CVE-2018-8014
CVE-2018-8014
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Diese Seite zeigt ausgewählte Angaben aus den Quellen. Die vollständige Beschreibung und betroffene Versionen finden Sie in den verlinkten Sicherheitshinweisen.
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
CVSS 9.8 · Kritisch · EPSS 20,9% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: system
Betroffene Produkte und Versionen
apache tomcat
- Softwareversionen
- 9.0.0.M1 to 9.0.8: Betroffen
- 8.5.0 to 8.5.31: Betroffen
- 8.0.0.RC1 to 8.0.52: Betroffen
- 7.0.41 to 7.0.88: Betroffen
Keine Korrektur veröffentlicht
tomcat7 Ubuntu:14.04:LTS
- Softwareversionen
- 7.0.42-1
- 7.0.47-1
- 7.0.50-1
- 7.0.52-1
- 7.0.52-1ubuntu0.1
- 7.0.52-1ubuntu0.3
- 7.0.52-1ubuntu0.6
- 7.0.52-1ubuntu0.7
- 7.0.52-1ubuntu0.8
- 7.0.52-1ubuntu0.9
- 7.0.52-1ubuntu0.10
- 7.0.52-1ubuntu0.11
- 7.0.52-1ubuntu0.13
- Betroffene Versionsbereiche
- ECOSYSTEM: < 7.0.52-1ubuntu0.14
Auf 7.0.52-1ubuntu0.14 aktualisieren
tomcat8 Ubuntu:16.04:LTS
- Softwareversionen
- 8.0.26-1
- 8.0.28-1
- 8.0.30-1
- 8.0.32-1
- 8.0.32-1ubuntu1
- 8.0.32-1ubuntu1.1
- 8.0.32-1ubuntu1.2
- 8.0.32-1ubuntu1.3
- 8.0.32-1ubuntu1.4
- 8.0.32-1ubuntu1.5
- Betroffene Versionsbereiche
- ECOSYSTEM: < 8.0.32-1ubuntu1.6
Auf 8.0.32-1ubuntu1.6 aktualisieren
tomcat7 Ubuntu:Pro:16.04:LTS
- Softwareversionen
- 7.0.64-1
- 7.0.68-1
- 7.0.68-1ubuntu0.1
- 7.0.68-1ubuntu0.3
- 7.0.68-1ubuntu0.4
- 7.0.68-1ubuntu0.4+esm1
- 7.0.68-1ubuntu0.4+esm2
- 7.0.68-1ubuntu0.4+esm3
- 7.0.68-1ubuntu0.4+esm4
- Betroffene Versionsbereiche
- ECOSYSTEM: (−∞, +∞)
Keine Korrektur veröffentlicht
tomcat8 Ubuntu:18.04:LTS
- Softwareversionen
- 8.5.21-1ubuntu1
- 8.5.29-1
- 8.5.30-1
- 8.5.30-1ubuntu1
- Betroffene Versionsbereiche
- ECOSYSTEM: < 8.5.30-1ubuntu1.2
Auf 8.5.30-1ubuntu1.2 aktualisieren
Originalquellen
- http://tomcat.apache.org/security-9.html
- https://access.redhat.com/errata/RHSA-2019:0451
- http://tomcat.apache.org/security-7.html
- https://access.redhat.com/errata/RHSA-2018:2469
- http://www.securitytracker.com/id/1041888
- https://usn.ubuntu.com/3665-1/
- http://tomcat.apache.org/security-8.html
- https://access.redhat.com/errata/RHSA-2018:2470
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://security.netapp.com/advisory/ntap-20181018-0002/
- https://access.redhat.com/errata/RHSA-2019:0450
- https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html
- http://www.securityfocus.com/bid/104203
- http://www.securitytracker.com/id/1040998
- https://access.redhat.com/errata/RHSA-2018:3768
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2018-8014