You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@tomee.apache.org by bu...@apache.org on 2016/04/05 13:39:49 UTC
svn commit: r984797 - in /websites/staging/tomee/trunk: cgi-bin/ content/
content/security/tomee.html
Author: buildbot
Date: Tue Apr 5 11:39:49 2016
New Revision: 984797
Log:
Staging update by buildbot for tomee
Modified:
websites/staging/tomee/trunk/cgi-bin/ (props changed)
websites/staging/tomee/trunk/content/ (props changed)
websites/staging/tomee/trunk/content/security/tomee.html
Propchange: websites/staging/tomee/trunk/cgi-bin/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Tue Apr 5 11:39:49 2016
@@ -1 +1 @@
-1737782
+1737824
Propchange: websites/staging/tomee/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Tue Apr 5 11:39:49 2016
@@ -1 +1 @@
-1737782
+1737824
Modified: websites/staging/tomee/trunk/content/security/tomee.html
==============================================================================
--- websites/staging/tomee/trunk/content/security/tomee.html (original)
+++ websites/staging/tomee/trunk/content/security/tomee.html Tue Apr 5 11:39:49 2016
@@ -172,8 +172,14 @@ that even if fixed in 7.0.0-M2 we recomm
<p>This issue only affects you if you rely on EJBd protocol (proprietary remote EJB protocol). This one one is not activated by default on the 7.x series
but it was on the 1.x ones.</p>
-<p>The related CVE number is <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0779">CVE-2016-0779</a>: the EJBd protocol provided by TomEE can exploit the 0-day vulnerability.
-This has been fixed in commit 58cdbbef9c77ab2b44870f9d606593b49cde76d9.</p>
+<p>The related CVE numbers are:</p>
+
+<ul>
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0779">CVE-2016-0779</a>: The EJBd protocol provided by TomEE can exploit the 0-day vulnerability.</li>
+<li><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8581">CVE-2015-8581</a>: The EjbObjectInputStream class in Apache TomEE allows remote attackers to execute arbitrary commands via a serialized Java stream.</li>
+</ul>
+
+<p>This has been fixed in commit 58cdbbef9c77ab2b44870f9d606593b49cde76d9.</p>
<p>Check <a href="/properties-listing.html">properties configuration</a> and <a href="/ejbd-transport.html">Ejbd transport</a> for more details (tomee.serialization.class.* and tomee.remote.support).</p>