Apache Tomcat Security Advisory - CVE-2021-24122 - DX NetOps Spectrum

book

Article ID: 206975

calendar_today

Updated On:

Products

CA Spectrum

Issue/Introduction


The following vulnerability was reported for apache tomcat versions

[SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure

CVE-2021-24122 Detail


Description:
When serving resources from a network location using the NTFS file
system it was possible to bypass security constraints and/or view the
source code for JSPs in some configurations. The root cause was the
unexpected behaviour of the JRE API File.getCanonicalPath() which in
turn was caused by the inconsistent behaviour of the Windows API
(FindFirstFileW) in some circumstances.

Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 10.0.0-M10 or later
- Upgrade to Apache Tomcat 9.0.40 or later

Environment

Release : 10.4.0, 10.4.1, 20.2.0, 20.2.3, 20.2.5

Component : Spectrum OneClick

Resolution


Spectrum10.4.3 (NetOps 20.2.7) updates Apache Tomcat to 9.0.41

Additional Information


Both OneClick Tomcat and WebTomcat are updated to Apache Tomcat 9.0.41

OneClick
20-Jan-2021 11:54:07.124 INFO [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servlet engine: [Apache Tomcat/9.0.41]

WebTomcat
21-Jan-2021 09:28:04.060 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server version name:   Apache Tomcat/9.0.41