GHSA-6rxj-58jh-436r
Apache Tomcat unauthorized access vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2018-1304
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 9.0.0, fixed 9.0.5 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 8.5.0, fixed 8.5.28 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 8.0.0, fixed 8.0.51 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 7.0.0, fixed 7.0.86 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-1304 ADVISORY
- https://github.com/apache/tomcat80/commit/9e700b93e3bf5c605267d20568a964169f9e0b79 WEB
- https://github.com/apache/tomcat/commit/723ea6a5bc5e7bc49e5ef84273c3b3c164a6a4fd WEB
- https://github.com/apache/tomcat/commit/5af7c13cff7cc8366c5997418e820989fabb8f48 WEB
- https://github.com/apache/tomcat/commit/2d69fde135302e8cff984bb2131ec69f2e396964 WEB
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb@%3Cannounce.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html WEB
- https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html WEB
- https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html WEB
- https://security.netapp.com/advisory/ntap-20180706-0001 WEB
- https://usn.ubuntu.com/3665-1 WEB
- https://web.archive.org/web/20200227102806/http://www.securityfocus.com/bid/103170 WEB
- https://web.archive.org/web/20200516074457/http://www.securitytracker.com/id/1040427 WEB
- https://www.debian.org/security/2018/dsa-4281 WEB
- https://www.oracle.com/security-alerts/cpuapr2020.html WEB
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html WEB
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html WEB
- https://access.redhat.com/errata/RHSA-2018:0465 WEB
- https://access.redhat.com/errata/RHSA-2018:0466 WEB
- https://access.redhat.com/errata/RHSA-2018:1320 WEB
- https://access.redhat.com/errata/RHSA-2018:1447 WEB
- https://access.redhat.com/errata/RHSA-2018:1448 WEB
- https://access.redhat.com/errata/RHSA-2018:1449 WEB
- https://access.redhat.com/errata/RHSA-2018:1450 WEB
- https://access.redhat.com/errata/RHSA-2018:1451 WEB
- https://access.redhat.com/errata/RHSA-2018:2939 WEB
- https://access.redhat.com/errata/RHSA-2019:2205 WEB
- https://github.com/advisories/GHSA-6rxj-58jh-436r ADVISORY
- https://github.com/apache/tomcat PACKAGE
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E WEB
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |