Bug 778464 (CVE-2012-4387) - VUL-1: CVE-2012-4387: apache-struts: S2-010 and S2-011
Summary: VUL-1: CVE-2012-4387: apache-struts: S2-010 and S2-011
Status: RESOLVED INVALID
Alias: CVE-2012-4387
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Minor
Target Milestone: ---
Assignee: E-mail List
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:NVD:CVE-2012-4386:6.8:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2012-09-03 06:29 UTC by Sebastian Krahmer
Modified: 2019-05-01 15:43 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2012-09-03 06:29:01 UTC 
Via OSS-sec:


Hi,

Apache Struts 2.3.4.1 fixes the vulnerabilities described in S2-010 (CSRF)
and S2-011 (DoS).

Could CVE ids be assigned please?

[1] http://struts.apache.org/2.x/docs/s2-010.html
[2] http://struts.apache.org/2.x/docs/s2-011.html

Sincerely,
--
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net
Comment 1 Sebastian Krahmer 2012-09-03 06:29:57 UTC 
Also via OSS-sec:


On 09/01/2012 11:35 AM, Raphael Geissert wrote:
> Hi,
>
> Apache Struts 2.3.4.1 fixes the vulnerabilities described in S2-010
> (CSRF) and S2-011 (DoS).
>
> Could CVE ids be assigned please?

Yes, confirmed struts 2.3.4.1 was released August 11, 2012.

====

> [1] http://struts.apache.org/2.x/docs/s2-010.html

When using Struts 2 token mechanism for CSRF protection, token check
may be bypassed by misusing known session attributes

Please use CVE-2012-4386 for this issue.

====

> [2] http://struts.apache.org/2.x/docs/s2-011.html

Long request parameter names might significantly promote the
effectiveness of DOS attacks

Please use CVE-2012-4387 for this issue.

These don't appear to affect struts 1.2.x/1.3.x.

- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Comment 2 Swamp Workflow Management 2012-09-03 22:00:21 UTC 
bugbot adjusting priority
Comment 13 Victor Pereira 2014-07-09 12:08:27 UTC 
not affected