2024-12-31 Weekly News — Episode 226
Watch the video version on YouTube at https://youtube.com/live/BUIfVQV0bhs?feature=share
Hosts:
- Gavin Pickin - Senior Developer at Ortus Solutions
- Daniel Garcia - Senior Developer at Ortus Solutions
Big Thanks to our Sponsor - Ortus Solutions
The makers of ColdBox, CommandBox, ForgeBox, TestBox and all your favorite box-es out there including BoxLang.
A few ways to say thanks back to Ortus Solutions:
- Buy Tickets to Into the Box 2025 in Washington DC https://t.co/cFLDUJZEyM
- April 30, 2025 - May 2, 2025 - Washington, DC
- Like and subscribe to our videos on YouTube.
- Help ORTUS reach for the Stars - Star and Fork our Repos
- Star all of your Github Box Dependencies from CommandBox with https://www.forgebox.io/view/commandbox-github
- Subscribe to our Podcast on your Podcast Apps and leave us a review
- Sign up for a free or paid account on CFCasts, which is releasing new content regularly
- BOXLife store: https://www.ortussolutions.com/about-us/shop
- Buy Ortus’s Books
- 102 ColdBox HMVC Quick Tips and Tricks on GumRoad (http://gum.co/coldbox-tips)
- Now on Amazon! In hardcover too!!!
- https://www.amazon.com/dp/B0CJHB712M
- Learn Modern ColdFusion (CFML) in 100+ Minutes - Free online https://modern-cfml.ortusbooks.com/ or buy an EBook or Paper copy https://www.ortussolutions.com/learn/books/coldfusion-in-100-minutes
Patreon Support (holly)
We have 61 patreons:
https://www.patreon.com/ortussolutions.
News and Announcements
Tomcat Vulnerability
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.
https://www.cve.org/CVERecord?id=CVE-2024-56337
How to resolve with Lucee: https://dev.lucee.org/t/cvs-exploit-of-tomcat-9-10-11/14590
End of 2024 - what did it bring it
What is 2025 bringing?
New Releases and Updates
Adobe Security Updates released December 23rd, 2024 - ColdFusion 2023 U
Popular Podcasts
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
24/7 News: The Latest
The latest news in 4 minutes updated every hour, every day.
Therapy Gecko
An unlicensed lizard psychologist travels the universe talking to strangers about absolutely nothing. TO CALL THE GECKO: follow me on https://www.twitch.tv/lyleforever to get a notification for when I am taking calls. I am usually live Mondays, Wednesdays, and Fridays but lately a lot of other times too. I am a gecko.