tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From ma...@apache.org
Subject svn commit: r1679374 - in /tomcat/site/trunk: docs/security-6.html docs/security-7.html docs/security-8.html xdocs/security-6.xml xdocs/security-7.xml xdocs/security-8.xml
Date Thu, 14 May 2015 14:03:06 GMT
Author: markt
Date: Thu May 14 14:03:06 2015
New Revision: 1679374

URL: http://svn.apache.org/r1679374
Log:
Add CVE-2014-7810

Modified:
    tomcat/site/trunk/docs/security-6.html
    tomcat/site/trunk/docs/security-7.html
    tomcat/site/trunk/docs/security-8.html
    tomcat/site/trunk/xdocs/security-6.xml
    tomcat/site/trunk/xdocs/security-7.xml
    tomcat/site/trunk/xdocs/security-8.xml

Modified: tomcat/site/trunk/docs/security-6.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-6.html?rev=1679374&r1=1679373&r2=1679374&view=diff
==============================================================================
--- tomcat/site/trunk/docs/security-6.html (original)
+++ tomcat/site/trunk/docs/security-6.html Thu May 14 14:03:06 2015
@@ -342,6 +342,28 @@
     
 <p>Affects: 6.0.0 to 6.0.43</p>
 
+    
+<p>
+<strong>Moderate: Security Manager bypass</strong>
+       <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7810" rel="nofollow">CVE-2014-7810</a>
+</p>
+
+    
+<p>Malicious web applications could use expression language to bypass the
+       protections of a Security Manager as expressions were evaluated within a
+       privileged code section.</p>
+
+    
+<p>This was fixed in revisions <a href="http://svn.apache.org/viewvc?view=rev&amp;rev=1645366">1645366</a>
and
+       <a href="http://svn.apache.org/viewvc?view=rev&amp;rev=1659538">1659538</a>.</p>
+
+    
+<p>This issue was identified by the Tomcat security team on 2 November 2014
+       and made public on 14 May 2015.</p>
+
+    
+<p>Affects: 6.0.0 to 6.0.43</p>
+
   
 </div>
 <h3 id="Fixed_in_Apache_Tomcat_6.0.43">

Modified: tomcat/site/trunk/docs/security-7.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-7.html?rev=1679374&r1=1679373&r2=1679374&view=diff
==============================================================================
--- tomcat/site/trunk/docs/security-7.html (original)
+++ tomcat/site/trunk/docs/security-7.html Thu May 14 14:03:06 2015
@@ -203,6 +203,9 @@
 <a href="#Apache_Tomcat_7.x_vulnerabilities">Apache Tomcat 7.x vulnerabilities</a>
 </li>
 <li>
+<a href="#Fixed_in_Apache_Tomcat_7.0.59">Fixed in Apache Tomcat 7.0.59</a>
+</li>
+<li>
 <a href="#Fixed_in_Apache_Tomcat_7.0.55">Fixed in Apache Tomcat 7.0.55</a>
 </li>
 <li>
@@ -326,6 +329,43 @@
 
   
 </div>
+<h3 id="Fixed_in_Apache_Tomcat_7.0.59">
+<span style="float: right;">4 February 2015</span> Fixed in Apache Tomcat 7.0.59</h3>
+<div class="text">
+
+  
+<p>
+<i>Note: The issue below was fixed in Apache Tomcat 7.0.58 but the
+       release vote for the 7.0.58 release candidate did not pass. Therefore,
+       although users must download 7.0.59 to obtain a version that includes a
+       fix for this issue, versions 7.0.58 is not included in the list of
+       affected versions.</i>
+</p>
+
+    
+<p>
+<strong>Moderate: Security Manager bypass</strong>
+       <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7810" rel="nofollow">CVE-2014-7810</a>
+</p>
+
+    
+<p>Malicious web applications could use expression language to bypass the
+       protections of a Security Manager as expressions were evaluated within a
+       privileged code section.</p>
+
+    
+<p>This was fixed in revisions <a href="http://svn.apache.org/viewvc?view=rev&amp;rev=1644018">1644018</a>
and
+       <a href="http://svn.apache.org/viewvc?view=rev&amp;rev=1645642">1645642</a>.</p>
+
+    
+<p>This issue was identified by the Tomcat security team on 2 November 2014
+       and made public on 14 May 2015.</p>
+
+    
+<p>Affects: 7.0.0 to 7.0.57</p>
+
+  
+</div>
 <h3 id="Fixed_in_Apache_Tomcat_7.0.55">
 <span style="float: right;">27 July 2014</span> Fixed in Apache Tomcat 7.0.55</h3>
 <div class="text">

Modified: tomcat/site/trunk/docs/security-8.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-8.html?rev=1679374&r1=1679373&r2=1679374&view=diff
==============================================================================
--- tomcat/site/trunk/docs/security-8.html (original)
+++ tomcat/site/trunk/docs/security-8.html Thu May 14 14:03:06 2015
@@ -203,6 +203,9 @@
 <a href="#Apache_Tomcat_8.x_vulnerabilities">Apache Tomcat 8.x vulnerabilities</a>
 </li>
 <li>
+<a href="#Fixed_in_Apache_Tomcat_8.0.17">Fixed in Apache Tomcat 8.0.17</a>
+</li>
+<li>
 <a href="#Fixed_in_Apache_Tomcat_8.0.9">Fixed in Apache Tomcat 8.0.9</a>
 </li>
 <li>
@@ -272,6 +275,43 @@
 
   
 </div>
+<h3 id="Fixed_in_Apache_Tomcat_8.0.17">
+<span style="float: right;">16 January 2015</span> Fixed in Apache Tomcat 8.0.17</h3>
+<div class="text">
+
+  
+<p>
+<i>Note: The issue below was fixed in Apache Tomcat 8.0.16 but the
+       release vote for the 8.0.16 release candidate did not pass. Therefore,
+       although users must download 8.0.17 to obtain a version that includes a
+       fix for this issue, versions 8.0.16 is not included in the list of
+       affected versions.</i>
+</p>
+
+    
+<p>
+<strong>Moderate: Security Manager bypass</strong>
+       <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7810" rel="nofollow">CVE-2014-7810</a>
+</p>
+
+    
+<p>Malicious web applications could use expression language to bypass the
+       protections of a Security Manager as expressions were evaluated within a
+       privileged code section.</p>
+
+    
+<p>This was fixed in revisions <a href="http://svn.apache.org/viewvc?view=rev&amp;rev=1644017">1644017</a>
and
+       <a href="http://svn.apache.org/viewvc?view=rev&amp;rev=1645641">1645641</a>.</p>
+
+    
+<p>This issue was identified by the Tomcat security team on 2 November 2014
+       and made public on 14 May 2015.</p>
+
+    
+<p>Affects: 8.0.0-RC1 to 8.0.15</p>
+
+  
+</div>
 <h3 id="Fixed_in_Apache_Tomcat_8.0.9">
 <span style="float: right;">24 June 2014</span> Fixed in Apache Tomcat 8.0.9</h3>
 <div class="text">

Modified: tomcat/site/trunk/xdocs/security-6.xml
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-6.xml?rev=1679374&r1=1679373&r2=1679374&view=diff
==============================================================================
--- tomcat/site/trunk/xdocs/security-6.xml (original)
+++ tomcat/site/trunk/xdocs/security-6.xml Thu May 14 14:03:06 2015
@@ -69,6 +69,21 @@
 
     <p>Affects: 6.0.0 to 6.0.43</p>
 
+    <p><strong>Moderate: Security Manager bypass</strong>
+       <cve>CVE-2014-7810</cve></p>
+
+    <p>Malicious web applications could use expression language to bypass the
+       protections of a Security Manager as expressions were evaluated within a
+       privileged code section.</p>
+
+    <p>This was fixed in revisions <revlink rev="1645366">1645366</revlink>
and
+       <revlink rev="1659538">1659538</revlink>.</p>
+
+    <p>This issue was identified by the Tomcat security team on 2 November 2014
+       and made public on 14 May 2015.</p>
+
+    <p>Affects: 6.0.0 to 6.0.43</p>
+
   </section>
 
   <section name="Fixed in Apache Tomcat 6.0.43" rtext="22 November 2014">

Modified: tomcat/site/trunk/xdocs/security-7.xml
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-7.xml?rev=1679374&r1=1679373&r2=1679374&view=diff
==============================================================================
--- tomcat/site/trunk/xdocs/security-7.xml (original)
+++ tomcat/site/trunk/xdocs/security-7.xml Thu May 14 14:03:06 2015
@@ -50,6 +50,31 @@
 
   </section>
 
+  <section name="Fixed in Apache Tomcat 7.0.59" rtext="4 February 2015">
+
+  <p><i>Note: The issue below was fixed in Apache Tomcat 7.0.58 but the
+       release vote for the 7.0.58 release candidate did not pass. Therefore,
+       although users must download 7.0.59 to obtain a version that includes a
+       fix for this issue, versions 7.0.58 is not included in the list of
+       affected versions.</i></p>
+
+    <p><strong>Moderate: Security Manager bypass</strong>
+       <cve>CVE-2014-7810</cve></p>
+
+    <p>Malicious web applications could use expression language to bypass the
+       protections of a Security Manager as expressions were evaluated within a
+       privileged code section.</p>
+
+    <p>This was fixed in revisions <revlink rev="1644018">1644018</revlink>
and
+       <revlink rev="1645642">1645642</revlink>.</p>
+
+    <p>This issue was identified by the Tomcat security team on 2 November 2014
+       and made public on 14 May 2015.</p>
+
+    <p>Affects: 7.0.0 to 7.0.57</p>
+
+  </section>
+
   <section name="Fixed in Apache Tomcat 7.0.55" rtext="27 July 2014">
 
     <p><strong>Important: Request Smuggling</strong>

Modified: tomcat/site/trunk/xdocs/security-8.xml
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-8.xml?rev=1679374&r1=1679373&r2=1679374&view=diff
==============================================================================
--- tomcat/site/trunk/xdocs/security-8.xml (original)
+++ tomcat/site/trunk/xdocs/security-8.xml Thu May 14 14:03:06 2015
@@ -50,6 +50,31 @@
 
   </section>
 
+  <section name="Fixed in Apache Tomcat 8.0.17" rtext="16 January 2015">
+
+  <p><i>Note: The issue below was fixed in Apache Tomcat 8.0.16 but the
+       release vote for the 8.0.16 release candidate did not pass. Therefore,
+       although users must download 8.0.17 to obtain a version that includes a
+       fix for this issue, versions 8.0.16 is not included in the list of
+       affected versions.</i></p>
+
+    <p><strong>Moderate: Security Manager bypass</strong>
+       <cve>CVE-2014-7810</cve></p>
+
+    <p>Malicious web applications could use expression language to bypass the
+       protections of a Security Manager as expressions were evaluated within a
+       privileged code section.</p>
+
+    <p>This was fixed in revisions <revlink rev="1644017">1644017</revlink>
and
+       <revlink rev="1645641">1645641</revlink>.</p>
+
+    <p>This issue was identified by the Tomcat security team on 2 November 2014
+       and made public on 14 May 2015.</p>
+
+    <p>Affects: 8.0.0-RC1 to 8.0.15</p>
+
+  </section>
+
   <section name="Fixed in Apache Tomcat 8.0.9" rtext="24 June 2014">
 
     <p><strong>Important: Request Smuggling</strong>



---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org


Mime
View raw message