This document describes the support position of Sustaining Engineering relative to a Trellix application.

Overview
This document addresses concerns about ePO and the Tomcat vulnerabilities. This report reflects questions about CVE-2018-1304 and CVE-2018-1305, referenced in the Tomcat Security Advisory.

Review additional information at the National Vulnerability Database.

Description
CVE-2018-1304:
The URL pattern of "" (the empty string), which exactly maps to the context root, isn't correctly handled when used as part of a security constraint definition, causing the constraint to be ignored. It's possible for unauthorized users to gain access to web application resources that would otherwise be protected under this condition. Only security constraints with a URL pattern of the empty string are affected.

CVE-2018-1305:
Security constraints defined by annotations of Servlets are only applied after a Servlet has been loaded. Security constraints defined in this way apply to the URL pattern and any URLs below. Depending on the order Servlets are loaded, it's possible for some security constraints to not be applied. Users who aren't authorized to access them might have access to resources that they shouldn't have access to.

Research and Conclusions
The ePO Engineering team has researched these vulnerabilities and determined that it can affect ePO minimally and is a low-risk issue. Based on our usage, the CVSS scores determined for both these CVEs are very low—2.6/2.3 (Base/Temporal score).

Resolution for these issues is planned in the next available ePO patch release (5.10).

Disclaimer
Any future product release dates mentioned in this statement are intended to outline our general product direction and shouldn't be relied on in making a purchasing decision:

• The product release dates are for information purposes only, and may not be incorporated into any contract.
• The product release dates aren't a commitment, promise, or legal obligation to deliver any material, code, or functionality.
• The development, release, and timing of any features or functionality described for our products remains at our sole discretion and may be changed or canceled at any time.