[prev in list] [next in list] [prev in thread] [next in thread]
List: apache-announce
Subject: [SECURITY] CVE-2011-2481: Apache Tomcat information disclosure vulnerability
From: Mark Thomas <markt () apache ! org>
Date: 2011-08-12 13:12:07
Message-ID: 4E4526A7.60109 () apache ! org
[Download RAW message or body]
CVE-2011-2481: Apache Tomcat information disclosure vulnerability
Severity: low
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 7.0.0 to 7.0.16
Previous versions are not affected.
Description:
The re-factoring of XML validation for Tomcat 7.0.x re-introduced the
vulnerability previously reported as CVE-2009-0783. This was initially
reported as a memory leak
(https://issues.apache.org/bugzilla/show_bug.cgi?id=51395). If a web
application is the first web
application loaded, this bug allows that web application to potentially
view and/or alter the web.xml, context.xml and tld files of other web
applications deployed on the Tomcat instance.
Mitigation:
7.0.x users should upgrade to 7.0.17 or later
Example:
See https://issues.apache.org/bugzilla/show_bug.cgi?id=29936#c12 for an
example web application that can be used to replace the XML parser used
by Tomcat.
Credit:
The security implications of bug 51395 were identified by the Tomcat
security team.
References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-7.html
The Apache Tomcat Security Team
---------------------------------------------------------------------
To unsubscribe, e-mail: announce-unsubscribe@apache.org
For additional commands, e-mail: announce-help@apache.org
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic