Author: markt
Date: Thu Oct 27 12:17:57 2016
New Revision: 1766812
URL: http://svn.apache.org/viewvc?rev=1766812&view=rev
Log:
Publish 5 CVEs
Modified:
tomcat/site/trunk/docs/security-6.html
tomcat/site/trunk/docs/security-7.html
tomcat/site/trunk/docs/security-8.html
tomcat/site/trunk/docs/security-9.html
tomcat/site/trunk/xdocs/security-6.xml
tomcat/site/trunk/xdocs/security-7.xml
tomcat/site/trunk/xdocs/security-8.xml
tomcat/site/trunk/xdocs/security-9.xml
Modified: tomcat/site/trunk/docs/security-6.html
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-6.html?rev=1766812&r1=1766811&r2=1766812&view=diff
==============================================================================
--- tomcat/site/trunk/docs/security-6.html (original)
+++ tomcat/site/trunk/docs/security-6.html Thu Oct 27 12:17:57 2016
@@ -219,6 +219,9 @@
<a href="#Apache_Tomcat_6.x_vulnerabilities">Apache Tomcat 6.x
vulnerabilities</a>
</li>
<li>
+<a href="#Fixed_in_Apache_Tomcat_6.0.47">Fixed in Apache Tomcat 6.0.47</a>
+</li>
+<li>
<a href="#Fixed_in_Apache_Tomcat_6.0.45">Fixed in Apache Tomcat 6.0.45</a>
</li>
<li>
@@ -331,6 +334,133 @@
</div>
+<h3 id="Fixed_in_Apache_Tomcat_6.0.47">
+<span style="float: right;">16 October 2016</span> Fixed in Apache Tomcat
6.0.47</h3>
+<div class="text">
+
+
+<p>
+<i>Note: The issues below were fixed in Apache Tomcat 6.0.46 but the
+ release vote for the 6.0.46 release candidate did not pass. Therefore,
+ although users must download 6.0.47 to obtain a version that includes
+ fixes for these issues, version 6.0.46 is not included in the list of
+ affected versions.</i>
+</p>
+
+
+<p>
+<strong>Low: Unrestricted Access to Global Resources</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6797";
rel="nofollow">CVE-2016-6797</a>
+</p>
+
+
+<p>The ResourceLinkFactory did not limit web application access to global
+ JNDI resources to those resources explicitly linked to the web
+ application. Therefore, it was possible for a web application to access
+ any global JNDI resource whether an explicit ResourceLink had been
+ configured or not.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1757285";>1757285</a>.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 18
+ January 2016 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 6.0.0 to 6.0.45</p>
+
+
+<p>
+<strong>Low: Security Manager Bypass</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6796";
rel="nofollow">CVE-2016-6796</a>
+</p>
+
+
+<p>A malicious web application was able to bypass a configured
+ SecurityManager via manipulation of the configuration parameters for the
+ JSP Servlet.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1758496";>1758496</a>.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 6.0.0 to 6.0.45</p>
+
+
+<p>
+<strong>Low: System Property Disclosure</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6794";
rel="nofollow">CVE-2016-6794</a>
+</p>
+
+
+<p>When a SecurityManager is configured, a web application's ability to read
+ system properties should be controlled by the SecurityManager. Tomcat's
+ system property replacement feature for configuration files could be
used
+ by a malicious web application to bypass the SecurityManager and read
+ system properties that should not be visible.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1754733";>1754733</a>.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 6.0.0 to 6.0.45</p>
+
+
+<p>
+<strong>Low: Security Manager Bypass</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5018";
rel="nofollow">CVE-2016-5018</a>
+</p>
+
+
+<p>A malicious web application was able to bypass a configured
+ SecurityManager via a Tomcat utility method that was accessible to web
+ applications.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1754904";>1754904</a>.</p>
+
+
+<p>This issue was discovered by Alvaro Munoz of the HP Enterprise Security
+ Team and reported to the Apache Tomcat Security Team on 5 July 2016. It
+ was made public on 27 October 2016.</p>
+
+
+<p>Affects: 6.0.0 to 6.0.45</p>
+
+
+<p>
+<strong>Low: Timing Attack</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0762";
rel="nofollow">CVE-2016-0762</a>
+</p>
+
+
+<p>The Realm implementations did not process the supplied password if the
+ supplied user name did not exist. This made a timing attack possible to
+ determine valid user names. Note that the default configuration includes
+ the LockOutRealm which makes exploitation of this vulnerability
+ harder.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1758506";>1758506</a>.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 1 January
+ 2016 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 6.0.0 to 6.0.45</p>
+
+
+</div>
<h3 id="Fixed_in_Apache_Tomcat_6.0.45">
<span style="float: right;">11 February 2016</span> Fixed in Apache Tomcat
6.0.45</h3>
<div class="text">
Modified: tomcat/site/trunk/docs/security-7.html
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-7.html?rev=1766812&r1=1766811&r2=1766812&view=diff
==============================================================================
--- tomcat/site/trunk/docs/security-7.html (original)
+++ tomcat/site/trunk/docs/security-7.html Thu Oct 27 12:17:57 2016
@@ -219,6 +219,9 @@
<a href="#Apache_Tomcat_7.x_vulnerabilities">Apache Tomcat 7.x
vulnerabilities</a>
</li>
<li>
+<a href="#Fixed_in_Apache_Tomcat_7.0.72">Fixed in Apache Tomcat 7.0.72</a>
+</li>
+<li>
<a href="#Fixed_in_Apache_Tomcat_7.0.70">Fixed in Apache Tomcat 7.0.70</a>
</li>
<li>
@@ -357,6 +360,133 @@
</div>
+<h3 id="Fixed_in_Apache_Tomcat_7.0.72">
+<span style="float: right;">19 September 2016</span> Fixed in Apache Tomcat
7.0.72</h3>
+<div class="text">
+
+
+<p>
+<i>Note: The issues below were fixed in Apache Tomcat 7.0.71 but the
+ release vote for the 7.0.71 release candidate did not pass. Therefore,
+ although users must download 7.0.72 to obtain a version that includes
+ fixes for these issues, version 7.0.71 is not included in the list of
+ affected versions.</i>
+</p>
+
+
+<p>
+<strong>Low: Unrestricted Access to Global Resources</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6797";
rel="nofollow">CVE-2016-6797</a>
+</p>
+
+
+<p>The ResourceLinkFactory did not limit web application access to global
+ JNDI resources to those resources explicitly linked to the web
+ application. Therefore, it was possible for a web application to access
+ any global JNDI resource whether an explicit ResourceLink had been
+ configured or not.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1757275";>1757275</a>.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 18
+ January 2016 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 7.0.0 to 7.0.70</p>
+
+
+<p>
+<strong>Low: Security Manager Bypass</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6796";
rel="nofollow">CVE-2016-6796</a>
+</p>
+
+
+<p>A malicious web application was able to bypass a configured
+ SecurityManager via manipulation of the configuration parameters for the
+ JSP Servlet.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1758495";>1758495</a>.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 7.0.0 to 7.0.70</p>
+
+
+<p>
+<strong>Low: System Property Disclosure</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6794";
rel="nofollow">CVE-2016-6794</a>
+</p>
+
+
+<p>When a SecurityManager is configured, a web application's ability to read
+ system properties should be controlled by the SecurityManager. Tomcat's
+ system property replacement feature for configuration files could be
used
+ by a malicious web application to bypass the SecurityManager and read
+ system properties that should not be visible.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1754728";>1754728</a>.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 7.0.0 to 7.0.70</p>
+
+
+<p>
+<strong>Low: Security Manager Bypass</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5018";
rel="nofollow">CVE-2016-5018</a>
+</p>
+
+
+<p>A malicious web application was able to bypass a configured
+ SecurityManager via a Tomcat utility method that was accessible to web
+ applications.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1754902";>1754902</a>.</p>
+
+
+<p>This issue was discovered by Alvaro Munoz of the HP Enterprise Security
+ Team and reported to the Apache Tomcat Security Team on 5 July 2016. It
+ was made public on 27 October 2016.</p>
+
+
+<p>Affects: 7.0.0 to 7.0.70</p>
+
+
+<p>
+<strong>Low: Timing Attack</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0762";
rel="nofollow">CVE-2016-0762</a>
+</p>
+
+
+<p>The Realm implementations did not process the supplied password if the
+ supplied user name did not exist. This made a timing attack possible to
+ determine valid user names. Note that the default configuration includes
+ the LockOutRealm which makes exploitation of this vulnerability
+ harder.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1758502";>1758502</a>.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 1 January
+ 2016 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 7.0.0 to 7.0.70</p>
+
+
+</div>
<h3 id="Fixed_in_Apache_Tomcat_7.0.70">
<span style="float: right;">20 June 2016</span> Fixed in Apache Tomcat
7.0.70</h3>
<div class="text">
Modified: tomcat/site/trunk/docs/security-8.html
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-8.html?rev=1766812&r1=1766811&r2=1766812&view=diff
==============================================================================
--- tomcat/site/trunk/docs/security-8.html (original)
+++ tomcat/site/trunk/docs/security-8.html Thu Oct 27 12:17:57 2016
@@ -219,6 +219,9 @@
<a href="#Apache_Tomcat_8.x_vulnerabilities">Apache Tomcat 8.x
vulnerabilities</a>
</li>
<li>
+<a href="#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37">Fixed in Apache Tomcat
8.5.5 and 8.0.37</a>
+</li>
+<li>
<a href="#Fixed_in_Apache_Tomcat_8.5.3_and_8.0.36">Fixed in Apache Tomcat
8.5.3 and 8.0.36</a>
</li>
<li>
@@ -303,6 +306,134 @@
</div>
+<h3 id="Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37">
+<span style="float: right;">5 September 2016</span> Fixed in Apache Tomcat
8.5.5 and 8.0.37</h3>
+<div class="text">
+
+
+<p>
+<strong>Low: Unrestricted Access to Global Resources</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6797";
rel="nofollow">CVE-2016-6797</a>
+</p>
+
+
+<p>The ResourceLinkFactory did not limit web application access to global
+ JNDI resources to those resources explicitly linked to the web
+ application. Therefore, it was possible for a web application to access
+ any global JNDI resource whether an explicit ResourceLink had been
+ configured or not.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1757272";>1757272</a> for
+ 8.5.x and revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1757273";>1757273</a> for
+ 8.0.x.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 18
+ January 2016 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36</p>
+
+
+<p>
+<strong>Low: Security Manager Bypass</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6796";
rel="nofollow">CVE-2016-6796</a>
+</p>
+
+
+<p>A malicious web application was able to bypass a configured
+ SecurityManager via manipulation of the configuration parameters for the
+ JSP Servlet.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1758493";>1758493</a> for
+ 8.5.x and revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1758494";>1758494</a> for
+ 8.0.x.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36</p>
+
+
+<p>
+<strong>Low: System Property Disclosure</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6794";
rel="nofollow">CVE-2016-6794</a>
+</p>
+
+
+<p>When a SecurityManager is configured, a web application's ability to read
+ system properties should be controlled by the SecurityManager. Tomcat's
+ system property replacement feature for configuration files could be
used
+ by a malicious web application to bypass the SecurityManager and read
+ system properties that should not be visible.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1754726";>1754726</a> for
+ 8.5.x and revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1754727";>1754727</a> for
+ 8.0.x.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36</p>
+
+
+<p>
+<strong>Low: Security Manager Bypass</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5018";
rel="nofollow">CVE-2016-5018</a>
+</p>
+
+
+<p>A malicious web application was able to bypass a configured
+ SecurityManager via a Tomcat utility method that was accessible to web
+ applications.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1754900";>1754900</a> for
+ 8.5.x and revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1754901";>1754901</a> for
+ 8.0.x.</p>
+
+
+<p>This issue was discovered by Alvaro Munoz of the HP Enterprise Security
+ Team and reported to the Apache Tomcat Security Team on 5 July 2016. It
+ was made public on 27 October 2016.</p>
+
+
+<p>Affects: 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36</p>
+
+
+<p>
+<strong>Low: Timing Attack</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0762";
rel="nofollow">CVE-2016-0762</a>
+</p>
+
+
+<p>The Realm implementations did not process the supplied password if the
+ supplied user name did not exist. This made a timing attack possible to
+ determine valid user names. Note that the default configuration includes
+ the LockOutRealm which makes exploitation of this vulnerability
+ harder.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1758500";>1758500</a> for
+ 8.5.x and revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1758501";>1758501</a> for
+ 8.0.x.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 1 January
+ 2016 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36</p>
+
+
+</div>
<h3 id="Fixed_in_Apache_Tomcat_8.5.3_and_8.0.36">
<span style="float: right;">13 June 2016</span> Fixed in Apache Tomcat 8.5.3
and 8.0.36</h3>
<div class="text">
Modified: tomcat/site/trunk/docs/security-9.html
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-9.html?rev=1766812&r1=1766811&r2=1766812&view=diff
==============================================================================
--- tomcat/site/trunk/docs/security-9.html (original)
+++ tomcat/site/trunk/docs/security-9.html Thu Oct 27 12:17:57 2016
@@ -219,6 +219,9 @@
<a href="#Apache_Tomcat_9.x_vulnerabilities">Apache Tomcat 9.x
vulnerabilities</a>
</li>
<li>
+<a href="#Fixed_in_Apache_Tomcat_9.0.0.M10">Fixed in Apache Tomcat
9.0.0.M10</a>
+</li>
+<li>
<a href="#Fixed_in_Apache_Tomcat_9.0.0.M8">Fixed in Apache Tomcat 9.0.0.M8</a>
</li>
<li>
@@ -273,6 +276,124 @@
</div>
+<h3 id="Fixed_in_Apache_Tomcat_9.0.0.M10">
+<span style="float: right;">5 September 2016</span> Fixed in Apache Tomcat
9.0.0.M10</h3>
+<div class="text">
+
+
+<p>
+<strong>Low: Unrestricted Access to Global Resources</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6797";
rel="nofollow">CVE-2016-6797</a>
+</p>
+
+
+<p>The ResourceLinkFactory did not limit web application access to global
+ JNDI resources to those resources explicitly linked to the web
+ application. Therefore, it was possible for a web application to access
+ any global JNDI resource whether an explicit ResourceLink had been
+ configured or not.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1757271";>1757271</a>.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 18
+ January 2016 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 9.0.0.M1 to 9.0.0.M9</p>
+
+
+<p>
+<strong>Low: Security Manager Bypass</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6796";
rel="nofollow">CVE-2016-6796</a>
+</p>
+
+
+<p>A malicious web application was able to bypass a configured
+ SecurityManager via manipulation of the configuration parameters for the
+ JSP Servlet.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1758487";>1758487</a>.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 9.0.0.M1 to 9.0.0.M9</p>
+
+
+<p>
+<strong>Low: System Property Disclosure</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6794";
rel="nofollow">CVE-2016-6794</a>
+</p>
+
+
+<p>When a SecurityManager is configured, a web application's ability to read
+ system properties should be controlled by the SecurityManager. Tomcat's
+ system property replacement feature for configuration files could be
used
+ by a malicious web application to bypass the SecurityManager and read
+ system properties that should not be visible.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1754445";>1754445</a>.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 9.0.0.M1 to 9.0.0.M9</p>
+
+
+<p>
+<strong>Low: Security Manager Bypass</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5018";
rel="nofollow">CVE-2016-5018</a>
+</p>
+
+
+<p>A malicious web application was able to bypass a configured
+ SecurityManager via a Tomcat utility method that was accessible to web
+ applications.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1754714";>1754714</a>.</p>
+
+
+<p>This issue was discovered by Alvaro Munoz of the HP Enterprise Security
+ Team and reported to the Apache Tomcat Security Team on 5 July 2016. It
+ was made public on 27 October 2016.</p>
+
+
+<p>Affects: 9.0.0.M1 to 9.0.0.M9</p>
+
+
+<p>
+<strong>Low: Timing Attack</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0762";
rel="nofollow">CVE-2016-0762</a>
+</p>
+
+
+<p>The Realm implementations did not process the supplied password if the
+ supplied user name did not exist. This made a timing attack possible to
+ determine valid user names. Note that the default configuration includes
+ the LockOutRealm which makes exploitation of this vulnerability
+ harder.</p>
+
+
+<p>This was fixed in revision <a
href="http://svn.apache.org/viewvc?view=rev&rev=1758499";>1758499</a>.</p>
+
+
+<p>This issue was identified by the Apache Tomcat Security Team on 1 January
+ 2016 and made public on 27 October 2016.</p>
+
+
+<p>Affects: 9.0.0.M1 to 9.0.0.M9</p>
+
+
+</div>
<h3 id="Fixed_in_Apache_Tomcat_9.0.0.M8">
<span style="float: right;">13 June 2016</span> Fixed in Apache Tomcat
9.0.0.M8</h3>
<div class="text">
Modified: tomcat/site/trunk/xdocs/security-6.xml
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-6.xml?rev=1766812&r1=1766811&r2=1766812&view=diff
==============================================================================
--- tomcat/site/trunk/xdocs/security-6.xml (original)
+++ tomcat/site/trunk/xdocs/security-6.xml Thu Oct 27 12:17:57 2016
@@ -48,6 +48,93 @@
</section>
+ <section name="Fixed in Apache Tomcat 6.0.47" rtext="16 October 2016">
+
+ <p><i>Note: The issues below were fixed in Apache Tomcat 6.0.46 but the
+ release vote for the 6.0.46 release candidate did not pass. Therefore,
+ although users must download 6.0.47 to obtain a version that includes
+ fixes for these issues, version 6.0.46 is not included in the list of
+ affected versions.</i></p>
+
+ <p><strong>Low: Unrestricted Access to Global Resources</strong>
+ <cve>CVE-2016-6797</cve></p>
+
+ <p>The ResourceLinkFactory did not limit web application access to global
+ JNDI resources to those resources explicitly linked to the web
+ application. Therefore, it was possible for a web application to access
+ any global JNDI resource whether an explicit ResourceLink had been
+ configured or not.</p>
+
+ <p>This was fixed in revision <revlink rev="1757285">1757285</revlink>.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 18
+ January 2016 and made public on 27 October 2016.</p>
+
+ <p>Affects: 6.0.0 to 6.0.45</p>
+
+ <p><strong>Low: Security Manager Bypass</strong>
+ <cve>CVE-2016-6796</cve></p>
+
+ <p>A malicious web application was able to bypass a configured
+ SecurityManager via manipulation of the configuration parameters for the
+ JSP Servlet.</p>
+
+ <p>This was fixed in revision <revlink rev="1758496">1758496</revlink>.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+ <p>Affects: 6.0.0 to 6.0.45</p>
+
+ <p><strong>Low: System Property Disclosure</strong>
+ <cve>CVE-2016-6794</cve></p>
+
+ <p>When a SecurityManager is configured, a web application's ability to
read
+ system properties should be controlled by the SecurityManager. Tomcat's
+ system property replacement feature for configuration files could be
used
+ by a malicious web application to bypass the SecurityManager and read
+ system properties that should not be visible.</p>
+
+ <p>This was fixed in revision <revlink rev="1754733">1754733</revlink>.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+ <p>Affects: 6.0.0 to 6.0.45</p>
+
+ <p><strong>Low: Security Manager Bypass</strong>
+ <cve>CVE-2016-5018</cve></p>
+
+ <p>A malicious web application was able to bypass a configured
+ SecurityManager via a Tomcat utility method that was accessible to web
+ applications.</p>
+
+ <p>This was fixed in revision <revlink rev="1754904">1754904</revlink>.</p>
+
+ <p>This issue was discovered by Alvaro Munoz of the HP Enterprise Security
+ Team and reported to the Apache Tomcat Security Team on 5 July 2016. It
+ was made public on 27 October 2016.</p>
+
+ <p>Affects: 6.0.0 to 6.0.45</p>
+
+ <p><strong>Low: Timing Attack</strong>
+ <cve>CVE-2016-0762</cve></p>
+
+ <p>The Realm implementations did not process the supplied password if the
+ supplied user name did not exist. This made a timing attack possible to
+ determine valid user names. Note that the default configuration includes
+ the LockOutRealm which makes exploitation of this vulnerability
+ harder.</p>
+
+ <p>This was fixed in revision <revlink rev="1758506">1758506</revlink>.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 1
January
+ 2016 and made public on 27 October 2016.</p>
+
+ <p>Affects: 6.0.0 to 6.0.45</p>
+
+ </section>
+
<section name="Fixed in Apache Tomcat 6.0.45" rtext="11 February 2016">
<p><strong>Low: Limited directory traversal</strong>
Modified: tomcat/site/trunk/xdocs/security-7.xml
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-7.xml?rev=1766812&r1=1766811&r2=1766812&view=diff
==============================================================================
--- tomcat/site/trunk/xdocs/security-7.xml (original)
+++ tomcat/site/trunk/xdocs/security-7.xml Thu Oct 27 12:17:57 2016
@@ -50,6 +50,93 @@
</section>
+ <section name="Fixed in Apache Tomcat 7.0.72" rtext="19 September 2016">
+
+ <p><i>Note: The issues below were fixed in Apache Tomcat 7.0.71 but the
+ release vote for the 7.0.71 release candidate did not pass. Therefore,
+ although users must download 7.0.72 to obtain a version that includes
+ fixes for these issues, version 7.0.71 is not included in the list of
+ affected versions.</i></p>
+
+ <p><strong>Low: Unrestricted Access to Global Resources</strong>
+ <cve>CVE-2016-6797</cve></p>
+
+ <p>The ResourceLinkFactory did not limit web application access to global
+ JNDI resources to those resources explicitly linked to the web
+ application. Therefore, it was possible for a web application to access
+ any global JNDI resource whether an explicit ResourceLink had been
+ configured or not.</p>
+
+ <p>This was fixed in revision <revlink rev="1757275">1757275</revlink>.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 18
+ January 2016 and made public on 27 October 2016.</p>
+
+ <p>Affects: 7.0.0 to 7.0.70</p>
+
+ <p><strong>Low: Security Manager Bypass</strong>
+ <cve>CVE-2016-6796</cve></p>
+
+ <p>A malicious web application was able to bypass a configured
+ SecurityManager via manipulation of the configuration parameters for the
+ JSP Servlet.</p>
+
+ <p>This was fixed in revision <revlink rev="1758495">1758495</revlink>.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+ <p>Affects: 7.0.0 to 7.0.70</p>
+
+ <p><strong>Low: System Property Disclosure</strong>
+ <cve>CVE-2016-6794</cve></p>
+
+ <p>When a SecurityManager is configured, a web application's ability to
read
+ system properties should be controlled by the SecurityManager. Tomcat's
+ system property replacement feature for configuration files could be
used
+ by a malicious web application to bypass the SecurityManager and read
+ system properties that should not be visible.</p>
+
+ <p>This was fixed in revision <revlink rev="1754728">1754728</revlink>.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+ <p>Affects: 7.0.0 to 7.0.70</p>
+
+ <p><strong>Low: Security Manager Bypass</strong>
+ <cve>CVE-2016-5018</cve></p>
+
+ <p>A malicious web application was able to bypass a configured
+ SecurityManager via a Tomcat utility method that was accessible to web
+ applications.</p>
+
+ <p>This was fixed in revision <revlink rev="1754902">1754902</revlink>.</p>
+
+ <p>This issue was discovered by Alvaro Munoz of the HP Enterprise Security
+ Team and reported to the Apache Tomcat Security Team on 5 July 2016. It
+ was made public on 27 October 2016.</p>
+
+ <p>Affects: 7.0.0 to 7.0.70</p>
+
+ <p><strong>Low: Timing Attack</strong>
+ <cve>CVE-2016-0762</cve></p>
+
+ <p>The Realm implementations did not process the supplied password if the
+ supplied user name did not exist. This made a timing attack possible to
+ determine valid user names. Note that the default configuration includes
+ the LockOutRealm which makes exploitation of this vulnerability
+ harder.</p>
+
+ <p>This was fixed in revision <revlink rev="1758502">1758502</revlink>.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 1
January
+ 2016 and made public on 27 October 2016.</p>
+
+ <p>Affects: 7.0.0 to 7.0.70</p>
+
+ </section>
+
<section name="Fixed in Apache Tomcat 7.0.70" rtext="20 June 2016">
<p><strong>Moderate: Denial of Service</strong>
Modified: tomcat/site/trunk/xdocs/security-8.xml
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-8.xml?rev=1766812&r1=1766811&r2=1766812&view=diff
==============================================================================
--- tomcat/site/trunk/xdocs/security-8.xml (original)
+++ tomcat/site/trunk/xdocs/security-8.xml Thu Oct 27 12:17:57 2016
@@ -50,6 +50,97 @@
</section>
+ <section name="Fixed in Apache Tomcat 8.5.5 and 8.0.37" rtext="5 September
2016">
+
+ <p><strong>Low: Unrestricted Access to Global Resources</strong>
+ <cve>CVE-2016-6797</cve></p>
+
+ <p>The ResourceLinkFactory did not limit web application access to global
+ JNDI resources to those resources explicitly linked to the web
+ application. Therefore, it was possible for a web application to access
+ any global JNDI resource whether an explicit ResourceLink had been
+ configured or not.</p>
+
+ <p>This was fixed in revision <revlink rev="1757272">1757272</revlink> for
+ 8.5.x and revision <revlink rev="1757273">1757273</revlink> for
+ 8.0.x.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 18
+ January 2016 and made public on 27 October 2016.</p>
+
+ <p>Affects: 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36</p>
+
+ <p><strong>Low: Security Manager Bypass</strong>
+ <cve>CVE-2016-6796</cve></p>
+
+ <p>A malicious web application was able to bypass a configured
+ SecurityManager via manipulation of the configuration parameters for the
+ JSP Servlet.</p>
+
+ <p>This was fixed in revision <revlink rev="1758493">1758493</revlink> for
+ 8.5.x and revision <revlink rev="1758494">1758494</revlink> for
+ 8.0.x.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+ <p>Affects: 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36</p>
+
+ <p><strong>Low: System Property Disclosure</strong>
+ <cve>CVE-2016-6794</cve></p>
+
+ <p>When a SecurityManager is configured, a web application's ability to
read
+ system properties should be controlled by the SecurityManager. Tomcat's
+ system property replacement feature for configuration files could be
used
+ by a malicious web application to bypass the SecurityManager and read
+ system properties that should not be visible.</p>
+
+ <p>This was fixed in revision <revlink rev="1754726">1754726</revlink> for
+ 8.5.x and revision <revlink rev="1754727">1754727</revlink> for
+ 8.0.x.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+ <p>Affects: 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36</p>
+
+ <p><strong>Low: Security Manager Bypass</strong>
+ <cve>CVE-2016-5018</cve></p>
+
+ <p>A malicious web application was able to bypass a configured
+ SecurityManager via a Tomcat utility method that was accessible to web
+ applications.</p>
+
+ <p>This was fixed in revision <revlink rev="1754900">1754900</revlink> for
+ 8.5.x and revision <revlink rev="1754901">1754901</revlink> for
+ 8.0.x.</p>
+
+ <p>This issue was discovered by Alvaro Munoz of the HP Enterprise Security
+ Team and reported to the Apache Tomcat Security Team on 5 July 2016. It
+ was made public on 27 October 2016.</p>
+
+ <p>Affects: 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36</p>
+
+ <p><strong>Low: Timing Attack</strong>
+ <cve>CVE-2016-0762</cve></p>
+
+ <p>The Realm implementations did not process the supplied password if the
+ supplied user name did not exist. This made a timing attack possible to
+ determine valid user names. Note that the default configuration includes
+ the LockOutRealm which makes exploitation of this vulnerability
+ harder.</p>
+
+ <p>This was fixed in revision <revlink rev="1758500">1758500</revlink> for
+ 8.5.x and revision <revlink rev="1758501">1758501</revlink> for
+ 8.0.x.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 1
January
+ 2016 and made public on 27 October 2016.</p>
+
+ <p>Affects: 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36</p>
+
+ </section>
+
<section name="Fixed in Apache Tomcat 8.5.3 and 8.0.36" rtext="13 June 2016">
<p><strong>Moderate: Denial of Service</strong>
Modified: tomcat/site/trunk/xdocs/security-9.xml
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-9.xml?rev=1766812&r1=1766811&r2=1766812&view=diff
==============================================================================
--- tomcat/site/trunk/xdocs/security-9.xml (original)
+++ tomcat/site/trunk/xdocs/security-9.xml Thu Oct 27 12:17:57 2016
@@ -50,6 +50,87 @@
</section>
+ <section name="Fixed in Apache Tomcat 9.0.0.M10" rtext="5 September 2016">
+
+ <p><strong>Low: Unrestricted Access to Global Resources</strong>
+ <cve>CVE-2016-6797</cve></p>
+
+ <p>The ResourceLinkFactory did not limit web application access to global
+ JNDI resources to those resources explicitly linked to the web
+ application. Therefore, it was possible for a web application to access
+ any global JNDI resource whether an explicit ResourceLink had been
+ configured or not.</p>
+
+ <p>This was fixed in revision <revlink rev="1757271">1757271</revlink>.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 18
+ January 2016 and made public on 27 October 2016.</p>
+
+ <p>Affects: 9.0.0.M1 to 9.0.0.M9</p>
+
+ <p><strong>Low: Security Manager Bypass</strong>
+ <cve>CVE-2016-6796</cve></p>
+
+ <p>A malicious web application was able to bypass a configured
+ SecurityManager via manipulation of the configuration parameters for the
+ JSP Servlet.</p>
+
+ <p>This was fixed in revision <revlink rev="1758487">1758487</revlink>.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+ <p>Affects: 9.0.0.M1 to 9.0.0.M9</p>
+
+ <p><strong>Low: System Property Disclosure</strong>
+ <cve>CVE-2016-6794</cve></p>
+
+ <p>When a SecurityManager is configured, a web application's ability to
read
+ system properties should be controlled by the SecurityManager. Tomcat's
+ system property replacement feature for configuration files could be
used
+ by a malicious web application to bypass the SecurityManager and read
+ system properties that should not be visible.</p>
+
+ <p>This was fixed in revision <revlink rev="1754445">1754445</revlink>.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 27
+ December 2015 and made public on 27 October 2016.</p>
+
+ <p>Affects: 9.0.0.M1 to 9.0.0.M9</p>
+
+ <p><strong>Low: Security Manager Bypass</strong>
+ <cve>CVE-2016-5018</cve></p>
+
+ <p>A malicious web application was able to bypass a configured
+ SecurityManager via a Tomcat utility method that was accessible to web
+ applications.</p>
+
+ <p>This was fixed in revision <revlink rev="1754714">1754714</revlink>.</p>
+
+ <p>This issue was discovered by Alvaro Munoz of the HP Enterprise Security
+ Team and reported to the Apache Tomcat Security Team on 5 July 2016. It
+ was made public on 27 October 2016.</p>
+
+ <p>Affects: 9.0.0.M1 to 9.0.0.M9</p>
+
+ <p><strong>Low: Timing Attack</strong>
+ <cve>CVE-2016-0762</cve></p>
+
+ <p>The Realm implementations did not process the supplied password if the
+ supplied user name did not exist. This made a timing attack possible to
+ determine valid user names. Note that the default configuration includes
+ the LockOutRealm which makes exploitation of this vulnerability
+ harder.</p>
+
+ <p>This was fixed in revision <revlink rev="1758499">1758499</revlink>.</p>
+
+ <p>This issue was identified by the Apache Tomcat Security Team on 1
January
+ 2016 and made public on 27 October 2016.</p>
+
+ <p>Affects: 9.0.0.M1 to 9.0.0.M9</p>
+
+ </section>
+
<section name="Fixed in Apache Tomcat 9.0.0.M8" rtext="13 June 2016">
<p><i>Note: The issue below was fixed in Apache Tomcat 9.0.0.M7 but the
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
