CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
Geode
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all…
24. Feb 2020
Original bei Debian öffnenAusgewertete Quellen
- Debianhttps://lists.debian.org/debian-lts-announce/2020/03/msg00006.html
- Debianhttps://lists.debian.org/debian-lts-announce/2020/05/msg00026.html
- Debianhttps://www.debian.org/security/2020/dsa-4673
- Debianhttps://www.debian.org/security/2020/dsa-4680
- Herstellerhttps://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E
- Herstellerhttps://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E
- Herstellerhttps://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E
- Herstellerhttps://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E
- Herstellerhttps://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- Herstellerhttps://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d7039668821be28df3%40%3Ccommits.tomee.apache.org%3E
- Hinweishttp://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html
- Hinweishttp://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
- Hinweishttp://support.blackberry.com/kb/articleDetail?articleNumber=000062739
- Hinweishttps://security.gentoo.org/glsa/202003-43
- Hinweishttps://security.netapp.com/advisory/ntap-20200226-0002/
- Hinweishttps://www.oracle.com/security-alerts/cpujan2021.html
- Hinweishttps://www.oracle.com/security-alerts/cpujul2020.html
- Hinweishttps://www.oracle.com/security-alerts/cpuoct2020.html
- CISAhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1938
- CISAApache Tomcat Improper Privilege Management Vulnerability
- NVDCVE-2020-1938