Author: markt
Date: Thu May 14 14:03:06 2015
New Revision: 1679374
URL: http://svn.apache.org/r1679374
Log:
Add CVE-2014-7810
Modified:
tomcat/site/trunk/docs/security-6.html
tomcat/site/trunk/docs/security-7.html
tomcat/site/trunk/docs/security-8.html
tomcat/site/trunk/xdocs/security-6.xml
tomcat/site/trunk/xdocs/security-7.xml
tomcat/site/trunk/xdocs/security-8.xml
Modified: tomcat/site/trunk/docs/security-6.html
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-6.html?rev=1679374&r1=1679373&r2=1679374&view=diff
==============================================================================
--- tomcat/site/trunk/docs/security-6.html (original)
+++ tomcat/site/trunk/docs/security-6.html Thu May 14 14:03:06 2015
@@ -342,6 +342,28 @@
<p>Affects: 6.0.0 to 6.0.43</p>
+
+<p>
+<strong>Moderate: Security Manager bypass</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7810";
rel="nofollow">CVE-2014-7810</a>
+</p>
+
+
+<p>Malicious web applications could use expression language to bypass the
+ protections of a Security Manager as expressions were evaluated within a
+ privileged code section.</p>
+
+
+<p>This was fixed in revisions <a
href="http://svn.apache.org/viewvc?view=rev&rev=1645366";>1645366</a> and
+ <a
href="http://svn.apache.org/viewvc?view=rev&rev=1659538";>1659538</a>.</p>
+
+
+<p>This issue was identified by the Tomcat security team on 2 November 2014
+ and made public on 14 May 2015.</p>
+
+
+<p>Affects: 6.0.0 to 6.0.43</p>
+
</div>
<h3 id="Fixed_in_Apache_Tomcat_6.0.43">
Modified: tomcat/site/trunk/docs/security-7.html
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-7.html?rev=1679374&r1=1679373&r2=1679374&view=diff
==============================================================================
--- tomcat/site/trunk/docs/security-7.html (original)
+++ tomcat/site/trunk/docs/security-7.html Thu May 14 14:03:06 2015
@@ -203,6 +203,9 @@
<a href="#Apache_Tomcat_7.x_vulnerabilities">Apache Tomcat 7.x
vulnerabilities</a>
</li>
<li>
+<a href="#Fixed_in_Apache_Tomcat_7.0.59">Fixed in Apache Tomcat 7.0.59</a>
+</li>
+<li>
<a href="#Fixed_in_Apache_Tomcat_7.0.55">Fixed in Apache Tomcat 7.0.55</a>
</li>
<li>
@@ -326,6 +329,43 @@
</div>
+<h3 id="Fixed_in_Apache_Tomcat_7.0.59">
+<span style="float: right;">4 February 2015</span> Fixed in Apache Tomcat
7.0.59</h3>
+<div class="text">
+
+
+<p>
+<i>Note: The issue below was fixed in Apache Tomcat 7.0.58 but the
+ release vote for the 7.0.58 release candidate did not pass. Therefore,
+ although users must download 7.0.59 to obtain a version that includes a
+ fix for this issue, versions 7.0.58 is not included in the list of
+ affected versions.</i>
+</p>
+
+
+<p>
+<strong>Moderate: Security Manager bypass</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7810";
rel="nofollow">CVE-2014-7810</a>
+</p>
+
+
+<p>Malicious web applications could use expression language to bypass the
+ protections of a Security Manager as expressions were evaluated within a
+ privileged code section.</p>
+
+
+<p>This was fixed in revisions <a
href="http://svn.apache.org/viewvc?view=rev&rev=1644018";>1644018</a> and
+ <a
href="http://svn.apache.org/viewvc?view=rev&rev=1645642";>1645642</a>.</p>
+
+
+<p>This issue was identified by the Tomcat security team on 2 November 2014
+ and made public on 14 May 2015.</p>
+
+
+<p>Affects: 7.0.0 to 7.0.57</p>
+
+
+</div>
<h3 id="Fixed_in_Apache_Tomcat_7.0.55">
<span style="float: right;">27 July 2014</span> Fixed in Apache Tomcat
7.0.55</h3>
<div class="text">
Modified: tomcat/site/trunk/docs/security-8.html
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-8.html?rev=1679374&r1=1679373&r2=1679374&view=diff
==============================================================================
--- tomcat/site/trunk/docs/security-8.html (original)
+++ tomcat/site/trunk/docs/security-8.html Thu May 14 14:03:06 2015
@@ -203,6 +203,9 @@
<a href="#Apache_Tomcat_8.x_vulnerabilities">Apache Tomcat 8.x
vulnerabilities</a>
</li>
<li>
+<a href="#Fixed_in_Apache_Tomcat_8.0.17">Fixed in Apache Tomcat 8.0.17</a>
+</li>
+<li>
<a href="#Fixed_in_Apache_Tomcat_8.0.9">Fixed in Apache Tomcat 8.0.9</a>
</li>
<li>
@@ -272,6 +275,43 @@
</div>
+<h3 id="Fixed_in_Apache_Tomcat_8.0.17">
+<span style="float: right;">16 January 2015</span> Fixed in Apache Tomcat
8.0.17</h3>
+<div class="text">
+
+
+<p>
+<i>Note: The issue below was fixed in Apache Tomcat 8.0.16 but the
+ release vote for the 8.0.16 release candidate did not pass. Therefore,
+ although users must download 8.0.17 to obtain a version that includes a
+ fix for this issue, versions 8.0.16 is not included in the list of
+ affected versions.</i>
+</p>
+
+
+<p>
+<strong>Moderate: Security Manager bypass</strong>
+ <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7810";
rel="nofollow">CVE-2014-7810</a>
+</p>
+
+
+<p>Malicious web applications could use expression language to bypass the
+ protections of a Security Manager as expressions were evaluated within a
+ privileged code section.</p>
+
+
+<p>This was fixed in revisions <a
href="http://svn.apache.org/viewvc?view=rev&rev=1644017";>1644017</a> and
+ <a
href="http://svn.apache.org/viewvc?view=rev&rev=1645641";>1645641</a>.</p>
+
+
+<p>This issue was identified by the Tomcat security team on 2 November 2014
+ and made public on 14 May 2015.</p>
+
+
+<p>Affects: 8.0.0-RC1 to 8.0.15</p>
+
+
+</div>
<h3 id="Fixed_in_Apache_Tomcat_8.0.9">
<span style="float: right;">24 June 2014</span> Fixed in Apache Tomcat
8.0.9</h3>
<div class="text">
Modified: tomcat/site/trunk/xdocs/security-6.xml
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-6.xml?rev=1679374&r1=1679373&r2=1679374&view=diff
==============================================================================
--- tomcat/site/trunk/xdocs/security-6.xml (original)
+++ tomcat/site/trunk/xdocs/security-6.xml Thu May 14 14:03:06 2015
@@ -69,6 +69,21 @@
<p>Affects: 6.0.0 to 6.0.43</p>
+ <p><strong>Moderate: Security Manager bypass</strong>
+ <cve>CVE-2014-7810</cve></p>
+
+ <p>Malicious web applications could use expression language to bypass the
+ protections of a Security Manager as expressions were evaluated within a
+ privileged code section.</p>
+
+ <p>This was fixed in revisions <revlink rev="1645366">1645366</revlink> and
+ <revlink rev="1659538">1659538</revlink>.</p>
+
+ <p>This issue was identified by the Tomcat security team on 2 November 2014
+ and made public on 14 May 2015.</p>
+
+ <p>Affects: 6.0.0 to 6.0.43</p>
+
</section>
<section name="Fixed in Apache Tomcat 6.0.43" rtext="22 November 2014">
Modified: tomcat/site/trunk/xdocs/security-7.xml
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-7.xml?rev=1679374&r1=1679373&r2=1679374&view=diff
==============================================================================
--- tomcat/site/trunk/xdocs/security-7.xml (original)
+++ tomcat/site/trunk/xdocs/security-7.xml Thu May 14 14:03:06 2015
@@ -50,6 +50,31 @@
</section>
+ <section name="Fixed in Apache Tomcat 7.0.59" rtext="4 February 2015">
+
+ <p><i>Note: The issue below was fixed in Apache Tomcat 7.0.58 but the
+ release vote for the 7.0.58 release candidate did not pass. Therefore,
+ although users must download 7.0.59 to obtain a version that includes a
+ fix for this issue, versions 7.0.58 is not included in the list of
+ affected versions.</i></p>
+
+ <p><strong>Moderate: Security Manager bypass</strong>
+ <cve>CVE-2014-7810</cve></p>
+
+ <p>Malicious web applications could use expression language to bypass the
+ protections of a Security Manager as expressions were evaluated within a
+ privileged code section.</p>
+
+ <p>This was fixed in revisions <revlink rev="1644018">1644018</revlink> and
+ <revlink rev="1645642">1645642</revlink>.</p>
+
+ <p>This issue was identified by the Tomcat security team on 2 November 2014
+ and made public on 14 May 2015.</p>
+
+ <p>Affects: 7.0.0 to 7.0.57</p>
+
+ </section>
+
<section name="Fixed in Apache Tomcat 7.0.55" rtext="27 July 2014">
<p><strong>Important: Request Smuggling</strong>
Modified: tomcat/site/trunk/xdocs/security-8.xml
URL:
http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-8.xml?rev=1679374&r1=1679373&r2=1679374&view=diff
==============================================================================
--- tomcat/site/trunk/xdocs/security-8.xml (original)
+++ tomcat/site/trunk/xdocs/security-8.xml Thu May 14 14:03:06 2015
@@ -50,6 +50,31 @@
</section>
+ <section name="Fixed in Apache Tomcat 8.0.17" rtext="16 January 2015">
+
+ <p><i>Note: The issue below was fixed in Apache Tomcat 8.0.16 but the
+ release vote for the 8.0.16 release candidate did not pass. Therefore,
+ although users must download 8.0.17 to obtain a version that includes a
+ fix for this issue, versions 8.0.16 is not included in the list of
+ affected versions.</i></p>
+
+ <p><strong>Moderate: Security Manager bypass</strong>
+ <cve>CVE-2014-7810</cve></p>
+
+ <p>Malicious web applications could use expression language to bypass the
+ protections of a Security Manager as expressions were evaluated within a
+ privileged code section.</p>
+
+ <p>This was fixed in revisions <revlink rev="1644017">1644017</revlink> and
+ <revlink rev="1645641">1645641</revlink>.</p>
+
+ <p>This issue was identified by the Tomcat security team on 2 November 2014
+ and made public on 14 May 2015.</p>
+
+ <p>Affects: 8.0.0-RC1 to 8.0.15</p>
+
+ </section>
+
<section name="Fixed in Apache Tomcat 8.0.9" rtext="24 June 2014">
<p><strong>Important: Request Smuggling</strong>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
