Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2015-5345 →
UBUNTU-CVE-2015-5345
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before cons...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:14.04:LTS
tomcat6
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.39-1ubuntu0.1"}]}]
Ubuntu:14.04:LTS
tomcat7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.6"}]}]
Ubuntu:16.04:LTS
tomcat6
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.45+dfsg-1"}]}]
Ubuntu:18.04:LTS
tomcat9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3~18.04.1"}]}]
Références
- advisory ubuntu.com
- report ubuntu.com
- report seclists.org
- report cve.org