CVE-2020-1938, also known as Ghostcat, is a critical vulnerability affecting Apache Tomcat servers. With a severity rating of 9.8, this vulnerability allows attackers to exploit Apache JServ Protocol (AJP) connections, potentially leading to remote code execution and unauthorized access to sensitive files.

How do I know if I'm affected?

If you're using Apache Tomcat, you might be affected by the vulnerability, also known as Ghostcat. This vulnerability impacts Apache Tomcat versions 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50, and 7.0.0 to 7.0.99. It also affects systems running on openSUSE Leap 15.1, Debian 8 "Jessie", and Fedora 32. Additionally, BlackBerry Workspaces Server and BlackBerry Good Control are impacted. To know if you're affected, check your Apache Tomcat version and the systems mentioned above. If you're using any of these versions or systems, your server might be vulnerable to unauthorized access and remote code execution.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to take action. Upgrade your Apache Tomcat to versions 9.0.31, 8.5.51, or 7.0.100 or later to block the vulnerability. Additionally, review your AJP Connector configuration to ensure it's only accessible by the proxy. For extra security, use firewalls to limit access to AJP ports and define a secret in the server.xml file or set the secretRequired option to false.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, the CVE-2020-1938 vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog. It was added on March 3, 2022, with a due date of March 17, 2022. The required action is to apply updates according to vendor instructions. This vulnerability, also known as Ghostcat, affects Apache Tomcat and can lead to unauthorized access and remote code execution if not addressed.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as NVD-CWE-Other, which is related to the Apache JServ Protocol (AJP) in Apache Tomcat, which can lead to unauthorized access and remote code execution if not properly secured.

For more details

CVE-2020-1938, a critical vulnerability affecting Apache Tomcat servers, has far-reaching consequences on various systems and software configurations. By addressing this vulnerability, organizations can prevent unauthorized access and remote code execution. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• National Vulnerability Database

• openSUSE Security Update for Tomcat

• BlackBerry Workspaces Server and BlackBerry Good Control Advisory

• Debian Tomcat8 Security Update

• Fedora 32 Tomcat Security Update