Bug 486752 (CVE-2013-4310)

Summary:	dev-java/struts: Multiple vulnerabilities (CVE-2013-{4310,4316})
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	java
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=405931
Whiteboard:	B4 [noglsa]
Package list:		Runtime testing required:	---
Bug Depends on:	487280
Bug Blocks:

Description GLSAMaker/CVETool Bot gentoo-dev

2013-10-02 03:47:18 UTC

CVE-2013-4316 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4316):
  Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by
  default, which has unknown impact and attack vectors.

CVE-2013-4310 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4310):
  Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass
  access controls via a crafted action: prefix.

Comment 1 Tom Wijsman (TomWij) (RETIRED) gentoo-dev

2013-10-02 23:09:33 UTC

+  02 Oct 2013; Tom Wijsman <TomWij@gentoo.org>
+  +files/struts-2.3.15.2-build.xml-apps-package.patch,
+  +files/struts-2.3.15.2-build.xml-classpath.patch,
+  +files/struts-2.3.15.2-build.xml-manifest.patch,
+  +files/struts-2.3.15.2-build.xml-remove-apps-portlet.patch,
+  +files/struts-2.3.15.2-build.xml-remove-core-and-plugins.patch,
+  +struts-2.3.15.2.ebuild:
+  Version bump to 2.3.15.2; for bug #152352, bug #237146, bug #405931 and bug
+  #486752.

Looks like we are going to need some KEYWORDREQ and STABLEREQ bugs; since it is late and have worked half a day on is, I'll look into that tomorrow. If you want to file them before that, feel free to go ahead.

Comment 2 Patrice Clement gentoo-dev

2016-02-07 11:10:08 UTC

This package has been removed, along with all the struts related ebuilds. See bug 540888.

Comment 3 Mikle Kolyada (RETIRED) archtester

2016-02-07 11:20:40 UTC

Should we produce removal GLSA? 

vote: No

Comment 4 Kristian Fiskerstrand (RETIRED) gentoo-dev

2016-02-08 20:11:32 UTC

(In reply to Mikle Kolyada from comment #3)
> Should we produce removal GLSA? 
> 
> vote: No

GLSA Vote: No