Bug 1180947 - (CVE-2021-24122) VUL-0: CVE-2021-24122: tomcat6,tomcat: Apache Tomcat Information Disclosure
(CVE-2021-24122)
VUL-0: CVE-2021-24122: tomcat6,tomcat: Apache Tomcat Information Disclosure
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/275576/
CVSSv3.1:SUSE:CVE-2021-24122:5.9:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-01-14 17:20 UTC by Alexandros Toptsoglou
Modified: 2021-09-14 15:44 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandros Toptsoglou 2021-01-14 17:20:20 UTC
through oss 

CVE-2021-24122 Apache Tomcat Information Disclosure

Severity: Important

Versions Affected:
Apache Tomcat 10.0.0-M1 to 10.0.0-M9
Apache Tomcat 9.0.0.M1 to 9.0.39
Apache Tomcat 8.5.0 to 8.5.59
Apache Tomcat 7.0.0 to 7.0.106

Description:
When serving resources from a network location using the NTFS file
system it was possible to bypass security constraints and/or view the
source code for JSPs in some configurations. The root cause was the
unexpected behaviour of the JRE API File.getCanonicalPath() which in
turn was caused by the inconsistent behaviour of the Windows API
(FindFirstFileW) in some circumstances.

Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 10.0.0-M10 or later
- Upgrade to Apache Tomcat 9.0.40 or later
- Upgrade to Apache Tomcat 8.5.60 or later
- Upgrade to Apache Tomcat 7.0.107 or later

Credit:
This issue was identified by Ilja Brander.

References:
 https://tomcat.apache.org/security-10.html
 https://tomcat.apache.org/security-9.html
 https://tomcat.apache.org/security-8.html
 https://tomcat.apache.org/security-7.html
 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-24122
 http://seclists.org/oss-sec/2021/q1/39
Comment 1 Alexandros Toptsoglou 2021-01-15 12:41:59 UTC
I am not sure whether this is an Windows only issue. The corresponding commit fix can be found at the references of comment 0. Tracking tomcat in 12-SP2,SP4,15,15-SP1 and 15-SP2 as affected. Please upgrade Factory too.
Comment 4 Abid Mehmood 2021-01-22 10:21:57 UTC
Hi Alexandros,

I wasn't able to take a look at this issue this week, because of some other commitments. Hopefully, I will manage to reserve some time for this next week. Sorry for the inconvenience.

Abid
Comment 7 Swamp Workflow Management 2021-02-19 17:14:56 UTC
SUSE-SU-2021:0531-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1180947
CVE References: CVE-2021-24122
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 15-SP2 (src):    tomcat-9.0.36-3.21.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Swamp Workflow Management 2021-02-19 17:20:33 UTC
SUSE-SU-2021:0530-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1180947
CVE References: CVE-2021-24122
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    tomcat-9.0.36-3.61.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2021-02-22 23:14:37 UTC
openSUSE-SU-2021:0330-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1180947
CVE References: CVE-2021-24122
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    tomcat-9.0.36-lp152.2.19.1
Comment 14 Abid Mehmood 2021-03-18 16:09:41 UTC
Hi Alexandros,

MR for SLE-12-SP1 has been rejected with the following message `This codestream is EOL, if in doubt please contact the security team` 

https://build.suse.de/request/show/238101

For all others, MRs have been already accepted and tomcat6 doesn't seem to get affected.

Please let me know how to proceed from here.
Comment 16 Swamp Workflow Management 2021-03-30 19:22:52 UTC
SUSE-SU-2021:0989-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1180947,1182909,1182912
CVE References: CVE-2021-24122,CVE-2021-25122,CVE-2021-25329
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    tomcat-9.0.36-3.79.1
SUSE Linux Enterprise Server 15-LTSS (src):    tomcat-9.0.36-3.79.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    tomcat-9.0.36-3.79.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    tomcat-9.0.36-3.79.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 17 Swamp Workflow Management 2021-04-01 19:19:08 UTC
SUSE-SU-2021:1009-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1180947,1182909,1182912
CVE References: CVE-2021-24122,CVE-2021-25122,CVE-2021-25329
JIRA References: 
Sources used:
SUSE Manager Server 4.0 (src):    tomcat-9.0.36-4.58.1
SUSE Manager Retail Branch Server 4.0 (src):    tomcat-9.0.36-4.58.1
SUSE Manager Proxy 4.0 (src):    tomcat-9.0.36-4.58.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    tomcat-9.0.36-4.58.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    tomcat-9.0.36-4.58.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    tomcat-9.0.36-4.58.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    tomcat-9.0.36-4.58.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    tomcat-9.0.36-4.58.1
SUSE Enterprise Storage 6 (src):    tomcat-9.0.36-4.58.1
SUSE CaaS Platform 4.0 (src):    tomcat-9.0.36-4.58.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 18 Abid Mehmood 2021-04-20 09:32:14 UTC
Hi Alexandros,

Sorry, it took so long for SLE 11, I was on vacation.

Patches (https://build.suse.de/request/show/239657) have been submitted for SLE11, both for this bug and for https://bugzilla.suse.com/show_bug.cgi?id=1059554
Comment 20 Swamp Workflow Management 2021-04-21 16:29:16 UTC
SUSE-SU-2021:14705-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1059554,1180947,1182909
CVE References: CVE-2017-12617,CVE-2021-24122,CVE-2021-25329
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    tomcat6-6.0.53-0.57.19.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    tomcat6-6.0.53-0.57.19.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 21 Abid Mehmood 2021-09-10 09:51:52 UTC
It has been quite some time that this bug is open even though all the patches have been submitted. Any update?
Comment 22 Gianluca Gabrielli 2021-09-14 15:44:55 UTC
This can be closed