Apache Tomcat AJP vulnerability (CVE-2020-1938 'Ghostcat') patched
Apache released fixes for CVE-2020-1938, an AJP request injection flaw dubbed Ghostcat that allows file reads and potential remote code execution on default Tomcat installations.
Executive briefing: The Apache Tomcat project issued security updates on to remediate CVE-2020-1938, a flaw in the Apache JServ Protocol (AJP) connector that can allow unauthenticated file read and, in certain configurations, remote code execution. Fixed versions include Tomcat 9.0.31, 8.5.51, and 7.0.100.
Operator action: Upgrade Tomcat to the patched releases, disable or firewall the AJP connector where not required, and configure the secretRequired and secret attributes for any remaining AJP listeners. Validate application server images and container base layers to ensure vulnerable builds are not redeployed.
Sources: The Apache advisory and Tomcat release notes outline affected versions, mitigation steps, and patched builds.
Continue in the Infrastructure pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Edge Resilience Infrastructure Guide — Zeph Tech
Engineer resilient edge estates using ETSI MEC standards, DOE grid assessments, and GSMA availability benchmarks documented by Zeph Tech.
-
Infrastructure Resilience Guide — Zeph Tech
Coordinate capacity planning, supply chain, and reliability operations using DOE grid programmes, Uptime Institute benchmarks, and NERC reliability mandates covered by Zeph Tech.
-
Infrastructure Sustainability Reporting Guide — Zeph Tech
Produce audit-ready infrastructure sustainability disclosures aligned with CSRD, IFRS S2, and sector-specific benchmarks curated by Zeph Tech.