[thredds] Fwd: [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure

• To: THREDDS community <thredds@xxxxxxxxxxxxxxxx>
• Subject: [thredds] Fwd: [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure
• From: Jennifer Oxelson Ganter <oxelson@xxxxxxxx>
• Date: Thu, 14 Jan 2021 15:22:27 -0700

Hello all,

A new Tomcat vulnerability has been announced.  Please upgrade accordingly.



---------- Forwarded message ---------
From: Mark Thomas <markt@xxxxxxxxxx>
Date: Thu, Jan 14, 2021 at 7:20 AM
Subject: [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure
To: Tomcat Users List <users@xxxxxxxxxxxxxxxxx>
Cc: announce@xxxxxxxxxxxxxxxxx <announce@xxxxxxxxxxxxxxxxx>, <
announce@xxxxxxxxxx>, Tomcat Developers List <dev@xxxxxxxxxxxxxxxxx>


CVE-2021-24122 Apache Tomcat Information Disclosure

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 10.0.0-M1 to 10.0.0-M9
Apache Tomcat 9.0.0.M1 to 9.0.39
Apache Tomcat 8.5.0 to 8.5.59
Apache Tomcat 7.0.0 to 7.0.106

Description:
When serving resources from a network location using the NTFS file
system it was possible to bypass security constraints and/or view the
source code for JSPs in some configurations. The root cause was the
unexpected behaviour of the JRE API File.getCanonicalPath() which in
turn was caused by the inconsistent behaviour of the Windows API
(FindFirstFileW) in some circumstances.

Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 10.0.0-M10 or later
- Upgrade to Apache Tomcat 9.0.40 or later
- Upgrade to Apache Tomcat 8.5.60 or later
- Upgrade to Apache Tomcat 7.0.107 or later

Credit:
This issue was identified by Ilja Brander.

History:
2021-01-14 Original advisory

References:
[1] https://tomcat.apache.org/security-10.html
[2] https://tomcat.apache.org/security-9.html
[3] https://tomcat.apache.org/security-8.html
[4] https://tomcat.apache.org/security-7.html