SB2018032308 - Amazon Linux AMI update for tomcat7, tomcat8
Published: March 23, 2018
Security Bulletin ID
SB2018032308
Severity
Low
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Security restrictions bypass (CVE-ID: CVE-2018-1304)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The weakness exists due to the URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled when used as part of a security constraint definition. A remote attacker can supply a specially crafted URL, bypass security restrictions and gain unauthorised access to web application resources.
2) Security restrictions bypass (CVE-ID: CVE-2018-1305)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The weakness exists due to security constraints defined by annotations of Servlets are only applied once a Servlet had been loaded. A remote attacker can supply a specially crafted URL pattern and any URLs below that point, bypass security restrictions and gain unauthorised access to arbitrary resources.
Remediation
Install update from vendor's website.