7 ms·
CVE-2021-24122 Apache Tomcat Information Disclosure
- java-man 6y agoAny details? Is this an Apache vulnerability or a JRE one?
- spullara 6y agoIt looks like they are using getCanonicalPath to ensure that the file is under the serving root but there is some behavior that confused the Tomcat code. I can imagine this bug could manifest in other software that depends on this behavior on Windows.
- hangonhn 6y agoAccording to the CVE, the root cause is unexpected behavior in the JRE caused by inconsistent behavior in the Windows API.
- farnulfo 6y agoCommits: https://github.com/apache/tomcat/commit/800b03140e640f8892f27021e681645e8e320177 https://github.com/apache/tomcat/commit/800b03140e640f8892f2... Source: https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_To...
- emergie 6y agoWindows OS as a production environment for any Tomcat webapp seems very unlikely.
- pjmlp 6y agoYou would be surprised how many Microsoft shops among F500 do it all the time. Here is another one, WebSphere on Windows.
- varikin 6y agoIn the late 2000s, I worked for an enterprise software company. Turns out many smaller customers that needed our software were Windows based and ran our Tomcat based software on Windows servers. The larger companies that had dedicated Unix clusters for our software and other things. In the world of SaaS, this becomes less of a thing, but there are still a lot non-tech small businesses that start with Windows based IT solutions because they want Office & Outlook. Then they find some domain specific thing that they want to host and since they know windows, it runs on a Windows server.
- discreditable 6y agoMore common than you think. PowerSchool is a major Student Info System. Tomcat on Windows.
- Turbots 6y agoI have So Many customers running Spring Boot Apps on embedded tomcat on Windows server.
- davidgerard 6y agoshould be very unlikely. Unfortunately, there's a lot of this sort of thing. It's especially popular with enterprise software, which will often be a Windows exe or msi that wraps Tomcat and a Java app.
- technion 6y agoA quick look around and I see McAfee EPO and microstrategy running this configuration in one organisation. Seems common across my customers.
- Thaxll 6y agoHow many CVE exists because of path, symlinks etc ...
- millerm 6y agoSomebody had better call Equifax directly this time and let them know. Yes, I know it was Struts last time, but...