Modernize or Die® - CFML News Podcast for December 31st, 2024 - Episode 226

2024-12-31 Weekly News — Episode 226

Watch the video version on YouTube at https://youtube.com/live/BUIfVQV0bhs?feature=share

Hosts: 

• Gavin Pickin - Senior Developer at Ortus Solutions
• Daniel Garcia - Senior Developer at Ortus Solutions

Big Thanks to our Sponsor - Ortus Solutions
The makers of ColdBox, CommandBox, ForgeBox, TestBox and all your favorite box-es out there including BoxLang.
A few ways to say thanks back to Ortus Solutions:

• Buy Tickets to Into the Box 2025 in Washington DC https://t.co/cFLDUJZEyM
• April 30, 2025 - May 2, 2025 - Washington, DC
• Like and subscribe to our videos on YouTube. 
• Help ORTUS reach for the Stars - Star and Fork our Repos
• Star all of your Github Box Dependencies from CommandBox with https://www.forgebox.io/view/commandbox-github 
• Subscribe to our Podcast on your Podcast Apps and leave us a review
• Sign up for a free or paid account on CFCasts, which is releasing new content regularly
• BOXLife store: https://www.ortussolutions.com/about-us/shop
• Buy Ortus’s Books
• 102 ColdBox HMVC Quick Tips and Tricks on GumRoad (http://gum.co/coldbox-tips)
• Now on Amazon! In hardcover too!!!
• https://www.amazon.com/dp/B0CJHB712M
• Learn Modern ColdFusion (CFML) in 100+ Minutes - Free online https://modern-cfml.ortusbooks.com/ or buy an EBook or Paper copy https://www.ortussolutions.com/learn/books/coldfusion-in-100-minutes 

 

Patreon Support (holly)
We have 61 patreons:
https://www.patreon.com/ortussolutions.

News and Announcements

Tomcat Vulnerability
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.
https://www.cve.org/CVERecord?id=CVE-2024-56337

How to resolve with Lucee: https://dev.lucee.org/t/cvs-exploit-of-tomcat-9-10-11/14590

End of 2024 - what did it bring it

What is 2025 bringing?

New Releases and Updates

Adobe Security Updates released December 23rd, 2024 - ColdFusion 2023 Update 12 and 2021 Update 18
We have released critical security updates for ColdFusion (2023 release) and ColdFusion (2021 release).
Adobe is aware that CVE-2024-53961 has a known proof-of-concept that could cause an arbitrary file system read.
View the security bulletin, APSB24-107, and the tech notes for more information.
https://coldfusion.adobe.com/2024/12/released-coldfusion-2023-and-2021-december-23rd-2024-security-updates/

An Initial Analysis of Adobe ColdFusion CVE-2024-53961 - from Hoyahaxa
Adobe released APSB24-107 today, which addresses one vulnerability in ColdFusion tracked as CVE-2024-53961 and described as a path traversal that could lead to file retrieval.  Based on a quick review of the corresponding patches, it appears to be a security enhancement that improves protection (and possibly remediates bypasses) against the attac