,brms-5/jbossweb=wont |/jbossweb=wontfix,epel-6/to |fix,eap-4/jbossweb=wontfix, |mcat=affected,fedora-all/to |eap-5/jbossweb=wontfix,eap- |mcat=affected,fsw-6/jbosswe |6/jbossweb=wontfix,epel-6/t |b=wontfix,jbews-2/tomcat7=a |omcat=affected,fedora-all/t |ffected,jbews-3/tomcat7=aff |omcat=affected,fsw-6/jbossw |ected,jbews-3/tomcat8=affec |eb=wontfix,jbews-2/tomcat7= |ted,jdg-6/jbossweb=affected |affected,jbews-3/tomcat7=af |,jon-3/jbossweb=affected,jp |fected,jbews-3/tomcat8=affe |p-6/jbossweb=affected,opens |cted,jdg-6/jbossweb=affecte |hift-1/jbossweb=new,rhel-6/ |d,jon-3/jbossweb=affected,j |tomcat6=notaffected,rhel-7/ |pp-6/jbossweb=affected,open |tomcat=affected |shift-1/jbossweb=new,rhel-6 | |/tomcat6=notaffected,rhel-7 | |/tomcat=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
--- Comment #20 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Via RHSA-2016:2808 https://rhn.redhat.com/errata/RHSA-2016-2808.html
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
--- Comment #21 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Red Hat JBoss Enterprise Web Server 2 for RHEL 7
Via RHSA-2016:2807 https://rhn.redhat.com/errata/RHSA-2016-2807.html
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1318206
java-sig-commits@lists.fedoraproject.org