From nobody Sun Dec 29 13:23:28 2024 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YLg0c3LfFz5j7tR; Sun, 29 Dec 2024 13:23:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YLg0c2tMCz4hqx; Sun, 29 Dec 2024 13:23:28 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1735478608; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rzsBAPsqrhLHRHzYDK3LFcZvl6iSYM9CfZjqGItdGus=; b=bnKfVtlsoFctlRn5t9Cm6/pIaltvcb1XgxUppZYjFLxS95FF1RZfC84cJ9zD07MQ8yLes7 H8LinU1sxm/obUKb7QU987Z5YL3HoEYDUWpOui4yubEfoOlft69TU9a+T+0qzAVjE9ZQ88 vTCS+INWpAgbx73YZtrTIlnWKuRpeFWBs1pZpCvKYim6LGQhhQ6VngsNffgaFH6Sua56BJ /Jz1aOpGRb7ARJ4K3evqpas/QE+4bQY4zo0H3i0OxkHbx2oAxGd3+eXgkPXDypsuy3ZwMT q+bemopOvfiXuTDky5Tp3VCEBAdYLJ3Hx7eVyCA1l24TQ3qu5naCxNuPV83YSg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1735478608; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rzsBAPsqrhLHRHzYDK3LFcZvl6iSYM9CfZjqGItdGus=; b=Jr4HOlqAvxlLJ9c0UTPjsqmrlGOGS3kVu1Dpt2oLNHKo2s64aKrdbL6RHMlTChoF07gXKN 4SsLVhksCvoc8bThDrOmP8yF2Oau0toxXB09R3nUsJvjjHhnPwdJDdb+i9JRTcbp4hHqou TTwsRkTzNROleh9VH53cweXi+Ym/HyVK/vPT5dUofPGsq0BuB4BGJVv/Hmy7tDJDPnz69B qMRDkKqwqPF3JP+5/qfw7GXJkDSuKKujEMAMH4bQSRhjuEjh2hbYUyQx/1XQD9V7+SRBaL Y2Tr1g4our8LnuMWIV+fwQFwZEZXFsPalouXqCP2re4bzdYJb0uq7Ug9jgfUxg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1735478608; a=rsa-sha256; cv=none; b=MstsGtm4AYKRZx+pUvdcwHZBzLt0nugJeuTDe7hX/cOmHI+oZDzZWc25zogtH11nC+NG0J GTqwsD0HPukXT/ih29Gn976r121UDW4fzcdm6BuWy1TdMFVci1ZXDBPOj0AqrXvx5EFGwM yU5LeLGefmQvfLpumTvt49RnOxbR9Pu3/HXh5+lPyVQm/f4ANrMLYBwuEPYxsP+ZLtRdG8 KieZw6LJxgz2MvpXgNURRSC9z7VRUJ1iP3NOOzgfaMSdEg2btOE74N2kZ46ZFNiPu+9L8T 3hmvRlNxoP/9PO/32YNF3p3FUI10eKCUIqKOojll1/HH3cN4RqIZPedBER48vA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YLg0c29dwz19b6; Sun, 29 Dec 2024 13:23:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4BTDNS0Q012964; Sun, 29 Dec 2024 13:23:28 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4BTDNSO6012958; Sun, 29 Dec 2024 13:23:28 GMT (envelope-from git) Date: Sun, 29 Dec 2024 13:23:28 GMT Message-Id: <202412291323.4BTDNSO6012958@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Fernando =?utf-8?Q?Apestegu=C3=ADa?= Subject: git: 1a35b19e6d46 - main - security/vuxml: TOCTOU Vulnerability in www/apache* List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fernape X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 1a35b19e6d46d348da6efa40bb46118cb77a5eb7 Auto-Submitted: auto-generated The branch main has been updated by fernape: URL: https://cgit.FreeBSD.org/ports/commit/?id=1a35b19e6d46d348da6efa40bb46118cb77a5eb7 commit 1a35b19e6d46d348da6efa40bb46118cb77a5eb7 Author: Fernando Apesteguía AuthorDate: 2024-12-29 13:22:03 +0000 Commit: Fernando Apesteguía CommitDate: 2024-12-29 13:22:03 +0000 security/vuxml: TOCTOU Vulnerability in www/apache* CVE-2024-56337 --- security/vuxml/vuln/2024.xml | 60 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 9ae28639c8fa..fb3c43af60ff 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,63 @@ + + Apache Tomcat -- RCE due to TOCTOU issue in JSP compilation + + + tomcat110 + + 11.0.0 + 11.0.1 + + + + tomcat101 + + 10.1.0 + 10.1.33 + + + + tomcat9 + + 9.0.0 + 9.0.97 + + + + + +

security@apache.org reports:

+
+

Time-of-check Time-of-use (TOCTOU) Race Condition + The mitigation for CVE-2024-50379 was incomplete. + Users running Tomcat on a case insensitive file system with the + default servlet write enabled (readonly initialisation parameter + set to the non-default value of false) may need additional configuration + to fully mitigate CVE-2024-50379 depending on which version of Java + they are using with Tomcat: - running on Java 8 or Java 11: the + system propertysun.io.useCanonCaches must be explicitly set to false + (it defaults to true) - running on Java 17: thesystem property + sun.io.useCanonCaches, if set, must be set to false(it defaults to + false) - running on Java 21 onwards: no further configuration is + required(the system property and the problematic cache have been + removed) + Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks + thatsun.io.useCanonCaches is set appropriately before allowing the + default servlet to be write enabled on a case insensitive file + system. Tomcat will also setsun.io.useCanonCaches to false by + default where it can.

+
+ + + + CVE-2024-56337 + https://nvd.nist.gov/vuln/detail/CVE-2024-56337 + + + 2024-12-20 + 2024-12-29 + + + kanboard -- Insufficient session invalidation