CVS-exploit of Tomcat 9/10/11

dev support
3

Apparently,

  1. the issue is relevant for versions of Apache Tomcat from 9.0.0.M1 through 9.0.97, from 10.1.0-M1 through 10.1.33 and from 11.0.0-M1 through 11.0.1;
  2. irrespective of the version in 1., the fix is to ensure that the Java property sun.io.useCanonCaches is set to false.
    That depends on the Java version on which the Tomcat server runs:

  • For Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true);

  • For Java 17 : the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false).

  • For Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed)

  • In short, if the Java version is 8 or 11, you can mitigate this issue manually by adding the flag

            -Dsun.io.useCanonCaches=false

    to the JVM settings.

5 Likes