ColdFusion 2021 Update 18 Tomcat vulnerability

[Thadd_CACI]

Our CIS has flagged Tomcat version < 9.0.98 as being vulnerable with critical severity.  

Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.

A hotfix to patch Tomcat to latest stable version for ColdFusion 2021 would be appreciated.

[BKBK]

@Thadd_CACI , as you can see from the list of "Apache Tomcat 9.x vulnerabilities", versions of Tomcat below 9.0.98, including 9.0.98 itself, are known to have issues. You can fix one such issue yourself: 
"CVE-2024-56337: Remote Code Execution via write enabled Default Servlet. "

The issue depends on the Java version. On ColdFusion 2021 (Java 11) , you can mitigate the issue manually by adding the flag

-Dsun.io.useCanonCaches=false

to ColdFusion's JVM settings, then restarting ColdFusion.

[igeocacher]

We have similar issues with our IT-Sec folks getting very "hot" over the continued TomCat vulnerabilities in CF2021. They are talking about abandoning CF altogether. We license CF Enterprise and use the Docker Images. What is the recommended way to fix this when using the official Docker distribution?

-dB

[Charlie Arehart]

Short answer: there is no Adobe-approved path to update the Tomcat underlying CF--whether a traditional server install (or the zip install, new since cf2021), or using the Adobe-provided container images.  We can only wait for them to do it. 

Longer answer/alternative: If someone's demanding you solve this, note that since you're running cf Enterprise, you could try to go the route of creating cf as a JEE WAR or EAR file (an option offered when running the cf installer, or from within the cf admin "packaging" section). One can also do this with the CF trial or developer edition as well: just not cf Standard. 

Then YOU are responsible for implementing and updating tomcat, and then you/a Tomcat administrator would deploy that CF WAR or EAR file onto Tomcat. That entails understanding the generic concepts of war/war deployment, the specifics of Tomcat war/war deployment, then the specifics of running cf  within a war/ear. 

Eminently doable, for some. Too large a bite for most, I'm sure. Just wanted to outline the option. (And I can help anyone compelled to pursue it. More at carehart.org/consulting.) 

(And for anyone interested in the subject, when one runs cf or Lucee on Commandbox, that's also implementing the cfml engine as a war file, just all done under the covers for you. And that's in fact why you can't run cf on Commandbox in production unless you have a cf enterprise license key, as again only that supports cf running as a war file: CF Standard does not. Finally, FWIW, Commandbox also happens to implement Undertow as its servlet engine, rather than tomcat.)