USN-6908-1: Critical Tomcat Vulnerabilities Alert

In a recent security release, USN-6908-1, several significant vulnerabilities have been identified in Apache Tomcat. These vulnerabilities, if exploited, could allow an attacker to perform cross-site scripting (XSS) attacks and even execute arbitrary code on the server. This article provides a detailed breakdown of these vulnerabilities and offers guidance on how to mitigate the risks.

Overview of the Vulnerabilities

The affected versions span across multiple major releases of Tomcat, indicating the wide impact of these security flaws.

• CVE-2019-0221: This vulnerability arises from the SSI printenv command in Apache Tomcat, which echoes user-provided data without proper escaping, leading to potential XSS attacks. This issue affects Tomcat versions from 7.0.0 to 9.0.17.
• CVE-2020-9484: This flaw involves the PersistenceManager with the FileStore configuration. Under certain conditions, this could lead to arbitrary code execution. It affects Tomcat versions from 7.0.0 to 10.0.0-M4.
• CVE-2021-25329: A continuation of the CVE-2020-9484 issue, where the initial fixes were incomplete, leaving Tomcat susceptible to the same type of attack. This affects later versions up to Tomcat 10.0.0.

Mitigation Strategies

To protect your systems, it is crucial to apply the latest patches provided by Apache. Additionally, review your configurations to disable unnecessary commands and services that might expose your servers to attackers.

For comprehensive protection:

1. Ensure all Tomcat installations are updated to the latest patched versions.
2. Disable the SSI printenv command if not required for your operations.
3. Regularly audit and harden your server configurations to limit the exposure of vulnerable services.

For further information and continuous updates, please visit our main website.