[#GEOS-1792] Security issue demoRequest (web interface)

GeoServer

Security issue demoRequest (web interface)

Created: 07/Mar/08 02:11 PM Updated: 07/Mar/08 02:12 PM

Component/s:

None

Affects Version/s:

1.4.0-M0, 1.5.x, 1.4.0-RC1, 1.4.0-M1, 1.4.0, 1.4.1, 1.5.0-beta1, 1.6.0, 1.4.0-M2, 1.4.0-RC2, 1.5.0-beta2, 1.5.0-RC2, 1.5.0, 1.4.0-RC3, 1.4.0-RC4, 1.4.0-RC5, 1.5.0-RC3, 1.5.0-RC4, 1.5.0-RC1, 1.6.0-alpha2, 1.6.0-beta1, 1.5.1, 1.5.2, 1.6.0-beta2, 1.5.4, 1.6.0-beta4, 1.6.0-RC1, 1.5.3, 1.6.0-beta3, 1.6.0-RC2, 1.6.0-RC3, 1.6.1

Fix Version/s:

1.6.2

Time Tracking:

Not Specified

Description

« Hide

A bug has been found in GeoServer that exposes the parts of the filesystem that are accessible to the servlet container (Tomcat, Jetty, etc.).

All users are strongly encouraged to upgrade to GeoServer 1.6.2a:
http://sourceforge.net/project/showfiles.php?group_id=25086&package_id=129885

(Ignore any version mismatches, as long as the WAR , .bin or .exe you are downloading is named 1.6.2a)

If you cannot upgrade immediately you should disable the demo system. Instructions can be found here:
http://geoserver.org/display/GEOS/Security+issue+-+Disable+demoRequest

All

Comments

Work Log

Change History

Sort Order:

Ascending order - Click to sort in descending order

There are no comments yet on this issue.