https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Bug ID: 1607591 Summary: CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: abhgupta@redhat.com, aileenc@redhat.com, alazarot@redhat.com, alee@redhat.com, anstephe@redhat.com, apintea@redhat.com, avibelli@redhat.com, bgeorges@redhat.com, bkundal@redhat.com, bmaxwell@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, cmoulliard@redhat.com, coolsvap@gmail.com, csutherl@redhat.com, darran.lofthouse@redhat.com, dbaker@redhat.com, dimitris@redhat.com, dosoudil@redhat.com, drieden@redhat.com, etirelli@redhat.com, fgavrilo@redhat.com, gvarsami@redhat.com, gzaronik@redhat.com, hghasemb@redhat.com, hhorak@redhat.com, ibek@redhat.com, ikanello@redhat.com, ivan.afonichev@gmail.com, java-sig-commits@lists.fedoraproject.org, jawilson@redhat.com, jbalunas@redhat.com, jclere@redhat.com, jcoleman@redhat.com, jdoyle@redhat.com, jokerman@redhat.com, jolee@redhat.com, jondruse@redhat.com, jorton@redhat.com, jpallich@redhat.com, jschatte@redhat.com, jshepherd@redhat.com, jstastny@redhat.com, kconner@redhat.com, krathod@redhat.com, krzysztof.daniel@gmail.com, kverlaen@redhat.com, ldimaggi@redhat.com, lgao@redhat.com, loleary@redhat.com, lpetrovi@redhat.com, lthon@redhat.com, mbabacek@redhat.com, mizdebsk@redhat.com, mszynkie@redhat.com, myarboro@redhat.com, nwallace@redhat.com, paradhya@redhat.com, pgallagh@redhat.com, pgier@redhat.com, pjurak@redhat.com, ppalaga@redhat.com, psakar@redhat.com, pslavice@redhat.com, pszubiak@redhat.com, rnetuka@redhat.com, rrajasek@redhat.com, rruss@redhat.com, rstancel@redhat.com, rsvoboda@redhat.com, rsynek@redhat.com, rwagner@redhat.com, rzhang@redhat.com, sdaley@redhat.com, spinder@redhat.com, sstavrev@redhat.com, sthangav@redhat.com, tcunning@redhat.com, theute@redhat.com, tkirby@redhat.com, trankin@redhat.com, trogers@redhat.com, twalsh@redhat.com, vhalbert@redhat.com, vtunka@redhat.com, weli@redhat.com
Flaw affecting tomcat 8.0.0.RC1 to 8.0.51 and 9.0.0.M1 to 9.0.7. An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service.
Upstream patch:
http://svn.apache.org/viewvc?view=rev&rev=1830375 http://svn.apache.org/viewvc?view=rev&rev=1830373
References:
https://tomcat.apache.org/security-8.html https://tomcat.apache.org/security-9.html
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1607593
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Yasuhiro Ozone yozone@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |yozone@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=new,bpms-6 |va-common-tomcat=new,bpms-6 |/tomcat=new,brms-6/tomcat=n |/tomcat=new,brms-6/tomcat=n |ew,epel-all/tomcat=affected |ew,epel-all/tomcat=affected |,brms-5/jbossweb=new,eap-6/ |,brms-5/jbossweb=new,eap-6/ |jbossweb=new,eap-5/jbossweb |jbossweb=new,eap-5/jbossweb |=new,jdg-6/jbossweb=new,jdg |=new,jdg-6/jbossweb=new,jdg |-7/tomcat=new,jdv-6/jbosswe |-7/tomcat=new,jdv-6/jbosswe |b=new,fuse-6/jbossweb=new,f |b=new,fuse-6/jbossweb=new,f |use-7/tomcat=new,fsw-6/jbos |use-7/tomcat=new,fsw-6/jbos |sweb=new,soap-5/jbossweb=ne |sweb=new,soap-5/jbossweb=ne |w,fis-2/tomcat=new,springbo |w,fis-2/tomcat=new,springbo |ot-1/tomcat=new,jbews-2/tom |ot-1/tomcat=new,jbews-2/tom |cat6=new,jws-3/tomcat7=new, |cat6=new,jws-3/tomcat7=affe |rhel-8/tomcat=affected,rhel |cted,rhel-8/tomcat=affected |-7/tomcat=new,jbews-2/tomca |,rhel-7/tomcat=new,jbews-2/ |t7=new,jws-3/tomcat8=new,rh |tomcat7=affected,jws-3/tomc |el-6/tomcat6=new,jon-3/jbos |at8=affected,rhel-6/tomcat6 |sweb=new,openshift-online-2 |=new,jon-3/jbossweb=new,ope |/jbossweb=new |nshift-online-2/jbossweb=ne | |w
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=new,bpms-6 |va-common-tomcat=new,bpms-6 |/tomcat=new,brms-6/tomcat=n |/tomcat=new,brms-6/tomcat=n |ew,epel-all/tomcat=affected |ew,epel-all/tomcat=affected |,brms-5/jbossweb=new,eap-6/ |,brms-5/jbossweb=new,eap-6/ |jbossweb=new,eap-5/jbossweb |jbossweb=new,eap-5/jbossweb |=new,jdg-6/jbossweb=new,jdg |=new,jdg-6/jbossweb=new,jdg |-7/tomcat=new,jdv-6/jbosswe |-7/tomcat=new,jdv-6/jbosswe |b=new,fuse-6/jbossweb=new,f |b=new,fuse-6/jbossweb=new,f |use-7/tomcat=new,fsw-6/jbos |use-7/tomcat=new,fsw-6/jbos |sweb=new,soap-5/jbossweb=ne |sweb=new,soap-5/jbossweb=ne |w,fis-2/tomcat=new,springbo |w,fis-2/tomcat=new,springbo |ot-1/tomcat=new,jbews-2/tom |ot-1/tomcat=new,jbews-2/tom |cat6=new,jws-3/tomcat7=affe |cat6=notaffected,jws-3/tomc |cted,rhel-8/tomcat=affected |at7=affected,rhel-8/tomcat= |,rhel-7/tomcat=new,jbews-2/ |affected,rhel-7/tomcat=new, |tomcat7=affected,jws-3/tomc |jbews-2/tomcat7=wontfix,jws |at8=affected,rhel-6/tomcat6 |-3/tomcat8=affected,rhel-6/ |=new,jon-3/jbossweb=new,ope |tomcat6=new,jon-3/jbossweb= |nshift-online-2/jbossweb=ne |new,openshift-online-2/jbos |w |sweb=new
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |tomcat 8.0.52, tomcat | |8.5.31, tomcat 9.0.8, | |tomcat 7.0.88
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=new,bpms-6 |va-common-tomcat=notaffecte |/tomcat=new,brms-6/tomcat=n |d,bpms-6/tomcat=new,brms-6/ |ew,epel-all/tomcat=affected |tomcat=new,epel-all/tomcat= |,brms-5/jbossweb=new,eap-6/ |affected,brms-5/jbossweb=ne |jbossweb=new,eap-5/jbossweb |w,eap-6/jbossweb=new,eap-5/ |=new,jdg-6/jbossweb=new,jdg |jbossweb=new,jdg-6/jbossweb |-7/tomcat=new,jdv-6/jbosswe |=new,jdg-7/tomcat=new,jdv-6 |b=new,fuse-6/jbossweb=new,f |/jbossweb=new,fuse-6/jbossw |use-7/tomcat=new,fsw-6/jbos |eb=new,fuse-7/tomcat=new,fs |sweb=new,soap-5/jbossweb=ne |w-6/jbossweb=new,soap-5/jbo |w,fis-2/tomcat=new,springbo |ssweb=new,fis-2/tomcat=new, |ot-1/tomcat=new,jbews-2/tom |springboot-1/tomcat=new,jbe |cat6=notaffected,jws-3/tomc |ws-2/tomcat6=notaffected,jw |at7=affected,rhel-8/tomcat= |s-3/tomcat7=affected,rhel-8 |affected,rhel-7/tomcat=new, |/tomcat=affected,rhel-7/tom |jbews-2/tomcat7=wontfix,jws |cat=affected,jbews-2/tomcat |-3/tomcat8=affected,rhel-6/ |7=wontfix,jws-3/tomcat8=aff |tomcat6=new,jon-3/jbossweb= |ected,rhel-6/tomcat6=notaff |new,openshift-online-2/jbos |ected,jon-3/jbossweb=new,op |sweb=new |enshift-online-2/jbossweb=n | |ew
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1608607
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1608607 Depends On| |1608608
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Jason Shepherd jshepherd@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC|abhgupta@redhat.com, | |dbaker@redhat.com, | |jokerman@redhat.com, | |sthangav@redhat.com, | |trankin@redhat.com | Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=notaffecte |va-common-tomcat=notaffecte |d,bpms-6/tomcat=new,brms-6/ |d,bpms-6/tomcat=new,brms-6/ |tomcat=new,epel-all/tomcat= |tomcat=new,epel-all/tomcat= |affected,brms-5/jbossweb=ne |affected,brms-5/jbossweb=ne |w,eap-6/jbossweb=new,eap-5/ |w,eap-6/jbossweb=new,eap-5/ |jbossweb=new,jdg-6/jbossweb |jbossweb=new,jdg-6/jbossweb |=new,jdg-7/tomcat=new,jdv-6 |=new,jdg-7/tomcat=new,jdv-6 |/jbossweb=new,fuse-6/jbossw |/jbossweb=new,fuse-6/jbossw |eb=new,fuse-7/tomcat=new,fs |eb=new,fuse-7/tomcat=new,fs |w-6/jbossweb=new,soap-5/jbo |w-6/jbossweb=new,soap-5/jbo |ssweb=new,fis-2/tomcat=new, |ssweb=new,fis-2/tomcat=new, |springboot-1/tomcat=new,jbe |springboot-1/tomcat=new,jbe |ws-2/tomcat6=notaffected,jw |ws-2/tomcat6=notaffected,jw |s-3/tomcat7=affected,rhel-8 |s-3/tomcat7=affected,rhel-8 |/tomcat=affected,rhel-7/tom |/tomcat=affected,rhel-7/tom |cat=affected,jbews-2/tomcat |cat=affected,jbews-2/tomcat |7=wontfix,jws-3/tomcat8=aff |7=wontfix,jws-3/tomcat8=aff |ected,rhel-6/tomcat6=notaff |ected,rhel-6/tomcat6=notaff |ected,jon-3/jbossweb=new,op |ected,jon-3/jbossweb=new |enshift-online-2/jbossweb=n | |ew |
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
ksuzumur@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ksuzumur@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Bharti Kundal bkundal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=notaffecte |va-common-tomcat=notaffecte |d,bpms-6/tomcat=new,brms-6/ |d,bpms-6/tomcat=new,brms-6/ |tomcat=new,epel-all/tomcat= |tomcat=new,epel-all/tomcat= |affected,brms-5/jbossweb=ne |affected,brms-5/jbossweb=ne |w,eap-6/jbossweb=new,eap-5/ |w,eap-6/jbossweb=affected,e |jbossweb=new,jdg-6/jbossweb |ap-5/jbossweb=new,jdg-6/jbo |=new,jdg-7/tomcat=new,jdv-6 |ssweb=new,jdg-7/tomcat=new, |/jbossweb=new,fuse-6/jbossw |jdv-6/jbossweb=new,fuse-6/j |eb=new,fuse-7/tomcat=new,fs |bossweb=new,fuse-7/tomcat=n |w-6/jbossweb=new,soap-5/jbo |ew,fsw-6/jbossweb=new,soap- |ssweb=new,fis-2/tomcat=new, |5/jbossweb=new,fis-2/tomcat |springboot-1/tomcat=new,jbe |=new,springboot-1/tomcat=ne |ws-2/tomcat6=notaffected,jw |w,jbews-2/tomcat6=notaffect |s-3/tomcat7=affected,rhel-8 |ed,jws-3/tomcat7=affected,r |/tomcat=affected,rhel-7/tom |hel-8/tomcat=affected,rhel- |cat=affected,jbews-2/tomcat |7/tomcat=affected,jbews-2/t |7=wontfix,jws-3/tomcat8=aff |omcat7=wontfix,jws-3/tomcat |ected,rhel-6/tomcat6=notaff |8=affected,rhel-6/tomcat6=n |ected,jon-3/jbossweb=new |otaffected,jon-3/jbossweb=n | |ew
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Bharti Kundal bkundal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1608656, 1608655
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Bharti Kundal bkundal@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=notaffecte |va-common-tomcat=notaffecte |d,bpms-6/tomcat=new,brms-6/ |d,bpms-6/tomcat=new,brms-6/ |tomcat=new,epel-all/tomcat= |tomcat=new,epel-all/tomcat= |affected,brms-5/jbossweb=ne |affected,brms-5/jbossweb=ne |w,eap-6/jbossweb=affected,e |w,eap-6/jbossweb=affected,e |ap-5/jbossweb=new,jdg-6/jbo |ap-5/jbossweb=notaffected,j |ssweb=new,jdg-7/tomcat=new, |dg-6/jbossweb=new,jdg-7/tom |jdv-6/jbossweb=new,fuse-6/j |cat=new,jdv-6/jbossweb=new, |bossweb=new,fuse-7/tomcat=n |fuse-6/jbossweb=new,fuse-7/ |ew,fsw-6/jbossweb=new,soap- |tomcat=new,fsw-6/jbossweb=n |5/jbossweb=new,fis-2/tomcat |ew,soap-5/jbossweb=new,fis- |=new,springboot-1/tomcat=ne |2/tomcat=new,springboot-1/t |w,jbews-2/tomcat6=notaffect |omcat=new,jbews-2/tomcat6=n |ed,jws-3/tomcat7=affected,r |otaffected,jws-3/tomcat7=af |hel-8/tomcat=affected,rhel- |fected,rhel-8/tomcat=affect |7/tomcat=affected,jbews-2/t |ed,rhel-7/tomcat=affected,j |omcat7=wontfix,jws-3/tomcat |bews-2/tomcat7=wontfix,jws- |8=affected,rhel-6/tomcat6=n |3/tomcat8=affected,rhel-6/t |otaffected,jon-3/jbossweb=n |omcat6=notaffected,jon-3/jb |ew |ossweb=new
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Masanobu Hatanaka mhatanak@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |mhatanak@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Timothy Walsh twalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=notaffecte |va-common-tomcat=notaffecte |d,bpms-6/tomcat=new,brms-6/ |d,bpms-6/tomcat=new,brms-6/ |tomcat=new,epel-all/tomcat= |tomcat=new,epel-all/tomcat= |affected,brms-5/jbossweb=ne |affected,brms-5/jbossweb=ne |w,eap-6/jbossweb=affected,e |w,eap-6/jbossweb=affected,e |ap-5/jbossweb=notaffected,j |ap-5/jbossweb=notaffected,j |dg-6/jbossweb=new,jdg-7/tom |dg-6/jbossweb=new,jdg-7/tom |cat=new,jdv-6/jbossweb=new, |cat=new,jdv-6/jbossweb=new, |fuse-6/jbossweb=new,fuse-7/ |fuse-6/jbossweb=new,fuse-7/ |tomcat=new,fsw-6/jbossweb=n |tomcat=new,fsw-6/jbossweb=n |ew,soap-5/jbossweb=new,fis- |ew,soap-5/jbossweb=new,fis- |2/tomcat=new,springboot-1/t |2/tomcat=new,springboot-1/t |omcat=new,jbews-2/tomcat6=n |omcat=new,jbews-2/tomcat6=n |otaffected,jws-3/tomcat7=af |otaffected,jws-3/tomcat7=af |fected,rhel-8/tomcat=affect |fected,rhel-8/tomcat=affect |ed,rhel-7/tomcat=affected,j |ed,rhel-7/tomcat=affected,j |bews-2/tomcat7=wontfix,jws- |bews-2/tomcat7=wontfix,jws- |3/tomcat8=affected,rhel-6/t |3/tomcat8=affected,rhel-6/t |omcat6=notaffected,jon-3/jb |omcat6=notaffected,jon-3/jb |ossweb=new |ossweb=new,jws-5/tomcat=not | |affected
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=notaffecte |va-common-tomcat=notaffecte |d,bpms-6/tomcat=new,brms-6/ |d,bpms-6/tomcat=notaffected |tomcat=new,epel-all/tomcat= |,brms-6/tomcat=notaffected, |affected,brms-5/jbossweb=ne |epel-all/tomcat=affected,br |w,eap-6/jbossweb=affected,e |ms-5/jbossweb=notaffected,e |ap-5/jbossweb=notaffected,j |ap-6/jbossweb=affected,eap- |dg-6/jbossweb=new,jdg-7/tom |5/jbossweb=notaffected,jdg- |cat=new,jdv-6/jbossweb=new, |6/jbossweb=new,jdg-7/tomcat |fuse-6/jbossweb=new,fuse-7/ |=new,jdv-6/jbossweb=new,fus |tomcat=new,fsw-6/jbossweb=n |e-6/jbossweb=new,fuse-7/tom |ew,soap-5/jbossweb=new,fis- |cat=new,fsw-6/jbossweb=new, |2/tomcat=new,springboot-1/t |soap-5/jbossweb=new,fis-2/t |omcat=new,jbews-2/tomcat6=n |omcat=new,springboot-1/tomc |otaffected,jws-3/tomcat7=af |at=new,jbews-2/tomcat6=nota |fected,rhel-8/tomcat=affect |ffected,jws-3/tomcat7=affec |ed,rhel-7/tomcat=affected,j |ted,rhel-8/tomcat=affected, |bews-2/tomcat7=wontfix,jws- |rhel-7/tomcat=affected,jbew |3/tomcat8=affected,rhel-6/t |s-2/tomcat7=wontfix,jws-3/t |omcat6=notaffected,jon-3/jb |omcat8=affected,rhel-6/tomc |ossweb=new,jws-5/tomcat=not |at6=notaffected,jon-3/jboss |affected |web=new,jws-5/tomcat=notaff | |ected
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=notaffecte |va-common-tomcat=notaffecte |d,bpms-6/tomcat=notaffected |d,bpms-6/tomcat=notaffected |,brms-6/tomcat=notaffected, |,brms-6/tomcat=notaffected, |epel-all/tomcat=affected,br |epel-all/tomcat=affected,br |ms-5/jbossweb=notaffected,e |ms-5/jbossweb=notaffected,e |ap-6/jbossweb=affected,eap- |ap-6/jbossweb=affected,eap- |5/jbossweb=notaffected,jdg- |5/jbossweb=notaffected,jdg- |6/jbossweb=new,jdg-7/tomcat |6/jbossweb=notaffected,jdg- |=new,jdv-6/jbossweb=new,fus |7/tomcat=notaffected,jdv-6/ |e-6/jbossweb=new,fuse-7/tom |jbossweb=affected,fuse-6/jb |cat=new,fsw-6/jbossweb=new, |ossweb=new,fuse-7/tomcat=ne |soap-5/jbossweb=new,fis-2/t |w,fsw-6/jbossweb=affected,s |omcat=new,springboot-1/tomc |oap-5/jbossweb=notaffected, |at=new,jbews-2/tomcat6=nota |fis-2/tomcat=new,springboot |ffected,jws-3/tomcat7=affec |-1/tomcat=new,jbews-2/tomca |ted,rhel-8/tomcat=affected, |t6=notaffected,jws-3/tomcat |rhel-7/tomcat=affected,jbew |7=affected,rhel-8/tomcat=af |s-2/tomcat7=wontfix,jws-3/t |fected,rhel-7/tomcat=affect |omcat8=affected,rhel-6/tomc |ed,jbews-2/tomcat7=wontfix, |at6=notaffected,jon-3/jboss |jws-3/tomcat8=affected,rhel |web=new,jws-5/tomcat=notaff |-6/tomcat6=notaffected,jon- |ected |3/jbossweb=new,jws-5/tomcat | |=notaffected
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=notaffecte |va-common-tomcat=notaffecte |d,bpms-6/tomcat=notaffected |d,bpms-6/tomcat=notaffected |,brms-6/tomcat=notaffected, |,brms-6/tomcat=notaffected, |epel-all/tomcat=affected,br |epel-all/tomcat=affected,br |ms-5/jbossweb=notaffected,e |ms-5/jbossweb=notaffected,e |ap-6/jbossweb=affected,eap- |ap-6/jbossweb=affected,eap- |5/jbossweb=notaffected,jdg- |5/jbossweb=notaffected,jdg- |6/jbossweb=notaffected,jdg- |6/jbossweb=notaffected,jdg- |7/tomcat=notaffected,jdv-6/ |7/tomcat=notaffected,jdv-6/ |jbossweb=affected,fuse-6/jb |jbossweb=affected,fuse-6/jb |ossweb=new,fuse-7/tomcat=ne |ossweb=new,fuse-7/tomcat=ne |w,fsw-6/jbossweb=affected,s |w,fsw-6/jbossweb=affected,s |oap-5/jbossweb=notaffected, |oap-5/jbossweb=notaffected, |fis-2/tomcat=new,springboot |fis-2/tomcat=new,springboot |-1/tomcat=new,jbews-2/tomca |-1/tomcat=affected,jbews-2/ |t6=notaffected,jws-3/tomcat |tomcat6=notaffected,jws-3/t |7=affected,rhel-8/tomcat=af |omcat7=affected,rhel-8/tomc |fected,rhel-7/tomcat=affect |at=affected,rhel-7/tomcat=a |ed,jbews-2/tomcat7=wontfix, |ffected,jbews-2/tomcat7=won |jws-3/tomcat8=affected,rhel |tfix,jws-3/tomcat8=affected |-6/tomcat6=notaffected,jon- |,rhel-6/tomcat6=notaffected |3/jbossweb=new,jws-5/tomcat |,jon-3/jbossweb=affected,jw |=notaffected |s-5/tomcat=notaffected
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1614559, 1614560
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Hooman Broujerdi hghasemb@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=notaffecte |va-common-tomcat=notaffecte |d,bpms-6/tomcat=notaffected |d,bpms-6/tomcat=notaffected |,brms-6/tomcat=notaffected, |,brms-6/tomcat=notaffected, |epel-all/tomcat=affected,br |epel-all/tomcat=affected,br |ms-5/jbossweb=notaffected,e |ms-5/jbossweb=notaffected,e |ap-6/jbossweb=affected,eap- |ap-6/jbossweb=affected,eap- |5/jbossweb=notaffected,jdg- |5/jbossweb=notaffected,jdg- |6/jbossweb=notaffected,jdg- |6/jbossweb=notaffected,jdg- |7/tomcat=notaffected,jdv-6/ |7/tomcat=notaffected,jdv-6/ |jbossweb=affected,fuse-6/jb |jbossweb=affected,fuse-6/jb |ossweb=new,fuse-7/tomcat=ne |ossweb=notaffected,fuse-7/t |w,fsw-6/jbossweb=affected,s |omcat=new,fsw-6/jbossweb=af |oap-5/jbossweb=notaffected, |fected,soap-5/jbossweb=nota |fis-2/tomcat=new,springboot |ffected,springboot-1/tomcat |-1/tomcat=affected,jbews-2/ |=affected,jbews-2/tomcat6=n |tomcat6=notaffected,jws-3/t |otaffected,jws-3/tomcat7=af |omcat7=affected,rhel-8/tomc |fected,rhel-8/tomcat=affect |at=affected,rhel-7/tomcat=a |ed,rhel-7/tomcat=affected,j |ffected,jbews-2/tomcat7=won |bews-2/tomcat7=wontfix,jws- |tfix,jws-3/tomcat8=affected |3/tomcat8=affected,rhel-6/t |,rhel-6/tomcat6=notaffected |omcat6=notaffected,jon-3/jb |,jon-3/jbossweb=affected,jw |ossweb=affected,jws-5/tomca |s-5/tomcat=notaffected |t=notaffected
--- Comment #7 from Hooman Broujerdi hghasemb@redhat.com --- Statement:
While JBoss fuse 6.3 and 7 standalone distributions ship tomcat, tomcat is not being used anywhere in the code base and we do not advise users to enable tomcat in their installations.
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Hooman Broujerdi hghasemb@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=notaffecte |va-common-tomcat=notaffecte |d,bpms-6/tomcat=notaffected |d,bpms-6/tomcat=notaffected |,brms-6/tomcat=notaffected, |,brms-6/tomcat=notaffected, |epel-all/tomcat=affected,br |epel-all/tomcat=affected,br |ms-5/jbossweb=notaffected,e |ms-5/jbossweb=notaffected,e |ap-6/jbossweb=affected,eap- |ap-6/jbossweb=affected,eap- |5/jbossweb=notaffected,jdg- |5/jbossweb=notaffected,jdg- |6/jbossweb=notaffected,jdg- |6/jbossweb=notaffected,jdg- |7/tomcat=notaffected,jdv-6/ |7/tomcat=notaffected,jdv-6/ |jbossweb=affected,fuse-6/jb |jbossweb=affected,fuse-6/to |ossweb=notaffected,fuse-7/t |mcat=affected,fuse-7/tomcat |omcat=new,fsw-6/jbossweb=af |=affected,fsw-6/jbossweb=af |fected,soap-5/jbossweb=nota |fected,soap-5/jbossweb=nota |ffected,springboot-1/tomcat |ffected,springboot-1/tomcat |=affected,jbews-2/tomcat6=n |=affected,jbews-2/tomcat6=n |otaffected,jws-3/tomcat7=af |otaffected,jws-3/tomcat7=af |fected,rhel-8/tomcat=affect |fected,rhel-8/tomcat=affect |ed,rhel-7/tomcat=affected,j |ed,rhel-7/tomcat=affected,j |bews-2/tomcat7=wontfix,jws- |bews-2/tomcat7=wontfix,jws- |3/tomcat8=affected,rhel-6/t |3/tomcat8=affected,rhel-6/t |omcat6=notaffected,jon-3/jb |omcat6=notaffected,jon-3/jb |ossweb=affected,jws-5/tomca |ossweb=affected,jws-5/tomca |t=notaffected |t=notaffected
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #9 from Chess Hazlett chazlett@redhat.com --- Statement:
Fuse 6.3 and 7 standalone distributions ship but do not use tomcat, and as such are not affected by this flaw; however, Fuse Integration Services 2.0 and Fuse 7 on OpenShift provide the affected artifacts via their respective maven repositories, and will provide fixes for this issue in a future release.
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Laura Pardo lpardo@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1624931, 1624929
--- Comment #10 from Laura Pardo lpardo@redhat.com --- Created tomcat tracking bugs for this issue:
Affects: epel-all [bug 1624931] Affects: fedora-all [bug 1624929]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1624929 [Bug 1624929] CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1624931 [Bug 1624931] CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Laura Pardo lpardo@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |80722,reported=20180723,sou |80722,reported=20180723,sou |rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS |:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S: |U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to |mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja |va-common-tomcat=notaffecte |va-common-tomcat=notaffecte |d,bpms-6/tomcat=notaffected |d,bpms-6/tomcat=notaffected |,brms-6/tomcat=notaffected, |,brms-6/tomcat=notaffected, |epel-all/tomcat=affected,br |epel-all/tomcat=affected,br |ms-5/jbossweb=notaffected,e |ms-5/jbossweb=notaffected,e |ap-6/jbossweb=affected,eap- |ap-6/jbossweb=affected,eap- |5/jbossweb=notaffected,jdg- |5/jbossweb=notaffected,jdg- |6/jbossweb=notaffected,jdg- |6/jbossweb=notaffected,jdg- |7/tomcat=notaffected,jdv-6/ |7/tomcat=notaffected,jdv-6/ |jbossweb=affected,fuse-6/to |jbossweb=affected,fuse-6/to |mcat=affected,fuse-7/tomcat |mcat=affected,fuse-7/tomcat |=affected,fsw-6/jbossweb=af |=affected,fsw-6/jbossweb=af |fected,soap-5/jbossweb=nota |fected,soap-5/jbossweb=nota |ffected,springboot-1/tomcat |ffected,springboot-1/tomcat |=affected,jbews-2/tomcat6=n |=affected,jbews-2/tomcat6=n |otaffected,jws-3/tomcat7=af |otaffected,jws-3/tomcat7=af |fected,rhel-8/tomcat=affect |fected,rhel-7/tomcat=affect |ed,rhel-7/tomcat=affected,j |ed,jbews-2/tomcat7=wontfix, |bews-2/tomcat7=wontfix,jws- |jws-3/tomcat8=affected,rhel |3/tomcat8=affected,rhel-6/t |-6/tomcat6=notaffected,jon- |omcat6=notaffected,jon-3/jb |3/jbossweb=affected,jws-5/t |ossweb=affected,jws-5/tomca |omcat=notaffected |t=notaffected |
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #11 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Web Server
Via RHSA-2018:2700 https://access.redhat.com/errata/RHSA-2018:2700
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Red Hat Product Errata | |RHSA-2018:2700
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #12 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Web Server 3 for RHEL 7 Red Hat JBoss Web Server 3 for RHEL 6
Via RHSA-2018:2701 https://access.redhat.com/errata/RHSA-2018:2701
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Red Hat Product Errata | |RHSA-2018:2701
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #14 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2018:2740 https://access.redhat.com/errata/RHSA-2018:2740
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Red Hat Product Errata | |RHSA-2018:2740
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #15 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7
Via RHSA-2018:2741 https://access.redhat.com/errata/RHSA-2018:2741
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Red Hat Product Errata | |RHSA-2018:2741
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #16 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5
Via RHSA-2018:2742 https://access.redhat.com/errata/RHSA-2018:2742
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Red Hat Product Errata | |RHSA-2018:2742
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Red Hat Product Errata | |RHSA-2018:2743
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6
Via RHSA-2018:2743 https://access.redhat.com/errata/RHSA-2018:2743
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Daniel Chong dchong@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |dchong@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #19 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:2921 https://access.redhat.com/errata/RHSA-2018:2921
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Red Hat Product Errata | |RHSA-2018:2921
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #21 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat JBoss Operations Network
Via RHSA-2018:2930 https://access.redhat.com/errata/RHSA-2018:2930
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Red Hat Product Errata | |RHSA-2018:2930
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #22 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8
Via RHSA-2018:2939 https://access.redhat.com/errata/RHSA-2018:2939
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Red Hat Product Errata | |RHSA-2018:2939
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #23 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Openshift Application Runtimes (text-only advisories)
Via RHSA-2018:2945 https://access.redhat.com/errata/RHSA-2018:2945
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Red Hat Product Errata | |RHSA-2018:2945
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Rémy Maucherat rmaucher@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |rmaucher@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #28 from Jean-frederic Clere jclere@redhat.com --- Oops https://bugzilla.redhat.com/show_bug.cgi?id=1608656 it was fixed in 6.4.21
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Aaron Ogburn aogburn@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |aogburn@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
--- Comment #32 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Fuse 7.2
Via RHSA-2018:3768 https://access.redhat.com/errata/RHSA-2018:3768
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
errata-xmlrpc errata-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Red Hat Product Errata | |RHSA-2018:3768
java-sig-commits@lists.fedoraproject.org
-
bugzilla＠redhat.com