https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Bug ID: 1311085 Summary: CVE-2015-5346 Apache Tomcat Session fixation Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: twalsh@redhat.com CC: aileenc@redhat.com, alazarot@redhat.com, alee@redhat.com, asantos@redhat.com, bbaranow@redhat.com, bdawidow@redhat.com, bmaxwell@redhat.com, brms-jira@redhat.com, ccoleman@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, csutherl@redhat.com, dandread@redhat.com, darran.lofthouse@redhat.com, dknox@redhat.com, dmcphers@redhat.com, epp-bugs@redhat.com, etirelli@redhat.com, fnasser@redhat.com, gvarsami@redhat.com, hfnukal@redhat.com, huwang@redhat.com, ivan.afonichev@gmail.com, jason.greene@redhat.com, java-sig-commits@lists.fedoraproject.org, jawilson@redhat.com, jboss-set@redhat.com, jbpapp-maint@redhat.com, jclere@redhat.com, jcoleman@redhat.com, jdg-bugs@redhat.com, jdoyle@redhat.com, jialiu@redhat.com, joelsmith@redhat.com, jokerman@redhat.com, jpallich@redhat.com, jshepherd@redhat.com, kconner@redhat.com, krzysztof.daniel@gmail.com, kseifried@redhat.com, ldimaggi@redhat.com, lgao@redhat.com, lmeyer@redhat.com, lpetrovi@redhat.com, mbabacek@redhat.com, mbaluch@redhat.com, me@coolsvap.net, miburman@redhat.com, mmccomas@redhat.com, mweiler@redhat.com, mwinkler@redhat.com, myarboro@redhat.com, nwallace@redhat.com, pavelp@redhat.com, pcheung@redhat.com, pgier@redhat.com, psakar@redhat.com, pslavice@redhat.com, rnetuka@redhat.com, rrajasek@redhat.com, rsvoboda@redhat.com, rwagner@redhat.com, rzhang@redhat.com, soa-p-jira@post-office.corp.redhat.com, spinder@redhat.com, tcunning@redhat.com, theute@redhat.com, tkirby@redhat.com, ttarrant@redhat.com, twalsh@redhat.com, vtunka@redhat.com, weli@redhat.com
When recycling the Request object to use for a new request, the requestedSessionSSL field was not recycled. This meant that a session ID provided in the next request to be processed using the recycled Request object could be used when it should not have been. This gave the client the ability to control the session ID. In theory, this could have been used as part of a session fixation attack but it would have been hard to achieve as the attacker would not have been able to force the victim to use the 'correct' Request object. It was also necessary for at least one web application to be configured to use the SSL session ID as the HTTP session ID. This is not a common configuration.
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version|tomcat 7.0.67, |tomcat 7.0.67, tomcat | |8.0.32
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160222, |impact=low,public=20160222, |reported=20140622,source=up |reported=20140622,source=up |stream,brms-5/jbossweb=new, |stream,brms-5/jbossweb=new, |eap-4/jbossweb=wontfix,eap- |eap-4/jbossweb=wontfix,eap- |5/jbossweb=wontfix,eap-6/jb |5/jbossweb=wontfix,eap-6/jb |ossweb=affected,epel-6/tomc |ossweb=affected,epel-6/tomc |at=affected,fedora-all/tomc |at=affected,fedora-all/tomc |at=new,fsw-6/jbossweb=new,j |at=new,fsw-6/jbossweb=new,j |bews-1/tomcat5=wontfix,jbew |bews-2/tomcat7=affected,jbe |s-1/tomcat6=wontfix,jbews-2 |ws-3/tomcat7=affected,jbews |/tomcat6=affected,jbews-2/t |-3/tomcat8=affected,jdg-6/j |omcat7=affected,jbews-3/tom |bossweb=affected,jon-3/jbos |cat7=affected,jbews-3/tomca |sweb=affected,jpp-6/jbosswe |t8=affected,jdg-6/jbossweb= |b=affected,openshift-1/jbos |affected,jon-3/jbossweb=aff |sweb=new,rhel-6/tomcat6=aff |ected,jpp-6/jbossweb=affect |ected,rhel-7/tomcat=affecte |ed,openshift-1/jbossweb=new |d |,rhel-6/tomcat6=affected,rh | |el-7/tomcat=affected,soap-4 | |/jbossweb=wontfix,soap-5/jb | |ossweb=wontfix |
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Tomas Hoger thoger@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2015-5346 Apache Tomcat |CVE-2015-5346 tomcat: |Session fixation |Session fixation
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |anemec@redhat.com
--- Comment #1 from Andrej Nemec anemec@redhat.com --- External references:
http://seclists.org/bugtraq/2016/Feb/143
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160222, |impact=low,public=20160222, |reported=20140622,source=up |reported=20140622,source=bu |stream,brms-5/jbossweb=new, |gtraq,brms-5/jbossweb=new,e |eap-4/jbossweb=wontfix,eap- |ap-4/jbossweb=wontfix,eap-5 |5/jbossweb=wontfix,eap-6/jb |/jbossweb=wontfix,eap-6/jbo |ossweb=affected,epel-6/tomc |ssweb=affected,epel-6/tomca |at=affected,fedora-all/tomc |t=affected,fedora-all/tomca |at=new,fsw-6/jbossweb=new,j |t=new,fsw-6/jbossweb=new,jb |bews-2/tomcat7=affected,jbe |ews-2/tomcat7=affected,jbew |ws-3/tomcat7=affected,jbews |s-3/tomcat7=affected,jbews- |-3/tomcat8=affected,jdg-6/j |3/tomcat8=affected,jdg-6/jb |bossweb=affected,jon-3/jbos |ossweb=affected,jon-3/jboss |sweb=affected,jpp-6/jbosswe |web=affected,jpp-6/jbossweb |b=affected,openshift-1/jbos |=affected,openshift-1/jboss |sweb=new,rhel-6/tomcat6=aff |web=new,rhel-6/tomcat6=affe |ected,rhel-7/tomcat=affecte |cted,rhel-7/tomcat=affected |d |
--- Comment #2 from Andrej Nemec anemec@redhat.com --- Upstream patches:
Tomcat7:
http://svn.apache.org/viewvc?view=revision&revision=1713187
Tomcat8:
http://svn.apache.org/viewvc?view=revision&revision=1713185 http://svn.apache.org/viewvc?view=revision&revision=1723506
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1311095
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1311095 [Bug 1311095] CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [epel-6]
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1311102
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1311102 [Bug 1311102] CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1311109
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Md Azhar mdshaikh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |mdshaikh@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1316022 Depends On| |1316023
https://bugzilla.redhat.com/show_bug.cgi?id=1311085 Bug 1311085 depends on bug 1311095, which changed state.
Bug 1311095 Summary: CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1311095
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160222, |impact=low,public=20160222, |reported=20140622,source=bu |reported=20140622,source=bu |gtraq,brms-5/jbossweb=new,e |gtraq,brms-5/jbossweb=new,e |ap-4/jbossweb=wontfix,eap-5 |ap-4/jbossweb=wontfix,eap-5 |/jbossweb=wontfix,eap-6/jbo |/jbossweb=wontfix,eap-6/jbo |ssweb=affected,epel-6/tomca |ssweb=affected,epel-6/tomca |t=affected,fedora-all/tomca |t=affected,fedora-all/tomca |t=new,fsw-6/jbossweb=new,jb |t=new,fsw-6/jbossweb=new,jb |ews-2/tomcat7=affected,jbew |ews-2/tomcat7=wontfix,jbews |s-3/tomcat7=affected,jbews- |-3/tomcat7=affected,jbews-3 |3/tomcat8=affected,jdg-6/jb |/tomcat8=affected,jdg-6/jbo |ossweb=affected,jon-3/jboss |ssweb=affected,jon-3/jbossw |web=affected,jpp-6/jbossweb |eb=affected,jpp-6/jbossweb= |=affected,openshift-1/jboss |affected,openshift-1/jbossw |web=new,rhel-6/tomcat6=affe |eb=new,rhel-6/tomcat6=affec |cted,rhel-7/tomcat=affected |ted,rhel-7/tomcat=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1322794 Depends On| |1322795
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Doc Text *updated* by Timothy Walsh twalsh@redhat.com --- When recycling the Request object to use for a new request, the requestedSessionSSL field was not recycled. This meant that a session ID provided in the next request to be processed using the recycled Request object could be used when it should not have been. This gave the client the ability to control the session ID. In theory, this could have been used as part of a session fixation attack but it would have been hard to achieve as the attacker would not have been able to force the victim to use the 'correct' Request object. It was also necessary for at least one web application to be configured to use the SSL session ID as the HTTP session ID. This is not a common configuration.
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Doc Text *updated* by Martin Prpic mprpic@redhat.com ---
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Doc Text *updated* by Timothy Walsh twalsh@redhat.com --- It was found that Tomcat would not recycle the requestedSessionSSL field. This gave the client the ability to control the session ID. It was also necessary for at least one web application to be configured to use the SSL session ID as the HTTP session ID. This is not a common configuration.
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|low |medium Whiteboard|impact=low,public=20160222, |impact=low,public=20160222, |reported=20140622,source=bu |reported=20140622,source=bu |gtraq,brms-5/jbossweb=new,e |gtraq,cvss2=6.8/AV:N/AC:M/A |ap-4/jbossweb=wontfix,eap-5 |u:N/C:P/I:P/A:P,brms-5/jbos |/jbossweb=wontfix,eap-6/jbo |sweb=new,eap-4/jbossweb=won |ssweb=affected,epel-6/tomca |tfix,eap-5/jbossweb=wontfix |t=affected,fedora-all/tomca |,eap-6/jbossweb=affected,ep |t=new,fsw-6/jbossweb=new,jb |el-6/tomcat=affected,fedora |ews-2/tomcat7=wontfix,jbews |-all/tomcat=new,fsw-6/jboss |-3/tomcat7=affected,jbews-3 |web=new,jbews-2/tomcat7=won |/tomcat8=affected,jdg-6/jbo |tfix,jbews-3/tomcat7=affect |ssweb=affected,jon-3/jbossw |ed,jbews-3/tomcat8=affected |eb=affected,jpp-6/jbossweb= |,jdg-6/jbossweb=affected,jo |affected,openshift-1/jbossw |n-3/jbossweb=affected,jpp-6 |eb=new,rhel-6/tomcat6=affec |/jbossweb=affected,openshif |ted,rhel-7/tomcat=affected |t-1/jbossweb=new,rhel-6/tom | |cat6=affected,rhel-7/tomcat | |=affected Severity|low |medium
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests.
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Comment #6 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Via RHSA-2016:1089 https://rhn.redhat.com/errata/RHSA-2016-1089.html
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Comment #7 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
JWS 3.0 for RHEL 7
Via RHSA-2016:1088 https://access.redhat.com/errata/RHSA-2016:1088
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Comment #8 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
JWS 3.0 for RHEL 6
Via RHSA-2016:1087 https://access.redhat.com/errata/RHSA-2016:1087
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Yasuhiro Ozone yozone@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |yozone@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Martin Poole mpoole@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |mpoole@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1347138 Depends On| |1347139
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160222, |impact=low,public=20160222, |reported=20140622,source=bu |reported=20140622,source=bu |gtraq,cvss2=6.8/AV:N/AC:M/A |gtraq,cvss2=6.8/AV:N/AC:M/A |u:N/C:P/I:P/A:P,brms-5/jbos |u:N/C:P/I:P/A:P,brms-5/jbos |sweb=new,eap-4/jbossweb=won |sweb=new,eap-4/jbossweb=won |tfix,eap-5/jbossweb=wontfix |tfix,eap-5/jbossweb=wontfix |,eap-6/jbossweb=affected,ep |,eap-6/jbossweb=affected,ep |el-6/tomcat=affected,fedora |el-6/tomcat=affected,fedora |-all/tomcat=new,fsw-6/jboss |-all/tomcat=new,fsw-6/jboss |web=new,jbews-2/tomcat7=won |web=new,jbews-2/tomcat7=won |tfix,jbews-3/tomcat7=affect |tfix,jbews-3/tomcat7=affect |ed,jbews-3/tomcat8=affected |ed,jbews-3/tomcat8=affected |,jdg-6/jbossweb=affected,jo |,jdg-6/jbossweb=affected,jo |n-3/jbossweb=affected,jpp-6 |n-3/jbossweb=affected,jpp-6 |/jbossweb=affected,openshif |/jbossweb=affected,openshif |t-1/jbossweb=new,rhel-6/tom |t-1/jbossweb=new,rhel-7/tom |cat6=affected,rhel-7/tomcat |cat=affected |=affected |
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160222, |impact=low,public=20160222, |reported=20140622,source=bu |reported=20140622,source=bu |gtraq,cvss2=6.8/AV:N/AC:M/A |gtraq,cvss2=6.8/AV:N/AC:M/A |u:N/C:P/I:P/A:P,brms-5/jbos |u:N/C:P/I:P/A:P,soap-5/jbos |sweb=new,eap-4/jbossweb=won |sweb=wontfix,brms-5/jbosswe |tfix,eap-5/jbossweb=wontfix |b=wontfix,eap-4/jbossweb=wo |,eap-6/jbossweb=affected,ep |ntfix,eap-5/jbossweb=wontfi |el-6/tomcat=affected,fedora |x,eap-6/jbossweb=affected,e |-all/tomcat=new,fsw-6/jboss |pel-6/tomcat=affected,fedor |web=new,jbews-2/tomcat7=won |a-all/tomcat=new,fsw-6/jbos |tfix,jbews-3/tomcat7=affect |sweb=wontfix,jbews-2/tomcat |ed,jbews-3/tomcat8=affected |7=wontfix,jbews-3/tomcat7=a |,jdg-6/jbossweb=affected,jo |ffected,jbews-3/tomcat8=aff |n-3/jbossweb=affected,jpp-6 |ected,jdg-6/jbossweb=affect |/jbossweb=affected,openshif |ed,jon-3/jbossweb=affected, |t-1/jbossweb=new,rhel-7/tom |jpp-6/jbossweb=affected,ope |cat=affected |nshift-1/jbossweb=new,rhel- | |7/tomcat=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Coty Sutherland csutherl@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1352009
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1352009 [Bug 1352009] CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 CVE-2016-3092 tomcat: multiple security vulnerabilities [epel-6]
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |low Severity|medium |low
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160222, |impact=low,public=20160222, |reported=20140622,source=bu |reported=20140622,source=bu |gtraq,cvss2=6.8/AV:N/AC:M/A |gtraq,cvss2=6.8/AV:N/AC:M/A |u:N/C:P/I:P/A:P,soap-5/jbos |u:N/C:P/I:P/A:P,soap-5/jbos |sweb=wontfix,brms-5/jbosswe |sweb=wontfix,brms-5/jbosswe |b=wontfix,eap-4/jbossweb=wo |b=wontfix,eap-4/jbossweb=wo |ntfix,eap-5/jbossweb=wontfi |ntfix,eap-5/jbossweb=wontfi |x,eap-6/jbossweb=affected,e |x,eap-6/jbossweb=affected,e |pel-6/tomcat=affected,fedor |pel-6/tomcat=affected,fedor |a-all/tomcat=new,fsw-6/jbos |a-all/tomcat=new,fsw-6/jbos |sweb=wontfix,jbews-2/tomcat |sweb=wontfix,jbews-2/tomcat |7=wontfix,jbews-3/tomcat7=a |7=wontfix,jbews-3/tomcat7=a |ffected,jbews-3/tomcat8=aff |ffected,jbews-3/tomcat8=aff |ected,jdg-6/jbossweb=affect |ected,jdg-6/jbossweb=affect |ed,jon-3/jbossweb=affected, |ed,jon-3/jbossweb=affected, |jpp-6/jbossweb=affected,ope |jpp-6/jbossweb=affected,ope |nshift-1/jbossweb=new,rhel- |nshift-1/jbossweb=new,rhel- |7/tomcat=affected |6/tomcat6=notaffected,rhel- | |7/tomcat=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1311085 Bug 1311085 depends on bug 1311102, which changed state.
Bug 1311102 Summary: CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1311102
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |CURRENTRELEASE
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Comment #12 from Fedora Update System updates@fedoraproject.org --- tomcat-7.0.70-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1311085 Bug 1311085 depends on bug 1352009, which changed state.
Bug 1352009 Summary: CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 CVE-2016-3092 tomcat: multiple security vulnerabilities [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1352009
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Comment #13 from Fedora Update System updates@fedoraproject.org --- tomcat-7.0.70-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160222, |impact=low,public=20160222, |reported=20140622,source=bu |reported=20140622,source=bu |gtraq,cvss2=6.8/AV:N/AC:M/A |gtraq,cvss2=6.8/AV:N/AC:M/A |u:N/C:P/I:P/A:P,soap-5/jbos |u:N/C:P/I:P/A:P,soap-5/jbos |sweb=wontfix,brms-5/jbosswe |sweb=wontfix,brms-5/jbosswe |b=wontfix,eap-4/jbossweb=wo |b=wontfix,eap-4/jbossweb=wo |ntfix,eap-5/jbossweb=wontfi |ntfix,eap-5/jbossweb=wontfi |x,eap-6/jbossweb=affected,e |x,eap-6/jbossweb=affected,e |pel-6/tomcat=affected,fedor |pel-6/tomcat=affected,fedor |a-all/tomcat=new,fsw-6/jbos |a-all/tomcat=new,fsw-6/jbos |sweb=wontfix,jbews-2/tomcat |sweb=wontfix,jbews-2/tomcat |7=wontfix,jbews-3/tomcat7=a |7=affected,jbews-3/tomcat7= |ffected,jbews-3/tomcat8=aff |affected,jbews-3/tomcat8=af |ected,jdg-6/jbossweb=affect |fected,jdg-6/jbossweb=affec |ed,jon-3/jbossweb=affected, |ted,jon-3/jbossweb=affected |jpp-6/jbossweb=affected,ope |,jpp-6/jbossweb=affected,op |nshift-1/jbossweb=new,rhel- |enshift-1/jbossweb=new,rhel |6/tomcat6=notaffected,rhel- |-6/tomcat6=notaffected,rhel |7/tomcat=affected |-7/tomcat=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1381946
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1382592
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Comment #16 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2016:2046 https://rhn.redhat.com/errata/RHSA-2016-2046.html
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160222, |impact=low,public=20160222, |reported=20140622,source=bu |reported=20140622,source=bu |gtraq,cvss2=6.8/AV:N/AC:M/A |gtraq,cvss2=6.8/AV:N/AC:M/A |u:N/C:P/I:P/A:P,soap-5/jbos |u:N/C:P/I:P/A:P,cvss3=8.1/C |sweb=wontfix,brms-5/jbosswe |VSS:3.0/AV:N/AC:H/PR:N/UI:N |b=wontfix,eap-4/jbossweb=wo |/S:U/C:H/I:H/A:H,soap-5/jbo |ntfix,eap-5/jbossweb=wontfi |ssweb=wontfix,brms-5/jbossw |x,eap-6/jbossweb=affected,e |eb=wontfix,eap-4/jbossweb=w |pel-6/tomcat=affected,fedor |ontfix,eap-5/jbossweb=wontf |a-all/tomcat=new,fsw-6/jbos |ix,eap-6/jbossweb=affected, |sweb=wontfix,jbews-2/tomcat |epel-6/tomcat=affected,fedo |7=affected,jbews-3/tomcat7= |ra-all/tomcat=new,fsw-6/jbo |affected,jbews-3/tomcat8=af |ssweb=wontfix,jbews-2/tomca |fected,jdg-6/jbossweb=affec |t7=affected,jbews-3/tomcat7 |ted,jon-3/jbossweb=affected |=affected,jbews-3/tomcat8=a |,jpp-6/jbossweb=affected,op |ffected,jdg-6/jbossweb=affe |enshift-1/jbossweb=new,rhel |cted,jon-3/jbossweb=affecte |-6/tomcat6=notaffected,rhel |d,jpp-6/jbossweb=affected,o |-7/tomcat=affected |penshift-1/jbossweb=new,rhe | |l-6/tomcat6=notaffected,rhe | |l-7/tomcat=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Via RHSA-2016:2808 https://rhn.redhat.com/errata/RHSA-2016-2808.html
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Comment #18 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Red Hat JBoss Enterprise Web Server 2 for RHEL 7
Via RHSA-2016:2807 https://rhn.redhat.com/errata/RHSA-2016-2807.html
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1428325
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks|1428325 |
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1318206
java-sig-commits@lists.fedoraproject.org