Security Alert (A21-01-03): Vulnerability in Apache Tomcat


 

Published on: 18 January 2021

Description:

Apache Software Foundation has released a security advisory to address a vulnerability in the Apache Tomcat. A remote attacker could entice a user to access specially crafted network resources which is using NTFS file system to exploit the vulnerability. 

 

Affected Systems:

  • Apache Tomcat 9.0.0.M1 to 9.0.39
  • Apache Tomcat 8.5.0 to 8.5.59
  • Apache Tomcat 7.0.0 to 7.0.106

 

Impact:

A successful exploitation of the vulnerability could lead to information disclosure on an affected system.

 

Recommendation:

Apache Software Foundation has released new version of the products to address the issue and they can be downloaded at the following URLs:

  • https://tomcat.apache.org/download-70.cgi
  • https://tomcat.apache.org/download-80.cgi
  • https://tomcat.apache.org/download-90.cgi

 

More Information:

https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
https://us-cert.cisa.gov/ncas/current-activity/2021/01/15/apache-releases-security-advisory-tomcat
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24122

 



Tag: Apache , Tomcat
Tags