You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@kylin.apache.org by George Ni <ni...@apache.org> on 2020/02/22 05:00:49 UTC
Apache Tomcat Security Vulnerability Notice
Hi Kylin users,
On February 20, China National Vulnerability Database (CNVD) published a
severe vulnerability in Apache Tomcat’s Apache JServ Protocol (or AJP). For
Apache Kylin uses Tomcat as the web container and tomcat 7.0.91 is packaged
in Kylin's release package, Kylin also has this security issue.
I strongly recommend you take one of the two solutions below for your Kylin
servers to avoid this security issue:
1. Download and install Tomcat 7.0.100 in Kylin
2. Simply comment it out from the $KYLIN_HOME/tomcat/conf/server.xml
file, find comment the following configuration (the specific port may be
different according to the initial configuration, the protocol is confirmed
as protocol="AJP/1.3")
<Connector port="9009" protocol="AJP/1.3" redirectPort="9443" />
Then restart your Kylin instances.
We'll upgrade the packed Tomcat in Kylin's next releases.
---------------------
Best regards,
Ni Chunen / George
Re: Apache Tomcat Security Vulnerability Notice
Posted by ShaoFeng Shi <sh...@apache.org>.
If upgrade Tomcat to 7.0.100, the tomcat/conf/server.xml and the web.xml in
Kylin WEB-INF also need be updated, otherwise the service couldn't start
successfully; Please refer to this:
https://github.com/apache/kylin/commit/74f1f6b7e660891d9460e2b1b083f541b4543a06
Best regards,
Shaofeng Shi 史少锋
Apache Kylin PMC
Email: shaofengshi@apache.org
Apache Kylin FAQ: https://kylin.apache.org/docs/gettingstarted/faq.html
Join Kylin user mail group: user-subscribe@kylin.apache.org
Join Kylin dev mail group: dev-subscribe@kylin.apache.org
George Ni <ni...@apache.org> 于2020年2月22日周六 下午1:01写道：
> Hi Kylin users,
>
> On February 20, China National Vulnerability Database (CNVD) published a
> severe vulnerability in Apache Tomcat’s Apache JServ Protocol (or AJP). For
> Apache Kylin uses Tomcat as the web container and tomcat 7.0.91 is packaged
> in Kylin's release package, Kylin also has this security issue.
>
> I strongly recommend you take one of the two solutions below for your
> Kylin servers to avoid this security issue:
>
> 1. Download and install Tomcat 7.0.100 in Kylin
> 2. Simply comment it out from the $KYLIN_HOME/tomcat/conf/server.xml
> file, find comment the following configuration (the specific port may be
> different according to the initial configuration, the protocol is confirmed
> as protocol="AJP/1.3")
>
> <Connector port="9009" protocol="AJP/1.3" redirectPort="9443" />
>
> Then restart your Kylin instances.
>
> We'll upgrade the packed Tomcat in Kylin's next releases.
>
> ---------------------
>
> Best regards,
>
>
>
> Ni Chunen / George
>
>
Re: Apache Tomcat Security Vulnerability Notice
Posted by ShaoFeng Shi <sh...@apache.org>.
If upgrade Tomcat to 7.0.100, the tomcat/conf/server.xml and the web.xml in
Kylin WEB-INF also need be updated, otherwise the service couldn't start
successfully; Please refer to this:
https://github.com/apache/kylin/commit/74f1f6b7e660891d9460e2b1b083f541b4543a06
Best regards,
Shaofeng Shi 史少锋
Apache Kylin PMC
Email: shaofengshi@apache.org
Apache Kylin FAQ: https://kylin.apache.org/docs/gettingstarted/faq.html
Join Kylin user mail group: user-subscribe@kylin.apache.org
Join Kylin dev mail group: dev-subscribe@kylin.apache.org
George Ni <ni...@apache.org> 于2020年2月22日周六 下午1:01写道：
> Hi Kylin users,
>
> On February 20, China National Vulnerability Database (CNVD) published a
> severe vulnerability in Apache Tomcat’s Apache JServ Protocol (or AJP). For
> Apache Kylin uses Tomcat as the web container and tomcat 7.0.91 is packaged
> in Kylin's release package, Kylin also has this security issue.
>
> I strongly recommend you take one of the two solutions below for your
> Kylin servers to avoid this security issue:
>
> 1. Download and install Tomcat 7.0.100 in Kylin
> 2. Simply comment it out from the $KYLIN_HOME/tomcat/conf/server.xml
> file, find comment the following configuration (the specific port may be
> different according to the initial configuration, the protocol is confirmed
> as protocol="AJP/1.3")
>
> <Connector port="9009" protocol="AJP/1.3" redirectPort="9443" />
>
> Then restart your Kylin instances.
>
> We'll upgrade the packed Tomcat in Kylin's next releases.
>
> ---------------------
>
> Best regards,
>
>
>
> Ni Chunen / George
>
>