FIS 2.0 CVE Status

Solution Verified - Updated -

Issue

  • We are on FIS version https://maven.repository.redhat.com/ga/io/fabric8/fabric8-project-bom-camel-spring-boot/2.2.170.redhat-000019/
  • It comes with tomcat version 8.0.36.redhat-24.
  • Security has come up with the following CVE list. Are these fixed in the version we are using ?
  • This will potentially hold up go-live.
https://www.cvedetails.com/cve/CVE-2016-8735/
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports

https://www.cvedetails.com/cve/CVE-2017-12617/
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

https://access.redhat.com/security/cve/cve-2017-5929

Environment

  • Red Hat Fuse
    • FIS 2.0

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In