tomcat6: CVE-2014-7810: Security Manager bypass by expression language

Debian Bug report logs - #787010
tomcat6: CVE-2014-7810: Security Manager bypass by expression language

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Santiago Ruano Rincón <santiagorr@riseup.net>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Cc: Debian LTS <debian-lts@lists.debian.org>

Subject: tomcat6: CVE-2014-7810: Security Manager bypass by expression language

Date: Wed, 27 May 2015 20:03:02 +0200

[Message part 1 (text/plain, inline)]

Source: tomcat6
Version: 6.0.41-2+squeeze6
Severity: normal
Tags: security patch upstream fixed-upstream

Dear Debian Java maintainers,

The Tomcat security team has identified a security issue [cve] that
allows malicious web applications to bypass the Security Manager, by the
use of expression language. The code related to this vulnerability is
present in squeeze and wheezy.

I have prepared the attached patches for squeeze, based on [fix].

[cve] https://security-tracker.debian.org/tracker/CVE-2014-7810
[fix] http://svn.apache.org/viewvc?view=revision&revision=1645366
      http://svn.apache.org/viewvc?view=revision&revision=1659538

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

Please adjust the affected versions in the BTS as needed.

Cheers!

Santiago

P.S. This is part of my first security bug reports against tomcat.
Please let me know how can I improve them.

[CVE-2014-7810-1.patch (text/x-diff, attachment)]

[CVE-2014-7810-2.patch (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.