Search code examples
securitytomcatartifactory

vulnerable Tomcat 10.1.31 embedded in Artifactory 7.98.13

Tenable Nessus reports a vulnerable Tomcat 10.1.31 on the path /opt/jfrog/artifactory/app/access/

This looks like an embedded Tomcat instance.

The JFrog Artifactory package installed is jfrog-artifactory-oss 7.98.13.

Official release notes show an incremental patch version: 7.98.14, but no hint about a Tomcat upgrade.

The vulnerability in question is CVE-2024-50379. It is fixed in Tomcat 10.1.34.

I did not find any information (official source or not) on whether JFrog Artifactory is affected by this vulnerability. Neither did I find anything on a recommended solution, patch or mitigation.

(I presume that touching the embedded Tomcat is not a good idea.)

What is JFrog official position on this specific CVE?

Solution

  • See relevant documentation here. It is mentioned that Artifactory is not impacted by this vulnerability.