[java-sig-commits] [Bug 1917209] New: CVE-2021-24122 tomcat: Information disclosure

https://bugzilla.redhat.com/show_bug.cgi?id=1917209

            Bug ID: 1917209
           Summary: CVE-2021-24122 tomcat: Information disclosure
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: high
          Priority: high
          Assignee: security-response-team(a)redhat.com
          Reporter: jwon(a)redhat.com
                CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
                    akoufoud(a)redhat.com, alazarot(a)redhat.com,
                    alee(a)redhat.com, almorale(a)redhat.com,
                    anstephe(a)redhat.com, asoldano(a)redhat.com,
                    atangrin(a)redhat.com, avibelli(a)redhat.com,
                    bbaranow(a)redhat.com, bgeorges(a)redhat.com,
                    bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com,
                    cdewolf(a)redhat.com, chazlett(a)redhat.com,
                    cmoulliard(a)redhat.com, coolsvap(a)gmail.com,
                    csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
                    dbecker(a)redhat.com, dkreling(a)redhat.com,
                    dosoudil(a)redhat.com, drieden(a)redhat.com,
                    eleandro(a)redhat.com, etirelli(a)redhat.com,
                    ggaughan(a)redhat.com, gmalinko(a)redhat.com,
                    gzaronik(a)redhat.com, huwang(a)redhat.com,
                    ibek(a)redhat.com, ikanello(a)redhat.com,
                    ivan.afonichev(a)gmail.com, iweiss(a)redhat.com,
                    janstey(a)redhat.com,
                    java-sig-commits(a)lists.fedoraproject.org,
                    jclere(a)redhat.com, jjoyce(a)redhat.com,
                    jochrist(a)redhat.com, jolee(a)redhat.com,
                    jpallich(a)redhat.com, jperkins(a)redhat.com,
                    jschatte(a)redhat.com, jschluet(a)redhat.com,
                    jstastny(a)redhat.com, jwon(a)redhat.com,
                    krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
                    kverlaen(a)redhat.com, kwills(a)redhat.com,
                    lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
                    lthon(a)redhat.com, mburns(a)redhat.com,
                    mkolesni(a)redhat.com, mnovotny(a)redhat.com,
                    msochure(a)redhat.com, msvehla(a)redhat.com,
                    mszynkie(a)redhat.com, nwallace(a)redhat.com,
                    pgallagh(a)redhat.com, pjindal(a)redhat.com,
                    pmackay(a)redhat.com, rguimara(a)redhat.com,
                    rhcs-maint(a)redhat.com, rhel8-maint(a)redhat.com,
                    rrajasek(a)redhat.com, rruss(a)redhat.com,
                    rstancel(a)redhat.com, rsvoboda(a)redhat.com,
                    rsynek(a)redhat.com, sclewis(a)redhat.com,
                    scohen(a)redhat.com, sdaley(a)redhat.com,
                    slinaber(a)redhat.com, smaestri(a)redhat.com,
                    szappis(a)redhat.com, tom.jenkinson(a)redhat.com
            Blocks: 1917185
  Target Milestone: ---
    Classification: Other



When serving resources from a network location using the NTFS file system it
was possible to bypass security constraints and/or view the source code for
JSPs in some configurations. The root cause was the unexpected behaviour of the
JRE API File.getCanonicalPath() which in turn was caused by the inconsistent
behaviour of the Windows API (FindFirstFileW) in some circumstances.

Upstream commits:
Tomcat 9.0:
https://github.com/apache/tomcat/commit/935fc5582dc25ae10bab6f9d5629ff8d9...
Tomcat 8.5:
https://github.com/apache/tomcat/commit/920dddbdb981f92e8d5872a4bb126a10a...
Tomcat 7.0:
https://github.com/apache/tomcat/commit/800b03140e640f8892f27021e681645e8...

Reference:
http://mail-archives.apache.org/mod_mbox/tomcat-announce/202101.mbox/%3Cf...
http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107


-- 
You are receiving this mail because:
You are on the CC list for the bug.