[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2024-06-28 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #12 from rydan --- https://gogoanimex.me GogoAnime -- You are receiving this mail because: You are the assignee for the bug. - To unsubscribe, e-mail: dev-uns

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2024-06-28 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #12 from rydan --- https://animelover1.statuspage.io -- You are receiving this mail because: You are the assignee for the bug. - To unsubscribe, e-mail: dev-u

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2024-06-27 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 Chuck Caldarale changed: What|Removed |Added URL|https://forum.czaswojny.int | |eria.pl/index.ph

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2024-06-27 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 jhon005 changed: What|Removed |Added URL|https://animex2.statuspage. |https://forum.czaswojny.int

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2024-06-27 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 jhon005 changed: What|Removed |Added URL||https://animex2.statuspage.

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2024-06-27 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #12 from jhon005 --- https://www.atoallinks.com/2022/how-does-gogoanime-stand-apart-from-different-sites/ https://www.addonface.com/read-blog/8286_gogoanime-features-and-things-to-be-aware-of-gogoanime.html https://www.onfeetnation

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2024-06-27 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 Chuck Caldarale changed: What|Removed |Added URL|https://forum.czaswojny.int | |eria.pl/index.ph

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2024-06-27 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 user1000 <2305g...@navalcadets.com> changed: What|Removed |Added URL||https://forum.czas

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2024-06-26 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 ryooodan changed: What|Removed |Added CC|guillermo.gran...@gmail.com | -- You are receiving this mail because: Y

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2024-06-04 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #14 from ryodan --- SHUUMATSU NO HAREM Type: Winter 2022 Anime Plot Summary: The Man-Killer Virus: a lethal disease that has eradicated 99.9% of the world's male population. Mizuhara Reito has been in cryogenic sleep for the past f

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2024-06-04 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #13 from ryodan --- SASAYAKU YOU NI KOI WO UTAU Type: Spring 2024 Anime Plot Summary: Yori Asanagi is a mature girl in many ways but is still pure when it comes to romance. That sentiment is proven when an underclassman, Himari Kin

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2024-06-04 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #12 from ryodan --- https://bz.apache.org/bugzilla/show_bug.cgi?id=57665 -- You are receiving this mail because: You are the assignee for the bug. - To unsubscrib

Re: [Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2020-01-17 Thread Mark Thomas
On 17/01/2020 14:25, Christopher Schultz wrote: > Mark, > > On 1/16/20 8:11 AM, Mark Thomas wrote: >> On 16/01/2020 12:00, bugzi...@apache.org wrote: >>> https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 >>> >>> --- Comment #13 from Sam --- > >> This idiot has been blocked from BZ for spam an

Re: [Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2020-01-17 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 1/16/20 8:11 AM, Mark Thomas wrote: > On 16/01/2020 12:00, bugzi...@apache.org wrote: >> https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 >> >> --- Comment #13 from Sam --- > > This idiot has been blocked from BZ for spam and the spa

Re: [Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2020-01-16 Thread Mark Thomas
On 16/01/2020 12:00, bugzi...@apache.org wrote: > https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 > > --- Comment #13 from Sam --- This idiot has been blocked from BZ for spam and the spam comment deleted. Mark - To unsub

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2020-01-16 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #13 from Sam --- Hello Mark, is this issue fixed? Best regards, Sam. https://getpeople.io -- You are receiving this mail because: You are the assignee for the bug. -

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2019-10-18 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #14 from Mike Smith --- Hello Mark, does this issue fixed already? Or any source? Thanks Mike S. http://www.insolvencyhelpline.co.uk/"; -- You are receiving this mail because: You are the assignee for the bug. ---

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2019-05-29 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 xing changed: What|Removed |Added Component|Catalina|Catalina Version|9.0.0.M22

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2018-09-14 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 ann chriss changed: What|Removed |Added OS||All --- Comment #13 from ann chriss ---

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2018-07-16 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 cailei changed: What|Removed |Added Component|Servlet & JSP API |Catalina Version|7.0.81

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2018-06-14 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #12 from Castro B --- Hello Mark, does this issue fixed already? Or any source? Thanks Castro B. http://buywebtrafficexperts.com/"; -- You are receiving this mail because: You are the assignee for the bug. ---

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2017-09-22 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 Mark Thomas changed: What|Removed |Added Status|NEW |RESOLVED Resolution|---

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2017-09-22 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #10 from Peter Stöckli --- Created attachment 35361 --> https://bz.apache.org/bugzilla/attachment.cgi?id=35361&action=edit proposal to improve doc of the readonly flag First of all: your work is greatly appreciated! And I didn't

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2017-09-22 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #9 from Mark Thomas --- Indeed. Lots of folks run Tomcat with WebDAV on internal sites. Hard-coding readonly to true is simply not an option. Regarding better documentation, patches welcome. -- You are receiving this mail because

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2017-09-22 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #8 from Remy Maucherat --- (In reply to Peter Stöckli from comment #7) > Isn't the mere existence of the readonly parameter also part of the problem? > > https://tomcat.apache.org/tomcat-7.0-doc/default-servlet.html > It is current

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2017-09-22 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #7 from Peter Stöckli --- Isn't the mere existence of the readonly parameter also part of the problem? https://tomcat.apache.org/tomcat-7.0-doc/default-servlet.html It is currently documented as "Is this context "read only", so HTT

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2017-09-20 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 Guillermo Grandes changed: What|Removed |Added CC||guillermo.gran...@gmail.com -- Yo

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2017-09-20 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #6 from Mark Thomas --- Nope. That will fail for directories where the trailing '/' is provided since it will have been removed from the absolute and canonical paths. -- You are receiving this mail because: You are the assignee fo

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2017-09-20 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #5 from Mark Thomas --- Maybe a better check would be that, given the path will already have been normalised, if the the absolute path ends with the given name. -- You are receiving this mail because: You are the assignee for the

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2017-09-20 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #4 from Remy Maucherat --- Well, every time there's surprising normalization, it causes security issues so it's a big API mistake :) The normalization of the input path should only happen for getCanonicalPath, that's the whole point

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2017-09-20 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 --- Comment #3 from Mark Thomas --- The File API certainly isn't helping. When a file named '/test.jsp' exists '/test.jsp/' -> '/test.jsp' is surprising. Less so when it doesn't exist because it could be referring to a directory and both forms

[Bug 61542] Apache Tomcat Remote Code Execution via JSP Upload bypass

2017-09-20 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=61542 Remy Maucherat changed: What|Removed |Added Summary|none|Apache Tomcat Remote Code