| Revision Date: | 2018-03-12 | Version: | 1 | | Title: | CVE-2018-1323 on Ubuntu 16.04 LTS (xenial) - medium. | | Description: | The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.
| | Family: | unix | Class: | vulnerability | | Status: | | Reference(s): | CVE-2018-1323
| | Platform(s): | Ubuntu 16.04 LTS
| Product(s): | | | Definition Synopsis | | Ubuntu 16.04 LTS (xenial) is installed. AND Package Information
NOT libservlet3.1-java package in xenial, while related to the CVE in some way, is not affected (note: 'code not present').
OR NOT libtomcat8-java package in xenial, while related to the CVE in some way, is not affected (note: 'code not present').
OR NOT tomcat8 package in xenial, while related to the CVE in some way, is not affected (note: 'code not present').
OR NOT tomcat8-admin package in xenial, while related to the CVE in some way, is not affected (note: 'code not present').
OR NOT tomcat8-common package in xenial, while related to the CVE in some way, is not affected (note: 'code not present').
OR NOT tomcat8-examples package in xenial, while related to the CVE in some way, is not affected (note: 'code not present').
OR NOT tomcat8-user package in xenial, while related to the CVE in some way, is not affected (note: 'code not present').
|
|