REDHAT-BUG-1713275: XSS
First published: Thu May 23 2019(Updated: )
The SSI printenv command echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website. Reference: <a href="http://tomcat.apache.org/security-9.html">http://tomcat.apache.org/security-9.html</a> Upstream commit: <a href="https://github.com/apache/tomcat/commit/15fcd16">https://github.com/apache/tomcat/commit/15fcd16</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tomcat |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://tomcat.apache.org/security-9.html
- https://github.com/apache/tomcat/commit/15fcd16
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1713279
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1713280
- https://access.redhat.com/support/policy/updates/jboss_notes
- https://access.redhat.com/errata/RHSA-2019:3931
- https://access.redhat.com/errata/RHSA-2019:3929
- https://access.redhat.com/security/cve/cve-2019-0221
- https://access.redhat.com/errata/RHSA-2020:0860
- https://access.redhat.com/errata/RHSA-2020:0861
- https://bugzilla.redhat.com/show_bug.cgi?id=1713275
Frequently Asked Questions
What is the severity of REDHAT-BUG-1713275?
The severity of REDHAT-BUG-1713275 is considered low since the SSI printenv command is disabled by default and primarily used for debugging.
How do I fix REDHAT-BUG-1713275?
To fix REDHAT-BUG-1713275, ensure that the SSI printenv command is not enabled in your Apache Tomcat configuration.
What type of vulnerability is REDHAT-BUG-1713275?
REDHAT-BUG-1713275 is an XSS (Cross-Site Scripting) vulnerability due to the printenv command echoing user input without escaping.
Is REDHAT-BUG-1713275 likely to affect production systems?
REDHAT-BUG-1713275 is unlikely to affect production systems because the vulnerable SSI printenv command is disabled by default.
Which version of Apache Tomcat is affected by REDHAT-BUG-1713275?
All versions of Apache Tomcat that support the SSI printenv command could potentially be affected by REDHAT-BUG-1713275 if this command is enabled.
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-0221
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/tomcat