CVE-2021-24122: Infoleak
First published: Thu Jan 14 2021(Updated: )
A flaw was found in Apache Tomcat. When serving resources from a network location using the NTFS file system, it was possible to bypass security constraints and view the source code for JSPs in some configurations. The root cause was the unexpected behavior of the JRE API File.getCanonicalPath(), which was caused by the inconsistent behavior of the Windows API (FindFirstFileW) in some circumstances. The highest threat from this vulnerability is to confidentiality.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jws5-tomcat | <0:9.0.36-9.redhat_8.1.el7 | 0:9.0.36-9.redhat_8.1.el7 |
| redhat/jws5-tomcat-native | <0:1.2.25-3.redhat_3.el7 | 0:1.2.25-3.redhat_3.el7 |
| redhat/jws5-tomcat | <0:9.0.36-9.redhat_8.1.el8 | 0:9.0.36-9.redhat_8.1.el8 |
| redhat/jws5-tomcat-native | <0:1.2.25-3.redhat_3.el8 | 0:1.2.25-3.redhat_3.el8 |
| Apache Tomcat | >=7.0.0<=7.0.106 | |
| Apache Tomcat | >=8.5.0<=8.5.59 | |
| Apache Tomcat | >=9.0.1<=9.0.39 | |
| Apache Tomcat | =9.0.0-milestone1 | |
| Apache Tomcat | =9.0.0-milestone10 | |
| Apache Tomcat | =9.0.0-milestone11 | |
| Apache Tomcat | =9.0.0-milestone12 | |
| Apache Tomcat | =9.0.0-milestone13 | |
| Apache Tomcat | =9.0.0-milestone14 | |
| Apache Tomcat | =9.0.0-milestone15 | |
| Apache Tomcat | =9.0.0-milestone16 | |
| Apache Tomcat | =9.0.0-milestone17 | |
| Apache Tomcat | =9.0.0-milestone18 | |
| Apache Tomcat | =9.0.0-milestone19 | |
| Apache Tomcat | =9.0.0-milestone2 | |
| Apache Tomcat | =9.0.0-milestone20 | |
| Apache Tomcat | =9.0.0-milestone21 | |
| Apache Tomcat | =9.0.0-milestone22 | |
| Apache Tomcat | =9.0.0-milestone23 | |
| Apache Tomcat | =9.0.0-milestone24 | |
| Apache Tomcat | =9.0.0-milestone25 | |
| Apache Tomcat | =9.0.0-milestone26 | |
| Apache Tomcat | =9.0.0-milestone27 | |
| Apache Tomcat | =9.0.0-milestone3 | |
| Apache Tomcat | =9.0.0-milestone4 | |
| Apache Tomcat | =9.0.0-milestone5 | |
| Apache Tomcat | =9.0.0-milestone6 | |
| Apache Tomcat | =9.0.0-milestone7 | |
| Apache Tomcat | =9.0.0-milestone8 | |
| Apache Tomcat | =9.0.0-milestone9 | |
| Apache Tomcat | =10.0.0-milestone1 | |
| Apache Tomcat | =10.0.0-milestone2 | |
| Apache Tomcat | =10.0.0-milestone3 | |
| Apache Tomcat | =10.0.0-milestone4 | |
| Apache Tomcat | =10.0.0-milestone5 | |
| Apache Tomcat | =10.0.0-milestone6 | |
| Apache Tomcat | =10.0.0-milestone7 | |
| Apache Tomcat | =10.0.0-milestone8 | |
| Apache Tomcat | =10.0.0-milestone9 | |
| Debian Debian Linux | =9.0 | |
| Oracle Agile PLM | =9.3.3 | |
| Oracle Agile PLM | =9.3.6 | |
| redhat/tomcat | <9.0.40 | 9.0.40 |
| redhat/tomcat | <8.5.60 | 8.5.60 |
| redhat/tomcat | <7.0.107 | 7.0.107 |
| maven/org.apache.tomcat.embed:tomcat-embed-core | >=7.0.0<7.0.107 | 7.0.107 |
| maven/org.apache.tomcat.embed:tomcat-embed-core | >=8.5.0<8.5.60 | 8.5.60 |
| maven/org.apache.tomcat.embed:tomcat-embed-core | >=9.0.0<9.0.40 | 9.0.40 |
| maven/org.apache.tomcat.embed:tomcat-embed-core | >=10.0.0-M1<=10.0.0-M9 | 10.0.0-M10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-24122 https://nvd.nist.gov/vuln/detail/CVE-2021-24122 http://mail-archives.apache.org/mod_mbox/tomcat-announce/202101.mbox/%3Cf3765f21-969d-7f21-e34a-efc106175373%40apache.org%3E http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60 http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
- https://bugzilla.redhat.com/show_bug.cgi?id=1917209
- https://access.redhat.com/errata/RHSA-2022:5532
- https://access.redhat.com/errata/RHSA-2021:0495
- https://access.redhat.com/errata/RHSA-2021:0494
- https://access.redhat.com/errata/RHSA-2021:3425
- https://access.redhat.com/security/cve/cve-2021-24122
- http://www.openwall.com/lists/oss-security/2021/01/14/1
- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r7382e1e35b9bc7c8f320b90ad77e74c13172d08034e20c18000fe710@%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d@%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r7e0bb9ea415724550e2b325e143b23e269579e54d66fcd7754bd0c20@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb32a73b7cb919d4f44a2596b6b951274c0004fc8b0e393d6829a45f9@%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
- https://security.netapp.com/advisory/ntap-20210212-0008/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://github.com/apache/tomcat/commit/935fc5582dc25ae10bab6f9d5629ff8d996cb533
- https://github.com/apache/tomcat/commit/920dddbdb981f92e8d5872a4bb126a10af5ca8a9
- https://github.com/apache/tomcat/commit/800b03140e640f8892f27021e681645e8e320177
- http://mail-archives.apache.org/mod_mbox/tomcat-announce/202101.mbox/%3Cf3765f21-969d-7f21-e34a-efc106175373%40apache.org%3E
- http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60
- http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.107
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1917234
- https://access.redhat.com/support/policy/updates/jboss_notes
- https://nvd.nist.gov/vuln/detail/CVE-2021-24122
- https://github.com/apache/tomcat/commit/7f004ac4531c45f9a2a2d1470561fe135cf27bc2
- https://tomcat.apache.org/security-9.html
- https://tomcat.apache.org/security-8.html
- https://tomcat.apache.org/security-7.html
- https://tomcat.apache.org/security-10.html
- https://security.netapp.com/advisory/ntap-20210212-0008
- https://github.com/advisories/GHSA-2rvv-w9r2-rg7m (Advisory)
- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r7382e1e35b9bc7c8f320b90ad77e74c13172d08034e20c18000fe710%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d%40%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r7e0bb9ea415724550e2b325e143b23e269579e54d66fcd7754bd0c20%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb32a73b7cb919d4f44a2596b6b951274c0004fc8b0e393d6829a45f9%40%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/severity
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-2rvv-w9r2-rg7m
- alias/CVE-2021-24122
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- agent/references
- collector/github-advisory
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- agent/last-modified-date
- agent/trending
- package-manager/redhat
- vendor/apache
- canonical/apache tomcat
- version/apache tomcat/7.0.0
- version/apache tomcat/7.0.106
- version/apache tomcat/8.5.0
- version/apache tomcat/8.5.59
- version/apache tomcat/9.0.1
- version/apache tomcat/9.0.39
- version/apache tomcat/9.0.0-milestone1
- version/apache tomcat/9.0.0-milestone10
- version/apache tomcat/9.0.0-milestone11
- version/apache tomcat/9.0.0-milestone12
- version/apache tomcat/9.0.0-milestone13
- version/apache tomcat/9.0.0-milestone14
- version/apache tomcat/9.0.0-milestone15
- version/apache tomcat/9.0.0-milestone16
- version/apache tomcat/9.0.0-milestone17
- version/apache tomcat/9.0.0-milestone18
- version/apache tomcat/9.0.0-milestone19
- version/apache tomcat/9.0.0-milestone2
- version/apache tomcat/9.0.0-milestone20
- version/apache tomcat/9.0.0-milestone21
- version/apache tomcat/9.0.0-milestone22
- version/apache tomcat/9.0.0-milestone23
- version/apache tomcat/9.0.0-milestone24
- version/apache tomcat/9.0.0-milestone25
- version/apache tomcat/9.0.0-milestone26
- version/apache tomcat/9.0.0-milestone27
- version/apache tomcat/9.0.0-milestone3
- version/apache tomcat/9.0.0-milestone4
- version/apache tomcat/9.0.0-milestone5
- version/apache tomcat/9.0.0-milestone6
- version/apache tomcat/9.0.0-milestone7
- version/apache tomcat/9.0.0-milestone8
- version/apache tomcat/9.0.0-milestone9
- version/apache tomcat/10.0.0-milestone1
- version/apache tomcat/10.0.0-milestone2
- version/apache tomcat/10.0.0-milestone3
- version/apache tomcat/10.0.0-milestone4
- version/apache tomcat/10.0.0-milestone5
- version/apache tomcat/10.0.0-milestone6
- version/apache tomcat/10.0.0-milestone7
- version/apache tomcat/10.0.0-milestone8
- version/apache tomcat/10.0.0-milestone9
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- vendor/oracle
- canonical/oracle agile plm
- version/oracle agile plm/9.3.3
- version/oracle agile plm/9.3.6
- package-manager/maven