正文

Apache Tomcat 信息泄露漏洞

admin
admin V管理员 /0 评论 /14 阅读
0305
此篇文章发布距今已超过1213天，您需要注意文章的内容或图片是否可用！

漏洞信息详情

Apache Tomcat 信息泄露漏洞

  • CNNVD编号：CNNVD-202101-1145
    • <!--
  • 危害等级： 中危-->
  • 危害等级： 中危
  • CVE编号： CVE-2021-24122
  • 漏洞类型： 信息泄露
  • 发布时间： 2021-01-14
  • 威胁类型： 远程
  • 更新时间： 2021-09-13
  • 厂        商：
  • 漏洞来源： Red Hat

漏洞简介

Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。

Apache Tomcat 存在信息泄露漏洞，该漏洞源于JRE API File.getCanonicalPath() 与 Windows API (FindFirstFileW)行为不一致。以下产品及版本受到影响：Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106。

漏洞公告

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d@%3Cdev.tomee.apache.org%3E

参考网址

来源:MISC

链接:https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r7e0bb9ea415724550e2b325e143b23e269579e54d66fcd7754bd0c20@%3Cdev.tomcat.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d@%3Cdev.tomee.apache.org%3E

来源:CONFIRM

链接:https://security.netapp.com/advisory/ntap-20210212-0008/

来源:MLIST

链接:https://lists.apache.org/thread.html/r7382e1e35b9bc7c8f320b90ad77e74c13172d08034e20c18000fe710@%3Cdev.tomee.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52@%3Cannounce.apache.org%3E

来源:MLIST

链接:https://lists.apache.org/thread.html/rb32a73b7cb919d4f44a2596b6b951274c0004fc8b0e393d6829a45f9@%3Cusers.tomcat.apache.org%3E

来源:MLIST

链接:http://www.openwall.com/lists/oss-security/2021/01/14/1

来源:MLIST

链接:https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52@%3Cannounce.tomcat.apache.org%3E

来源:MLIST

链接:https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/161389/Red-Hat-Security-Advisory-2021-0494-01.html

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/164101/Red-Hat-Security-Advisory-2021-3425-01.html

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-data-risk-manager-is-affected-by-multiple-vulnerabilities-3/

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-professional-ibm-websphere-cast-iron-solution-are-affected-by-apache-tomcat-vulnerabilities/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0644

来源:vigilance.fr

链接:https://vigilance.fr/vulnerability/Apache-Tomcat-information-disclosure-via-NTFS-JSP-Source-Code-34350

来源:www.cybersecurity-help.cz

链接:https://www.cybersecurity-help.cz/vdb/SB2021072821

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2021-24122

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0522

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0186/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.1130

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-apache-tomcat-vulnerabilities-affect-ibm-control-center/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.1103

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-open-source-apache-tomcat-vulnerabilities-affect-ibm-tivoli-application-dependency-discovery-manager-cve-2021-24122/

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.1375

来源:www.ibm.com

链接:https://www.ibm.com/blogs/psirt/security-bulletin-cve-2021-24122-when-serving-resources-from-a-network-location-using-the-ntfs-file-system-apache-tomcat-versions-8-5-0-to-8-5-59-were-susceptible-to-jsp-source-code-disclo/

来源:www.oracle.com

链接:https://www.oracle.com/security-alerts/cpujul2021.html

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.0915.2

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.3051

受影响实体

    暂无


补丁

  • Apache Tomcat 信息泄露漏洞的修复措施
    <!--
    2021-1-14
    -->