Vulnerability CVE-2020-13934 - Questions about updating Tomcat

dev support
3

Thank you very much, Pete! That did the trick.

I was able to implement this successfully. For anyone who needs to do this, these were our steps:

  1. Choose a phrase to use as a shared secret. For this example, I’m using “someSecret”.
  2. In the Lucee installation directory, in lucee/tomcat/conf directory, edit the file server.xml.
  3. On the line after <!-- Define an AJP 1.3 Connector on port 8009 -->, add your new secret with secret=“someSecret” into the tag. Save the file. It will look something like this:
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" secret="someSecret" />
  1. Edit the BonCodeAJP13.settings file in the Windows directory. After the element <ModCFMLSecret/>, add <RequestSecret>someSecret</RequestSecret>. Save the file.
  2. Restart the Lucee service and perform an IIS reset.