Red Hat Security AdvisoryRHSA-2015:1052
thermostat1 security, bug fix, and enhancement update
Released 2015-06-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) thermostat1-2.0-60.9.el6, thermostat1-apache-commons-fileupload-1.3-60.7.el6, thermostat1-apache-commons-fileupload-javadoc-1.3-60.7.el6 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) thermostat1-2.0-70.9.el7, thermostat1-apache-commons-fileupload-1.3-70.3.el7, thermostat1-apache-commons-fileupload-javadoc-1.3-70.3.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5) thermostat1-2.0-60.9.el6, thermostat1-apache-commons-fileupload-1.3-60.7.el6, thermostat1-apache-commons-fileupload-javadoc-1.3-60.7.el6 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) thermostat1-2.0-60.9.el6, thermostat1-apache-commons-fileupload-1.3-60.7.el6, thermostat1-apache-commons-fileupload-javadoc-1.3-60.7.el6 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) thermostat1-2.0-60.9.el6, thermostat1-apache-commons-fileupload-1.3-60.7.el6, thermostat1-apache-commons-fileupload-javadoc-1.3-60.7.el6 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) thermostat1-2.0-70.9.el7, thermostat1-apache-commons-fileupload-1.3-70.3.el7, thermostat1-apache-commons-fileupload-javadoc-1.3-70.3.el7 +14
Fixes 1 record
Priority LOW 12
Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local users to obtain user credentials by reading the file.
CVSS 2.0LOW 2.1· Local · No auth · Interaction — · EPSS 0.00507 · Published 2015-06-08 · Partial fix CWE-200
