Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2021-24122 →
DEBIAN-CVE-2021-24122
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
tomcat9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.40-1"}]}]
Debian:13
tomcat9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.40-1"}]}]
Debian:14
tomcat9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.40-1"}]}]
Références
- advisory security-tracker.debian.org