A vulnerability was discovered in the error page mechanism in Tomcat’s DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page.

Mitigation

If it is necessary to have the DefaultServlet property readonly=false, use a jsp error page, for example Error404.jsp rather than a static html error page. Alternatively do not specify an error-page in the Deployment Descriptor and use a custom ErrorReportValve.

References

bugzilla.redhat.com/show_bug.cgi?id=1459158

tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15

nessus 38

mageia 1

debian 5

openvas 22

amazon 4

debiancve 1

f5 1

archlinux 2

fedora 3

ibm 13

osv 7

myhack58 2