UBUNTU-CVE-2018-8014

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2018-8014
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-8014.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2018-8014
Related
Published
2018-05-16T00:00:00Z
Modified
2018-05-16T00:00:00Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

References

Affected packages

Ubuntu:14.04:LTS / tomcat7

Package

Name
tomcat7
Purl
pkg:deb/ubuntu/tomcat7@7.0.52-1ubuntu0.14?arch=src?distro=trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.0.52-1ubuntu0.14

Affected versions

7.*

7.0.42-1
7.0.47-1
7.0.50-1
7.0.52-1
7.0.52-1ubuntu0.1
7.0.52-1ubuntu0.3
7.0.52-1ubuntu0.6
7.0.52-1ubuntu0.7
7.0.52-1ubuntu0.8
7.0.52-1ubuntu0.9
7.0.52-1ubuntu0.10
7.0.52-1ubuntu0.11
7.0.52-1ubuntu0.13

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "tomcat7-examples": "7.0.52-1ubuntu0.14",
            "tomcat7-admin": "7.0.52-1ubuntu0.14",
            "tomcat7-user": "7.0.52-1ubuntu0.14",
            "libservlet3.0-java": "7.0.52-1ubuntu0.14",
            "libservlet3.0-java-doc": "7.0.52-1ubuntu0.14",
            "libtomcat7-java": "7.0.52-1ubuntu0.14",
            "tomcat7-docs": "7.0.52-1ubuntu0.14",
            "tomcat7": "7.0.52-1ubuntu0.14",
            "tomcat7-common": "7.0.52-1ubuntu0.14"
        }
    ]
}

Ubuntu:16.04:LTS / tomcat8

Package

Name
tomcat8
Purl
pkg:deb/ubuntu/tomcat8@8.0.32-1ubuntu1.6?arch=src?distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.0.32-1ubuntu1.6

Affected versions

8.*

8.0.26-1
8.0.28-1
8.0.30-1
8.0.32-1
8.0.32-1ubuntu1
8.0.32-1ubuntu1.1
8.0.32-1ubuntu1.2
8.0.32-1ubuntu1.3
8.0.32-1ubuntu1.4
8.0.32-1ubuntu1.5

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "tomcat8-common": "8.0.32-1ubuntu1.6",
            "tomcat8-admin": "8.0.32-1ubuntu1.6",
            "tomcat8-user": "8.0.32-1ubuntu1.6",
            "libtomcat8-java": "8.0.32-1ubuntu1.6",
            "tomcat8": "8.0.32-1ubuntu1.6",
            "tomcat8-examples": "8.0.32-1ubuntu1.6",
            "libservlet3.1-java-doc": "8.0.32-1ubuntu1.6",
            "libservlet3.1-java": "8.0.32-1ubuntu1.6",
            "tomcat8-docs": "8.0.32-1ubuntu1.6"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / tomcat7

Package

Name
tomcat7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.0.64-1
7.0.68-1
7.0.68-1ubuntu0.1
7.0.68-1ubuntu0.3
7.0.68-1ubuntu0.4
7.0.68-1ubuntu0.4+esm1
7.0.68-1ubuntu0.4+esm2

Ecosystem specific 

{
    "ubuntu_priority": "low"
}

Ubuntu:18.04:LTS / tomcat8

Package

Name
tomcat8
Purl
pkg:deb/ubuntu/tomcat8@8.5.30-1ubuntu1.2?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.5.30-1ubuntu1.2

Affected versions

8.*

8.5.21-1ubuntu1
8.5.29-1
8.5.30-1
8.5.30-1ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "tomcat8-common": "8.5.30-1ubuntu1.2",
            "tomcat8-admin": "8.5.30-1ubuntu1.2",
            "tomcat8-user": "8.5.30-1ubuntu1.2",
            "libtomcat8-java": "8.5.30-1ubuntu1.2",
            "tomcat8": "8.5.30-1ubuntu1.2",
            "tomcat8-examples": "8.5.30-1ubuntu1.2",
            "libservlet3.1-java-doc": "8.5.30-1ubuntu1.2",
            "libservlet3.1-java": "8.5.30-1ubuntu1.2",
            "libtomcat8-embed-java": "8.5.30-1ubuntu1.2",
            "tomcat8-docs": "8.5.30-1ubuntu1.2"
        }
    ]
}