FIS 2.0 CVE Status
Issue
- We are on FIS version https://maven.repository.redhat.com/ga/io/fabric8/fabric8-project-bom-camel-spring-boot/2.2.170.redhat-000019/
- It comes with tomcat version 8.0.36.redhat-24.
- Security has come up with the following CVE list. Are these fixed in the version we are using ?
- This will potentially hold up go-live.
https://www.cvedetails.com/cve/CVE-2016-8735/
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports
https://www.cvedetails.com/cve/CVE-2017-12617/
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
https://access.redhat.com/security/cve/cve-2017-5929
Environment
- Red Hat Fuse
- FIS 2.0
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.