[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Fwd: [SECURITY] CVE-2018-1305 Security constraint annotations applied too late
From:       Mark Thomas <markt () apache ! org>
Date:       2018-02-23 0:33:34
Message-ID: 0650ff91-3841-9773-14d9-58ba9b97698a () apache ! org
[Download RAW message or body]

-------- Forwarded Message --------
Subject: [SECURITY] CVE-2018-1305 Security constraint annotations
applied too late
Date: Fri, 23 Feb 2018 00:27:36 +0000
From: Mark Thomas <markt@apache.org>
Reply-To: announce@tomcat.apache.org, announce@tomcat.apache.org
To: Tomcat Users List <users@tomcat.apache.org>
CC: Tomcat Developers List <dev@tomcat.apache.org>, announce@apache.org,
announce@tomcat.apache.org <announce@tomcat.apache.org>

CVE-2018-1305 Security constraint annotations applied too late

Severity: High

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.4
Apache Tomcat 8.5.0 to 8.5.27
Apache Tomcat 8.0.0.RC1 to 8.0.49
Apache Tomcat 7.0.0 to 7.0.84

Description:
Security constraints defined by annotations of Servlets were only
applied once a Servlet had been loaded. Because security constraints
defined in this way apply to the URL pattern and any URLs below that
point, it was possible - depending on the order Servlets were loaded -
for some security constraints not to be applied. This could have exposed
resources to users who were not authorised to access them.

Mitigation:
Users of the affected versions should apply one of the following
mitigations. Upgrade to:
- Apache Tomcat 9.0.5 or later
- Apache Tomcat 8.5.28 or later
- Apache Tomcat 8.0.50 or later
- Apache Tomcat 7.0.85 or later

Credit:
This issue was identified by the Apache Tomcat Security Team.

History:
2018-02-23 Original advisory

References:
[1] http://tomcat.apache.org/security-9.html
[2] http://tomcat.apache.org/security-8.html
[3] http://tomcat.apache.org/security-7.html

[prev in list] [next in list] [prev in thread] [next in thread]