[thredds] Tomcat Ghostcat Vulnerability

• To: David Neufeld via thredds <thredds@xxxxxxxxxxxxxxxx>
• Subject: [thredds] Tomcat Ghostcat Vulnerability
• From: Roy Mendelssohn - NOAA Federal <roy.mendelssohn@xxxxxxxx>
• Date: Mon, 9 Mar 2020 20:51:32 -0700

I am surprised this hasn't hit this list already:

"Ghostcat" is a new security vulnerability in Tomcat's AJP Connector that 
potentially allows attackers to take over the server. You can read more about 
the problem at
        • 
https://www.bleepingcomputer.com/news/security/active-scans-for-apache-tomcat-ghostcat-vulnerability-detected-patch-now/
        • 
https://www.esri.com/arcgis-blog/products/arcgis-online/administration/dont-get-bitten-by-ghostcat-tomcat-vulnerability/
        • 
https://securityboulevard.com/2020/02/patch-your-tomcat-and-jboss-instances-to-protect-from-ghostcat-vulnerability-cve-2020-1938-and/
        • https://nvd.nist.gov/vuln/detail/CVE-2020-1938

Updates are available for the recent versions of Tomcat to fix this.  We have 
updated 2 TDS to Tomcat 8: 8.5.51 with no issues that I can see,  but ten again 
we aren't using AJP.

-Roy

**********************
"The contents of this message do not reflect any position of the U.S. 
Government or NOAA."
**********************
Roy Mendelssohn
Supervisory Operations Research Analyst
NOAA/NMFS
Environmental Research Division
Southwest Fisheries Science Center
***Note new street address***
110 McAllister Way
Santa Cruz, CA 95060
Phone: (831)-420-3666
Fax: (831) 420-3980
e-mail: Roy.Mendelssohn@xxxxxxxx www: https://www.pfeg.noaa.gov/

"Old age and treachery will overcome youth and skill."
"From those who have been given much, much will be expected" 
"the arc of the moral universe is long, but it bends toward justice" -MLK Jr.

• Follow-Ups:
  • Re: [thredds] Tomcat Ghostcat Vulnerability
    • From: Nathan Potter