You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Mark Thomas <ma...@apache.org> on 2018/05/16 14:58:28 UTC
[SECURITY] CVE-2018-8014 Insecure defaults for CORS filter
CVE-2018-8014 Insecure defaults for CORS filter
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.8
Apache Tomcat 8.5.0 to 8.5.31
Apache Tomcat 8.0.0.RC1 to 8.0.52
Apache Tomcat 7.0.41 to 7.0.88
Description:
The defaults settings for the CORS filter are insecure and enable
'supportsCredentials' for all origins.
It is expected that users of the CORS filter will have configured it
appropriately for their environment rather than using it in the default
configuration. Therefore, it is expected that most users will not be
impacted by this issue.
Mitigation:
Users of the affected versions should apply one of the following
mitigations.
- Configure the filter appropriately for your environment
Secure defaults will be provided in the following versions:
- Apache Tomcat 9.0.9 or later when released
- Apache Tomcat 8.5.32 or later when released
- Apache Tomcat 8.0.53 or later when released
- Apache Tomcat 7.0.89 or later when released
History:
2018-05-15 Original advisory
References:
[1] http://tomcat.apache.org/security-9.html
[2] http://tomcat.apache.org/security-8.html
[3] http://tomcat.apache.org/security-7.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org