JVNDB-2020-001757
|
Apache Tomcat �̕����̐Ǝ㐫�ɑ���A�b�v�f�[�g
|
The Apache Software Foundation ����AApache Tomcat �Ɋւ��鎟�̕����̐Ǝ㐫�ɑ���A�b�v�f�[�g�����J����܂����B
* HTTP Request Smuggling (CWE-444) - CVE-2020-1935�ACVE-2019-17569
�@* Apache Tomcat �������� Transfer-Encoding �w�b�_�[������ď����������o�[�X�v���L�V�̔z���ɂ���ꍇ HTTP Request Smuggling �U������\��������܂��B
* �s�K�ȔF���� (CWE-285) - CVE-2020-1938
�@* Apache JServ Protocol (AJP) �� Apache httpd ���t�������N�G�X�g�� Apache Tomcat �ɘA�g����ۂɎg�p����Ă���A�f�t�H���g�ŗL���Ȑݒ�ƂȂ��Ă��܂��BAJP �|�[�g�ɃA�N�Z�X���\�ȏꍇ�A�C�ӂ̃��N�G�X�g�𑗐M�����\��������܂��B
|
|
|
Apache Software Foundation
����
- Hitachi IT Operations Director
- Job Management Partner 1/IT Desktop Management - Manager
- Job Management Partner 1/IT Desktop Management 2 - Manager
- Job Management Partner 1/IT Service Level Management - Manager
- JP1/Automatic Job Management System 3 - Manager
- JP1/Integrated Management - Service Support
- JP1/Integrated Management - Service Support Advanced Edition
- JP1/Integrated Management - Service Support Starter Edition
- JP1/IT Desktop Management - Manager
- JP1/IT Desktop Management 2 - Manager
- JP1/IT Desktop Management 2 - Operations Director
- JP1/IT Desktop Management 2 Smart Device Manager
- JP1/IT Service Level Management - Manager
- JP1/Navigation Platform
- JP1/Navigation Platform for Developers
- JP1/Performance Management - Manager
- JP1/Performance Management - Web Console
- JP1/Service Level Management - Manager
- JP1/Service Support
- JP1/Service Support Starter Edition
- JP1/SNMP System Observer
|
�{�Ǝ㐫�̉e�����鐻�i�̏ڍׂɂ��ẮA�x���_���юQ�l�������m�F���������B
|
CVE-2020-1935�ACVE-2019-17569
* �H���ꂽ HTTP �w�b�_���܂� HTTP ���N�G�X�g���������邱�ƂŁA�����������Ȃǂ̉\��������܂�
CVE-2020-1938
* Apache Tomcat �̐ݒ�ɂ���ĉe���͈قȂ�܂����AWEB-INF �� META-INF�A�܂��� ServletContext.getResourceAsStream() �����B�\�f�B���N�g���z���̔C�ӂ̃t�@�C����ǂݎ����\��������܂��B�܂��AWeb �A�v���P�[�V�������t�@�C���̃A�b�v���[�h����ѕۑ��������Ă���ꍇ�ɑ�O�҂ɔC�ӂ̃R�[�h�����s�����\��������܂��B
|
CVE-2020-1935�ACVE-2020-1938�ACVE-2019-17569
[�A�b�v�f�[�g����]
�J���҂�����������ƂɁA�ŐV�łփA�b�v�f�[�g���Ă��������B
�J���҂͐Ǝ㐫�̑�Ƃ��āA���̃o�[�W�����������[�X���Ă��܂��B
* Apache Tomcat 9.0.31
* Apache Tomcat 8.5.51
* Apache Tomcat 7.0.100
CVE-2020-1938
[���[�N�A���E���h�����{����]
���̐��i�ɂ��Ă̓T�|�[�g���I�����Ă���A�C���v���O����������܂���B
* NSA210�ANSA220�ANSA220+�ANSA221�ANSA310�ANSA310S�ANSA320�ANSA320S�ANSA325 ����� NSA325v2
���̃��[�N�A���E���h�����{���邱�ƂŁA�{�Ǝ㐫�̉e�����y�����邱�Ƃ��\�ł��B
* server.xml ���� AJP Connector �̐ݒ���폜����
* AJP �|�[�g�ւ̐ڑ��𐧌�����
�@* �t�@�C�A�E�H�[���̐ݒ�
�@* AJP �R�l�N�^�ɖ����I�ɃA�h���X��ݒ肷��
�@* AJP �ڑ��̔F�ݒ���s��
|
Apache Software Foundation
���{�d�C
����
|
|
- CVE-2020-1935
- CVE-2020-1938
- CVE-2019-17569
|
- JVN : JVNVU#94679920
- JVN : JVNVU#96012689
- National Vulnerability Database (NVD) : CVE-2020-1935
- National Vulnerability Database (NVD) : CVE-2020-1938
- National Vulnerability Database (NVD) : CVE-2019-17569
- JPCERT ���ӊ��N : JPCERT-AT-2020-0009
|
- [2020�N02��26��]
�f��
- [2020�N08��06��]
�x���_���FHitachi Software Vulnerability Information (hitachi-sec-2020-124) ��lj�
�x���_���F�\�t�g�E�F�A���i�Z�L�����e�B��� (hitachi-sec-2020-124) ��lj�
- [2021�N02��16��]
�e������V�X�e���F���e���X�V
�x���_���FHitachi Software Vulnerability Information (hitachi-sec-2021-107) ��lj�
�x���_���F�\�t�g�E�F�A���i�Z�L�����e�B��� (hitachi-sec-2021-107) ��lj�
- [2021�N07��08��]
�Q�l���FJVN (JVNVU#96012689) ��lj�
- [2021�N07��15��]
�x���_���F���� (hitachi-sec-2021-121) ��lj�
- [2021�N08��10��]
�x���_���F���{�d�C (NV20-007) ��lj�
|