CVE-2018-1304: Medium severity Apache Tomcat vulnerability
Apache Tomcat versions 7.0.0 to 7.0.84, 8.0.0.RC1 to 8.0.49 and 8.5.0 to 8.5.27 does not properly handle the URL empty string ("") when used as part of a security constraint definition. This can lead to the security constraint being ignored, leading to unitended exposure of resources.
External References:
https://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.85 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.0.50 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.28
Upstream Bug Report:
https://bz.apache.org/bugzilla/showbug.cgi?id=62067
Upstream Fixes:
Tomcat 7.0.x:
http://svn.apache.org/viewvc?view=rev&rev=1823309
Tomcat 8.0.x:
http://svn.apache.org/viewvc?view=rev&rev=1814827
Tomcat 8.5.x:
http://svn.apache.org/viewvc?view=rev&rev=1823307
Other sources
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 7.0.86 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 8.0.51 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 8.5.28 - Upgrade
Upgrade
maven/org.apache.tomcat.embed:tomcat-embed-coreto a version that resolves this vulnerability.Fixed in 9.0.5 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 7.0.85 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.0.50 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.5.28 - Upgrade
Upgrade
debian/tomcat9to a version that resolves this vulnerability.Fixed in 9.0.43-2~deb11u10Fixed in 9.0.118-0+deb11u1Fixed in 9.0.70-2Fixed in 9.0.95-1Fixed in 9.0.118-1 - Upgrade
Upgrade
Apache Tomcat 7.0.xto a version that resolves this vulnerability.Fixed in 7.0.85 - Upgrade
Upgrade
Apache Tomcat 8.0.xto a version that resolves this vulnerability.Fixed in 8.0.50 - Upgrade
Upgrade
Apache Tomcat 8.5.xto a version that resolves this vulnerability.Fixed in 8.5.28 - Compensating control
Ensure security constraints are not defined with a URL pattern of the empty string (""), since Tomcat 7.0.0 through 7.0.84, 8.0.0.RC1 through 8.0.49, and 8.5.0 through 8.5.27 could ignore such constraints, resulting in unintended exposure of protected resources.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1304?
CVE-2018-1304 is classified as a medium severity vulnerability due to the potential exposure of sensitive resources.
How do I fix CVE-2018-1304?
To fix CVE-2018-1304, upgrade Apache Tomcat to versions 7.0.85, 8.0.50, or 8.5.28 and later.
What are the affected versions in CVE-2018-1304?
CVE-2018-1304 affects Apache Tomcat versions from 7.0.0 to 7.0.84, 8.0.0.RC1 to 8.0.49, and 8.5.0 to 8.5.27.
What type of attack is possible with CVE-2018-1304?
CVE-2018-1304 could allow an attacker to bypass security constraints, leading to unintended resource exposure.
Is CVE-2018-1304 exploitable without authentication?
Yes, CVE-2018-1304 can be exploited without authentication, allowing unauthorized access to sensitive resources.