Apache Releases Security Advisory for Tomcat [CVE-2021-24122]

The Apache Software Foundation has released a security advisory to address a vulnerability affecting multiple versions of Apache Tomcat. An attacker could exploit this vulnerability to obtain sensitive information.  

This has been assigned CVE-2021-24122

When serving resources from a network location using the NTFS file system it was possible to bypass security constraints and/or view the source code for JSPs in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

Users of the affected versions should apply one of the following mitigations:

– Upgrade to Apache Tomcat 10.0.0-M10 or later

– Upgrade to Apache Tomcat 9.0.40 or later

– Upgrade to Apache Tomcat 8.5.60 or later

– Upgrade to Apache Tomcat 7.0.107 or later