Zero-friction vulnerability management platform

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

CentOS Update for jakarta-taglibs-standard CESA-2015:1695 centos6

Information

Severity

Severity

High

Family

Family

CentOS Local Security Checks

CVSSv2 Base

CVSSv2 Base

7.5

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Solution Type

Solution Type

Vendor Patch

Created

Created

7 years ago

Modified

Modified

3 years ago

Summary

Check the version of jakarta-taglibs-standard

Insight

Insight

jakarta-taglibs-standard is the Java Standard Tag Library (JSTL). This library is used in conjunction with Tomcat and Java Server Pages (JSP). It was found that the Java Standard Tag Library (JSTL) allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution. (CVE-2015-0254) Note: jakarta-taglibs-standard users may need to take additional steps after applying this update. Detailed instructions on the additional steps can be at the linked references. All jakarta-taglibs-standard users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to the linked article. 5. Bugs fixed: 1198606 - CVE-2015-0254 jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags 6. Package List: Red Hat Enterprise Linux Desktop Optional (v. 6): Source: jakarta-taglibs-standard-1.1.1-11.7.el6_7.src.rpm noarch: jakarta-taglibs-standard-1.1.1-11.7.el6_7.noarch.rpm jakarta-taglibs-standard-javadoc-1.1.1-11.7.el6_7.noarch.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: jakarta-taglibs-standard-1.1.1-11.7.el6_7.src.rpm noarch: jakarta-taglibs-standard-1.1.1-11.7.el6_7.noarch.rpm jakarta-taglibs-standard-javadoc-1.1.1-11.7.el6_7.noarch.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: jakarta-taglibs-standard-1.1.1-11.7.el6_7.src.rpm noarch: jakarta-taglibs-standard-1.1.1-11.7.el6_7.noarch.rpm jakarta-taglibs-standard-javadoc-1.1.1-11.7.el6_7.noarch.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: jakarta-taglibs-standard-1.1.1-11.7.el6_7.src.rpm noarch: jakarta-taglibs-standard-1.1.1-11.7.el6_7.noarch.rpm jakarta-taglibs-standard-javadoc-1.1.1-11.7.el6_7.noarch.rpm Red Hat Enterprise Linux Client Optional (v. 7): Source: jakarta-taglibs-standard-1.1.2-14.el7_1.src.rpm noarch: jakarta-taglibs-standard-1.1.2-14.el7_1.noarch.rpm jakarta-taglibs-standard-javadoc-1.1.2-14.el7_1.noarch.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): Source: jakarta-taglibs-standard-1.1.2-14.el7_1.src.rpm noarc ... Description truncated, please see the referenced URL(s) for more information.

Affected Software

Affected Software

jakarta-taglibs-standard on CentOS 6

Detection Method

Detection Method

Checks if a vulnerable version is present on the target host.

Solution

Solution

Please install the updated packages.

Common Vulnerabilities and Exposures (CVE)