Security Bulletin
Summary
Multiple vulnerabilities in Open Source Apache Tomcat reported by The Apache Software Foundation affect IBM Tivoli Application Dependency Discovery Manager
Vulnerability Details
CVEID: CVE-2017-15706
DESCRIPTION: Apache Tomcat could provide weaker than expected security, caused by the incorrect documentation of the CGI search algorithm used by the CGI Servlet to identify which script to execute. The error resulted in the failure of some scripts to execute as expected and other scripts may have been executed unexpectedly.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/138486 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID: CVE-2017-15698
DESCRIPTION: Apache Tomcat Native Connector could allow a remote attacker to bypass security restrictions, caused by the improper handling of fields longer than 127 bytes when parsing the AIA-Extension field of a client certificate. The parsing error resulted in the OCSP check being omitted and made it possible for client certificates that should have been rejected to be accepted.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/138491 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID: CVE-2018-1305
DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the failure to properly enforce security constraints that are defined by annotations of Servlets in certain cases. An attacker could exploit this vulnerability to bypass security constraints to access restricted resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/139475 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVEID: CVE-2018-1304
DESCRIPTION: Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by the failure to properly enforce security constraint definitions that contain a URL pattern of "" (the empty string) that exactly maps to the context root. An attacker could exploit this vulnerability to bypass security constraints to access restricted resources.
CVSS Base Score: 7.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/139476 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected Products and Versions
TADDM 7.2.2.0 - 7.2.2.5
TADDM 7.3.0.0 (TADDM 7.3.0.1-4 - not affected - using WebSphere Liberty Profile)
Remediation/Fixes
Below are eFixes prepared on top of the latest 7.2.2 FP5 level and 7.3.0.0 (7.3.0.1+ not affected);
| Fix | VRMF | APAR | How to acquire fix |
| efix_taddm73_tomcat7085_201411291020.zip | 7.3.0.0 | None | Download eFix |
| efix_taddm722_tomcat7085_FP520160209.zip | 7.2.2.5 | None | Download eFix |
Please get familiar with eFix readme in etc/<efix_name>_readme.txt
Note that the eFix requires manual deletion of the external/apache-tomcat directory.
Workarounds and Mitigations
The only solution is to apply eFix prepared to specific TADDM version (7.2.2.5 or 7.3.0.0). This fix is only tested for TADDM versions 7.2.2.5 or 7.3.0.0. Though, if applied to the other maintenance levels, it should not lead to any issue, but if it does, consider upgrading to the latest maintenance level to apply this fix.
Get Notified about Future Security Bulletins
References
Change History
23-Apr-18 - Original version published
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
17 June 2018
UID
swg22015795