UBUNTU-CVE-2018-1304

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2018-1304

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-1304.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2018-1304

Related

Published

2018-02-28T00:00:00Z

Modified

2024-10-15T14:06:29Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.

References

Affected packages

Ubuntu:14.04:LTS / tomcat7

Package

Name: tomcat7
Purl: pkg:deb/ubuntu/tomcat7?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.0.52-1ubuntu0.14

Affected versions

7.*

7.0.42-1

7.0.47-1

7.0.50-1

7.0.52-1

7.0.52-1ubuntu0.1

7.0.52-1ubuntu0.3

7.0.52-1ubuntu0.6

7.0.52-1ubuntu0.7

7.0.52-1ubuntu0.8

7.0.52-1ubuntu0.9

7.0.52-1ubuntu0.10

7.0.52-1ubuntu0.11

7.0.52-1ubuntu0.13

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "7.0.52-1ubuntu0.14",
            "binary_name": "libservlet3.0-java"
        },
        {
            "binary_version": "7.0.52-1ubuntu0.14",
            "binary_name": "libservlet3.0-java-doc"
        },
        {
            "binary_version": "7.0.52-1ubuntu0.14",
            "binary_name": "libtomcat7-java"
        },
        {
            "binary_version": "7.0.52-1ubuntu0.14",
            "binary_name": "tomcat7"
        },
        {
            "binary_version": "7.0.52-1ubuntu0.14",
            "binary_name": "tomcat7-admin"
        },
        {
            "binary_version": "7.0.52-1ubuntu0.14",
            "binary_name": "tomcat7-common"
        },
        {
            "binary_version": "7.0.52-1ubuntu0.14",
            "binary_name": "tomcat7-docs"
        },
        {
            "binary_version": "7.0.52-1ubuntu0.14",
            "binary_name": "tomcat7-examples"
        },
        {
            "binary_version": "7.0.52-1ubuntu0.14",
            "binary_name": "tomcat7-user"
        }
    ]
}

Ubuntu:16.04:LTS / tomcat8

Package

Name: tomcat8
Purl: pkg:deb/ubuntu/tomcat8?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.0.32-1ubuntu1.6

Affected versions

8.*

8.0.26-1

8.0.28-1

8.0.30-1

8.0.32-1

8.0.32-1ubuntu1

8.0.32-1ubuntu1.1

8.0.32-1ubuntu1.2

8.0.32-1ubuntu1.3

8.0.32-1ubuntu1.4

8.0.32-1ubuntu1.5

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "8.0.32-1ubuntu1.6",
            "binary_name": "libservlet3.1-java"
        },
        {
            "binary_version": "8.0.32-1ubuntu1.6",
            "binary_name": "libservlet3.1-java-doc"
        },
        {
            "binary_version": "8.0.32-1ubuntu1.6",
            "binary_name": "libtomcat8-java"
        },
        {
            "binary_version": "8.0.32-1ubuntu1.6",
            "binary_name": "tomcat8"
        },
        {
            "binary_version": "8.0.32-1ubuntu1.6",
            "binary_name": "tomcat8-admin"
        },
        {
            "binary_version": "8.0.32-1ubuntu1.6",
            "binary_name": "tomcat8-common"
        },
        {
            "binary_version": "8.0.32-1ubuntu1.6",
            "binary_name": "tomcat8-docs"
        },
        {
            "binary_version": "8.0.32-1ubuntu1.6",
            "binary_name": "tomcat8-examples"
        },
        {
            "binary_version": "8.0.32-1ubuntu1.6",
            "binary_name": "tomcat8-user"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / tomcat7

Package

Name: tomcat7
Purl: pkg:deb/ubuntu/tomcat7?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.0.64-1

7.0.68-1

7.0.68-1ubuntu0.1

7.0.68-1ubuntu0.3

7.0.68-1ubuntu0.4

7.0.68-1ubuntu0.4+esm1

7.0.68-1ubuntu0.4+esm2

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:18.04:LTS / tomcat8

Package

Name: tomcat8
Purl: pkg:deb/ubuntu/tomcat8?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.5.30-1ubuntu1

Affected versions

8.*

8.5.21-1ubuntu1

8.5.29-1

8.5.30-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "8.5.30-1ubuntu1",
            "binary_name": "libservlet3.1-java"
        },
        {
            "binary_version": "8.5.30-1ubuntu1",
            "binary_name": "libservlet3.1-java-doc"
        },
        {
            "binary_version": "8.5.30-1ubuntu1",
            "binary_name": "libtomcat8-embed-java"
        },
        {
            "binary_version": "8.5.30-1ubuntu1",
            "binary_name": "libtomcat8-java"
        },
        {
            "binary_version": "8.5.30-1ubuntu1",
            "binary_name": "tomcat8"
        },
        {
            "binary_version": "8.5.30-1ubuntu1",
            "binary_name": "tomcat8-admin"
        },
        {
            "binary_version": "8.5.30-1ubuntu1",
            "binary_name": "tomcat8-common"
        },
        {
            "binary_version": "8.5.30-1ubuntu1",
            "binary_name": "tomcat8-docs"
        },
        {
            "binary_version": "8.5.30-1ubuntu1",
            "binary_name": "tomcat8-examples"
        },
        {
            "binary_version": "8.5.30-1ubuntu1",
            "binary_name": "tomcat8-user"
        }
    ]
}