RHSA-2008:0877: Important: jbossweb security update

JBoss Web Server (jbossweb) is an enterprise ready web server designed formedium and large applications, is based on Apache Tomcat, and is embeddedinto JBoss Application Server. It provides organizations with a singledeployment platform for JavaServer Pages (JSP) and Java Servlettechnologies, Microsoft® .NET, PHP, and CGI.A traversal vulnerability was discovered when using a RequestDispatcherin combination with a servlet or JSP. A remote attacker could utilize aspecially-crafted request parameter to access protected web resources.(CVE-2008-2370)An additional traversal vulnerability was discovered when the"allowLinking" and "URIencoding" settings were activated. A remote attackercould use a UTF-8-encoded request to extend their privileges and obtainlocal files accessible to the jbossweb process. (CVE-2008-2938)Users of jbossweb should upgrade to this updated package, which containsbackported patches to resolve these issues.