Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:3935-1

Опубликовано: 28 нояб. 2018
Источник: suse-cvrf

Описание

Security update for tomcat6

This update for tomcat6 fixes the following issue:

Security issue fixed:

  • CVE-2018-11784: Fixed problem with specially crafted URLs that could be used to cause a redirect to any URI of an attackers choise (bsc#1110850).

Список пакетов

SUSE Linux Enterprise Server 11 SP4
tomcat6-6.0.53-0.57.10.1
tomcat6-admin-webapps-6.0.53-0.57.10.1
tomcat6-docs-webapp-6.0.53-0.57.10.1
tomcat6-javadoc-6.0.53-0.57.10.1
tomcat6-jsp-2_1-api-6.0.53-0.57.10.1
tomcat6-lib-6.0.53-0.57.10.1
tomcat6-servlet-2_5-api-6.0.53-0.57.10.1
tomcat6-webapps-6.0.53-0.57.10.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4
tomcat6-6.0.53-0.57.10.1
tomcat6-admin-webapps-6.0.53-0.57.10.1
tomcat6-docs-webapp-6.0.53-0.57.10.1
tomcat6-javadoc-6.0.53-0.57.10.1
tomcat6-jsp-2_1-api-6.0.53-0.57.10.1
tomcat6-lib-6.0.53-0.57.10.1
tomcat6-servlet-2_5-api-6.0.53-0.57.10.1
tomcat6-webapps-6.0.53-0.57.10.1

Ссылки

Описание

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

Затронутые продукты
SUSE Linux Enterprise Server 11 SP4:tomcat6-6.0.53-0.57.10.1
SUSE Linux Enterprise Server 11 SP4:tomcat6-admin-webapps-6.0.53-0.57.10.1
SUSE Linux Enterprise Server 11 SP4:tomcat6-docs-webapp-6.0.53-0.57.10.1
SUSE Linux Enterprise Server 11 SP4:tomcat6-javadoc-6.0.53-0.57.10.1
Ссылки
Уязвимость SUSE-SU-2018:3935-1