This update for tomcat fixes the following issues :

  - CVE-2021-24122: Fixed an information disclosure if     resources are served from the NTFS file system     (bsc#1180947).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of tomcat installed on the remote host is prior to 8.5.60-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-010 advisory.

    While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to     9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on     an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely     lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak     between requests. (CVE-2020-17527)

    When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The fix for CVE-2020-9484 was incomplete. When using     Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41,     8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a     configuration edge case that was highly unlikely to be     used, the Tomcat instance was still vulnerable to     CVE-2020-9494. Note that both the previously published     prerequisites for CVE-2020-9484 and the previously     published mitigations for CVE-2020-9484 also apply to     this issue.(CVE-2021-25329)

  - When serving resources from a network location using     the NTFS file system, Apache Tomcat versions 10.0.0-M1     to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and     7.0.0 to 7.0.106 were susceptible to JSP source code     disclosure in some configurations. The root cause was     the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the     inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances.(CVE-2021-24122)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tomcat installed on the remote host is prior to 9.0.40. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.40_security-9 advisory.

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

  - While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to     9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on     an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely     lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak     between requests. (CVE-2020-17527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 8.5.60. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_8.5.60_security-8 advisory.

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

  - While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to     9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on     an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely     lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak     between requests. (CVE-2020-17527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When serving resources from a network location using     the NTFS file system, Apache Tomcat versions 10.0.0-M1     to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and     7.0.0 to 7.0.106 were susceptible to JSP source code     disclosure in some configurations. The root cause was     the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the     inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances.(CVE-2021-24122)

  - While investigating bug 64830 it was discovered that     Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to     9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request     header value from the previous stream received on an     HTTP/2 connection for the request associated with the     subsequent stream. While this would most likely lead to     an error and the closure of the HTTP/2 connection, it     is possible that information could leak between     requests.(CVE-2020-17527)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2812 advisory.

    When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

    Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache     Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and     from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading     to information leaking from the current request/response to the next. Users are recommended to upgrade to     version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
    (CVE-2023-42795)

    Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information     disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache     Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from     9.0.0.M1 through 9.0.98.

    If all of the following were true, a malicious user was able to view       security sensitive files and/or     inject content into those files:- writes enabled for the default servlet (disabled by default)- support     for partial PUT (enabled by default)- a target URL for security sensitive uploads that was a sub-directory     of a target URL for public uploads- attacker knowledge of the names of security sensitive files being     uploaded- the security sensitive files also being uploaded via partial PUT

    If all of the following were true, a malicious user was able to       perform remote code execution:-     writes enabled for the default servlet (disabled by default)- support for partial PUT (enabled by     default)- application was using Tomcat's file based session persistence with the default storage location-     application included a library that may be leveraged in a deserialization attack

    Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.98, which fixes the issue.

    More justification and the patch links are available for all versions here:[1]     https://tomcat.apache.org/security-11.html[2] https://tomcat.apache.org/security-10.html[3]     https://tomcat.apache.org/security-9.html (CVE-2025-24813)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14705-1 advisory.

  - When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to     7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default     servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This     JSP could then be requested and any code it contained would be executed by the server. (CVE-2017-12617)

  - When serving resources from a network location using the NTFS file system, Apache Tomcat versions     10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP     source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances. (CVE-2021-24122)

  - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to     9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be     used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published     prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to     this issue. (CVE-2021-25329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
146852	openSUSE Security Update : tomcat (openSUSE-2021-330)	Nessus	SuSE Local Security Checks	2021/2/25	2024/1/19	medium
247516	Linux Distros Unpatched Vulnerability : CVE-2021-24122	Nessus	Misc.	2025/8/10	2026/7/16	medium
182062	Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-010)	Nessus	Amazon Linux Local Security Checks	2023/9/27	2024/12/11	high
149164	EulerOS 2.0 SP3 : tomcat (EulerOS-SA-2021-1856)	Nessus	Huawei Local Security Checks	2021/4/30	2024/1/2	high
144050	Apache Tomcat 9.0.0.M1 < 9.0.40 multiple vulnerabilities	Nessus	Web Servers	2020/12/10	2024/5/23	high
144054	Apache Tomcat 8.5.0 < 8.5.60 multiple vulnerabilities	Nessus	Web Servers	2020/12/10	2024/5/23	high
145727	EulerOS 2.0 SP8 : tomcat (EulerOS-SA-2021-1175)	Nessus	Huawei Local Security Checks	2021/2/1	2024/1/25	high
233710	Amazon Linux 2 : tomcat (ALAS-2025-2812)	Nessus	Amazon Linux Local Security Checks	2025/4/1	2026/1/21	critical
148353	Photon OS 4.0: Apache PHSA-2021-4.0-0007	Nessus	PhotonOS Local Security Checks	2021/4/7	2026/11/2	high
149630	EulerOS 2.0 SP5 : tomcat (EulerOS-SA-2021-1915)	Nessus	Huawei Local Security Checks	2021/5/18	2024/1/1	high
150565	SUSE SLES11 Security Update : tomcat6 (SUSE-SU-2021:14705-1)	Nessus	SuSE Local Security Checks	2021/6/10	2023/1/17	high

偵測

搜尋 Plugin

medium

medium

high

high

high

high

high

critical

high

high

high