CF2021 Apache Tomcat Vulnerability

Question

We recently received a vulnerability report on Apache Tomcat 9.0.106 from our security team and have been instructed to upgrade to 9.0.108. Are there steps to manual upgrade Tomcat within ColdFusion? If so, can you kindly provide guidance?

BKBK · Accepted Answer

That's right. I came across the vulnerabilities in Apache Tomcat versions 9.0.106 and 9.0.107. To check the Tomcat version used by your ColdFusion installation, run the following line of code:

<cfoutput>#createobject('java','org.apache.catalina.util.ServerInfo').getServerInfo()#</cfoutput>

It is not yet possible for the developer to manually upgrade the Tomcat version within ColdFusion. However, I would imagine that Adobe is aware of the vulnerabilities. We should therefore expect Adobe's ColdFusion engineers to release a hotfix for this soon.

But there is something you can already do. If only to put your mind at rest. Use the Request-Feature tool in Tracker to appeal to Adobe to urgently release the hotfix.

AbhishekJha · Answer

@Demetrius34669657am05 Our team is aware about the vulnerabilities and are currently working on it.

In case you need additional visibility, please log the issue here with the report for our team to evalute.

Thank You,

Abhishek

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.