CVE-2020-9484
Apache Tomcat: remote code execution via session persistence deserialization
Technology
Apache Tomcat
CVSS Score
7.0 / 10.0
Affected Versions
10.0.0-M1 to 10.0.0-M4; 9.0.0.M1 to 9.0.34; 8.5.0 to 8.5.54; 7.0.0 to 7.0.103
Upstream Fix
10.0.0-M5; 9.0.35; 8.5.55; 7.0.104
Published
May 20, 2020
OSSeva Coverage
Fixed upstream
Description
Remote code execution through deserialization is possible only if all of these hold: the attacker controls the contents and name of a file on the server, the server uses PersistenceManager with a FileStore, the sessionAttributeValueClassNameFilter is null (the default without a SecurityManager) or lax, and the attacker knows the relative path from the FileStore location to that file. Fixed in 10.0.0-M5, 9.0.35, 8.5.55 and 7.0.104; a follow-up, CVE-2021-25329, closed an edge case in 9.0.43, 8.5.63 and 7.0.108.
Is your Apache Tomcat deployment affected?
If you're running 10.0.0-M1 to 10.0.0-M4; 9.0.0.M1 to 9.0.34; 8.5.0 to 8.5.54; 7.0.0 to 7.0.103, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat 10.0.0-M1 to 10.0.0-M4; 9.0.0.M1 to 9.0.34; 8.5.0 to 8.5.54; 7.0.0 to 7.0.103?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?