CVE-2018-1305: Security Constraint Bypass in org.apache.tomcat.embed:tomcat-embed-core
Summary
CVE-2018-1305: Apache Tomcat information exposure vulnerability. Affects org.apache.tomcat.embed:tomcat-embed-core across 3 version ranges.
>= 7.0.0, < 7.0.85
>= 8.5.0, < 8.5.28
>= 9.0.0M1, < 9.0.5
Fixed in 7.0.85, 8.5.28 or 9.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.apache.tomcat.embed:tomcat-embed-core is a package in the Maven ecosystem that provides embedded Apache Tomcat functionality. It allows developers to run Tomcat within their applications, enabling them to deploy and manage web applications. This package is widely used in Java-based web development projects.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1305, affects versions 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, and 7.0.0 to 7.0.84 of org.apache.tomcat.embed:tomcat-embed-core. It arises from a flaw in the application of security constraints defined by annotations of Servlets in Apache Tomcat. These security constraints are only applied once a Servlet has been loaded, which means that depending on the order in which Servlets are loaded, some security constraints may not be applied. This could potentially expose resources to unauthorized users.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.0.857.0.85 -
>= 8.5.0, < 8.5.288.5.28 -
>= 9.0.0M1, < 9.0.59.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched versions.
Conclusion
The vulnerability CVE-2018-1305 in org.apache.tomcat.embed:tomcat-embed-core exposes resources to unauthorized users due to the improper application of security constraints. To mitigate this risk, it is crucial to upgrade to the fixed versions and review the security constraints in the application. For more information and assistance, reach out to DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
org.apache.tomcat.embed:tomcat-embed-core is a package in the Maven ecosystem that provides embedded Apache Tomcat functionality for Java-based web development projects.
This vulnerability could allow unauthorized users to access resources that should be restricted, potentially leading to unauthorized data exposure or manipulation.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
No, there are no known workarounds for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.