[<prev] [next>] [day] [month] [year] [list]
Message-ID: <0b682bd8-5aa1-1c74-abf8-5b3cd81c0c85@apache.org>
Date: Thu, 14 Jan 2021 14:22:50 +0000
From: Mark Thomas <markt@...che.org>
To: oss-security@...ts.openwall.com
Subject: [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure
CVE-2021-24122 Apache Tomcat Information Disclosure
Severity: Important
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 10.0.0-M1 to 10.0.0-M9
Apache Tomcat 9.0.0.M1 to 9.0.39
Apache Tomcat 8.5.0 to 8.5.59
Apache Tomcat 7.0.0 to 7.0.106
Description:
When serving resources from a network location using the NTFS file
system it was possible to bypass security constraints and/or view the
source code for JSPs in some configurations. The root cause was the
unexpected behaviour of the JRE API File.getCanonicalPath() which in
turn was caused by the inconsistent behaviour of the Windows API
(FindFirstFileW) in some circumstances.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 10.0.0-M10 or later
- Upgrade to Apache Tomcat 9.0.40 or later
- Upgrade to Apache Tomcat 8.5.60 or later
- Upgrade to Apache Tomcat 7.0.107 or later
Credit:
This issue was identified by Ilja Brander.
History:
2021-01-14 Original advisory
References:
[1] https://tomcat.apache.org/security-10.html
[2] https://tomcat.apache.org/security-9.html
[3] https://tomcat.apache.org/security-8.html
[4] https://tomcat.apache.org/security-7.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
