juddi-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From alexo...@apache.org
Subject svn commit: r1795570 - in /juddi/cms-site/trunk: content/security.mdtext templates/skeleton.html templates/skeletonHome.html
Date Thu, 18 May 2017 23:27:51 GMT
Author: alexoree
Date: Thu May 18 23:27:51 2017
New Revision: 1795570

URL: http://svn.apache.org/viewvc?rev=1795570&view=rev
Log:
adding jUDDI security page

Added:
    juddi/cms-site/trunk/content/security.mdtext
Modified:
    juddi/cms-site/trunk/templates/skeleton.html
    juddi/cms-site/trunk/templates/skeletonHome.html

Added: juddi/cms-site/trunk/content/security.mdtext
URL: http://svn.apache.org/viewvc/juddi/cms-site/trunk/content/security.mdtext?rev=1795570&view=auto
==============================================================================
--- juddi/cms-site/trunk/content/security.mdtext (added)
+++ juddi/cms-site/trunk/content/security.mdtext Thu May 18 23:27:51 2017
@@ -0,0 +1,32 @@
+Title: Security Advisories
+
+## Security Advisories for Apache jUDDI
+
+### CVEID:CVE-2015-5241
+
+VERSION: 3.1.2, 3.1.3, 3.1.4, and 3.1.5 utilize the portlets based user interface also known
as 'Pluto', 'jUDDI Portal', 'UDDI Portal' or 'uddi-console'
+
+PROBLEMTYPE:Open Redirect
+
+REFERENCES:https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600@%3Cannounce.tomcat.apache.org%3E
+
+DESCRIPTION: After logging into the portal, the logout jsp page redirects the browser back
to the login page after. It is feasible for malicious user to redirect the browser to an unintended
web page. User session data, credentials, and auth tokens are cleared before the redirect.
+
+Mitigations:
+
+ 1) Remove or disable the portlet's based user interface. 
+ 2) Upgrade to newer versions of jUDDI (v3.2 and newer) which is not affected by this issue
+ 3) If upgrading or disabling the portlet based user interface is not an option, the following
can be used to resolve the issue. Modify the file located at "uddi-portlets/logout.jsp", replacing
the following text
+ 
+````
+   "String redirectURL = (String) request.getParameter("urlredirect");
+   if (redirectURL==null) redirectURL = "/pluto/Logout";
+````
+
+with this text
+
+````
+    String redirectURL = "/pluto/Logout";
+````
+
+No patches or releases are planned for the affected versions since jUDDI v3.2 replaced the
user interface.

Modified: juddi/cms-site/trunk/templates/skeleton.html
URL: http://svn.apache.org/viewvc/juddi/cms-site/trunk/templates/skeleton.html?rev=1795570&r1=1795569&r2=1795570&view=diff
==============================================================================
--- juddi/cms-site/trunk/templates/skeleton.html (original)
+++ juddi/cms-site/trunk/templates/skeleton.html Thu May 18 23:27:51 2017
@@ -136,6 +136,7 @@
 						<li><a href="docs.html">User, Admin and Dev Guides</a></li>
 						<li><a href="http://wiki.apache.org/juddi/">Wiki</a></li>
 						<li><a href="library.html">UDDI Library</a></li>
+						<li><a href="security.html">Security Advisories</a></li>
 						<li><a href="apidocs2/">Javadocs v2</a></li>
 						<li><a href="apidocs/">Javadocs v3</a></li>
 						<li><a href="xref/">Xref v2</a></li>

Modified: juddi/cms-site/trunk/templates/skeletonHome.html
URL: http://svn.apache.org/viewvc/juddi/cms-site/trunk/templates/skeletonHome.html?rev=1795570&r1=1795569&r2=1795570&view=diff
==============================================================================
--- juddi/cms-site/trunk/templates/skeletonHome.html (original)
+++ juddi/cms-site/trunk/templates/skeletonHome.html Thu May 18 23:27:51 2017
@@ -138,6 +138,7 @@
 						<li><a href="docs.html">User, Admin and Dev Guides</a></li>
 						<li><a href="http://wiki.apache.org/juddi/">Wiki</a></li>
 						<li><a href="library.html">UDDI Library</a></li>
+						<li><a href="security.html">Security Advisories</a></li>
 						<li><a href="apidocs2/">Javadocs v2</a></li>
 						<li><a href="apidocs/">Javadocs v3</a></li>
 						<li><a href="xref/">Xref v2</a></li>



---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@juddi.apache.org
For additional commands, e-mail: commits-help@juddi.apache.org


Mime
View raw message