https://answers.axonivy.com/questions/2880/is-ivy-affected-by-the-newly-found-apache-tomcat-rce-vulnerabilities-cve-2017-12615-and-cve-2017-12617<p>Two Remote code execution (RCE) security vulnerabilities affecting all versions of Apache Tomcat have been found last week.</p> <p><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615">CVE-2017-12615 (RCE when readonly set to false, affects Tomcat &lt; 7.0.81 on Windows)</a></p> <p><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12617">CVE-2017-12617 (RCE when readonly set to false, affects all Tomcat versions on all Operating systems)</a></p> <p>Is ivy affected by the newly found Apache Tomcat RCE vulnerabilities (CVE-2017-12615 and CVE-2017-12617) ?</p>enMon, 25 Sep 2017 04:13:01 -0400https://answers.axonivy.com/questions/2880/is-ivy-affected-by-the-newly-found-apache-tomcat-rce-vulnerabilities-cve-2017-12615-and-cve-2017-12617/2881<p>To our knowledge gathered by analyzing our source code and by performing security tests ivy is <strong>NOT</strong> affected.</p> <p>Additionally, current available information shows that the vulnerabilities do not affect normal Tomcat installations, but Tomcats that have the <code>readonly</code> param set to <code>false</code> on the default servlet and Tomcats using the WebDAV servlet. Ivy does not have the <code>readonly</code> param set to <code>false</code> and does not use the WebDAV servlet.</p> <p>Also, see information <a href="http://markmail.org/message/rhnbwfcvxk33h42i?q=list:org.apache.tomcat.dev/">here</a> and <a href="https://bz.apache.org/bugzilla/show_bug.cgi?id=61542">here</a>.</p>SupportIvyTeamMon, 25 Sep 2017 04:13:01 -0400https://answers.axonivy.com/questions/2880/is-ivy-affected-by-the-newly-found-apache-tomcat-rce-vulnerabilities-cve-2017-12615-and-cve-2017-12617/2881