CVE-2013-4590

Impact:
Low
Public Date:
2014-02-25
CWE:
CWE-611
Bugzilla:
1069911: CVE-2013-4590 tomcat: information disclosure via XXE when running untrusted web applications
It was found that several application-provided XML files, such as web.xml, content.xml, *.tld, *.tagx, and *.jspx, resolved external entities, permitting XML External Entity (XXE) attacks. An attacker able to deploy malicious applications to Tomcat could use this flaw to circumvent security restrictions set by the JSM, and gain access to sensitive information on the system. Note that this flaw only affected deployments in which Tomcat is running applications from untrusted sources, such as in a shared hosting environment.

Find out more about CVE-2013-4590 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

This issue did not affect JBoss Web, as shipped with various Red Hat JBoss products.

This issue does affect Tomcat 5 as shipped by Red Hat Enterprise Linux 5. The risks in breaking compatibility associated with fixing this flaw outweigh the benefits of the fix, therefore Red Hat does not plan to fix this flaw in Red Hat Enterprise Linux 5. Additionally, note that Red Hat Enterprise Linux 5 is currently in reduced support phase, receiving only Critical security updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/site/support/policy/updates/errata#Production_3_Phase

Red Hat Enterprise Linux 5:
This vulnerability has been rated as having a security impact of Low. After evaluation and in accordance with the criteria noted in the product support life cycle, there are no plans to address this issue in an upcoming release. Please contact Red Hat Support for further information.

Red Hat JBoss EWS 1:
This vulnerability has been rated as having a security impact of Low. After evaluation and in accordance with the criteria noted in the product support life cycle, there are no plans to address this issue in an upcoming release. Please contact Red Hat Support for further information.

CVSS v2 metrics

Base Score 1.2
Base Metrics AV:L/AC:H/Au:N/C:P/I:N/A:N
Access Vector Local
Access Complexity High
Authentication None
Confidentiality Impact Partial
Integrity Impact None
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server RHSA-2014:1087 2014-08-21
Red Hat JBoss Web Server 2.1 RHSA-2014:1086 2014-08-21
Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server RHSA-2014:1088 2014-08-21
Red Hat Enterprise Linux 6 (tomcat6) RHSA-2014:1038 2014-08-11

Affected Packages State

Platform Package State
Red Hat JBoss Portal Platform 6 jbossweb Not affected
Red Hat JBoss Operations Network 3 jbossweb Not affected
Red Hat JBoss Fuse Service Works 6 jbossweb Not affected
Red Hat JBoss EWS 1 tomcat6 Will not fix
Red Hat JBoss EWS 1 tomcat5 Will not fix
Red Hat JBoss EAP 6 jbossweb Not affected
Red Hat JBoss EAP 5 jbossweb Not affected
Red Hat JBoss Data Virtualization 6 jbossweb Not affected
Red Hat JBoss Data Grid 6 jbossweb Not affected
Red Hat JBoss BRMS 6 jbossweb Not affected
Red Hat JBoss BPMS 6 jbossweb Not affected
Red Hat Enterprise Linux 7 tomcat Not affected
Red Hat Enterprise Linux 5 tomcat5 Will not fix
Unless explicitly stated as not affected, all previous versions of packages in any minor update stream of a product listed here should be assumed vulnerable, although may not have been subject to full analysis.
Last Modified