Bug 76917 - www-servers/tomcat: XSS issue
Bug#: 76917 Product:  Gentoo Security Version: unspecified Platform: All
OS/Version: All Status: RESOLVED Severity: minor Priority: P2
Resolution: FIXED Assigned To: security@gentoo.org Reported By: jaervosz@gentoo.org
Component: Vulnerabilities
URL:  http://www.oliverkarow.de/research/jakarta556_xss.txt
Summary: www-servers/tomcat: XSS issue
Keywords:  
Status Whiteboard: C4 [noglsa]
Opened: 2005-01-06 09:42 0000
Description:   Opened: 2005-01-06 09:42 0000 
I'm not sure wether this affects our specific Linux versions but filing a bug
to be sure.

------- Comment #1 From Thierry Carrez (RETIRED) 2005-01-07 05:37:05 0000 ------- 
java team, can you confirm ?

------- Comment #2 From Stefan Cornelius (RETIRED) 2005-01-17 06:52:16 0000 ------- 
I can confirm that it works with 5.5.6-alpha1 (not in portage yet) and with the
tomcat-5.0.27-r4 ebuild (latest stable in portage), after adding the "manager"
role to the "tomcat" user in  $CATALINA_HOME/conf/tomcat-users.xml

I can't say if the patch works because I failed to apply it, though this is
probably my fault.

------- Comment #3 From Thierry Carrez (RETIRED) 2005-01-17 07:33:06 0000 ------- 
Thanks Stefan for verifying.

Java team, please test and patch ebuild with provided patch : 
http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg66978.html

This is really small (XSS needing authentication) so no GLSA needed.

------- Comment #4 From Thierry Carrez (RETIRED) 2005-01-25 08:13:41 0000 ------- 
It's small but should nevertheless be fixed...

------- Comment #5 From Jochen Maes (RETIRED) 2005-02-04 06:47:10 0000 ------- 
trying to fix the bugger

------- Comment #6 From Jochen Maes (RETIRED) 2005-02-04 06:55:00 0000 ------- 
patch fixed gentoo and committed, 

will be on mirrors soon.

bumped to servletapi-2.4-r1

------- Comment #7 From Thierry Carrez (RETIRED) 2005-02-04 07:36:03 0000 ------- 
ppc64: please test and mark servletapi-2.4-r1 stable

------- Comment #8 From Markus Rothe 2005-02-06 01:11:50 0000 ------- 
stable on ppc64

------- Comment #9 From Thierry Carrez (RETIRED) 2005-02-06 09:11:10 0000 ------- 
Closed without GLSA