From our other sites
The story
On October 20, the Apache Software Foundation announced eight vulnerabilities in “Apache Tomcat,” the Java server used to run web applications. CVSS scores reach as high as 9.1, with some rated “CRITICAL,” and the issues can be fixed by updating to v9.0.123, v10.1.61, or v11.0.27. On the forum thread, a wave of posters mistook Tomcat for a plain web server based on the “Apache” name, with some surprised to learn it’s actually a Java servlet container, while others in the field braced for a weekend of emergency work. A few posts speculated about a link to Japan’s My Number ID card system, but these were unsubstantiated guesses rather than confirmed reports.
On October 20, the Apache Software Foundation (ASF) disclosed a total of eight vulnerabilities in “Apache Tomcat.” They affect the v9, v10, and v11 branches of “Apache Tomcat.” Severity ratings differ between ASF’s own assessment and CVSS 3.1/4.0, but the set includes a vulnerability with a maximum CVSS 3.1/4.0 score of 9.1 (CRITICAL).
All of the vulnerabilities can be addressed by updating to “Apache Tomcat” v9.0.123, v10.1.61, or v11.0.27, released on October 12. The CVE numbers, severity ratings, and the affected currently-supported versions for each vulnerability are as follows.
(details omitted)
Source: news.yahoo.co.jp / Original article here
What people said
don't stop
Don't stop, Don't stop the server
Don't stop, Don't stop the server
Play me more of that stylish tune
Just a construction gig, after all~ (´・ω・`)♪ (IT work self-deprecatingly compared to manual labor)
Lots of middle-aged guys in here lol
Looks like my weekend shift is confirmed
So it's not that big a deal then
If I grind through the procedure doc review now,
I could probably still swing the late-night shift tomorrow… (´・ω:;.:… (trailing off in dread)
There's been a bunch of CVEs in Apache Tomcat's security library, but
we don't use anything that fancy, so we're fine
WebSocket stuff gets CVEs all the time too, but
we don't use anything that fancy, so we're fine
We've only got PUT and GET implemented — it's such an outdated, janky system that it's actually safe BECAUSE of that
You don't do JS at all?
Async POST via Ajax is pretty standard stuff, isn't it?
Ta-ppoi ta-ppoi♪ (nonsense scat-singing syllables)
Thought this was just a website issue,
but then PHP got compromised,
and now even Apache above it too?
Apache's a different story
Well, for that one at least you'd hope they'd use nginx, right?
This one's worse than the PHP thing
Wait, really?
Are a lot of people here thinking it's a web server?
I guess if you've never touched Java, you wouldn't know "Tom Cat" (nickname for Tomcat)
Oops
I was just going off reflex there
Right, it's a servlet
That knowledge is long gone from my brain now
Though I'd probably remember if I touched it again
and
Tomcat
basically every server's going down over this
I'll only freak out if 5ch itself goes down
Only the antique relic servers, though
The 5ch server runs on magnetic tape and COBOL, so it's fine
Think of it as a kind of go-between for Java. Basically, an API like that comes built into Apache by default — that's roughly the right mental image.
Yeah, back in the J2EE days
I'm amazed everyone just went along with such a bizarre spec lol
Re: #87
These guys seem to think it's a web server too~
Guess "Tom Cat" really isn't famous, huh
Wasn't Boot, but I did touch plain Spring for a bit~ brings back memories
That was the last time I used Java
Got reassigned to Node.js right after that though 😓
I hope FANZA is okay at least (joking aside — FANZA is a Japanese adult content site, unrelated jab)
Grab your My Number card and run
Having the card doesn't actually raise your risk of something leaking from a server-side vulnerability.
Even people without the card already have a My Number assigned to them, and it's used across all sorts of data.
The real risk of holding the physical card is stuff like theft or losing it.
There's still Ruby…!
Plus the .NET crowd and the self-styled 'elite' Python types
Welp, the internet's over then
Re: #124
Those languages are probably flooded with sloppy code too these days — all "vibe coding" with zero thought given to secure development or quality
Humanity just wasn't ready for the internet yet
I mean, surely the pros handling a top-secret government project wouldn't actually use PHP… right? lol
Seriously, tell me that's not true… lol
Wasn't it LINE that built the old My Number Portal?
The subcontracting chain is such a black box that nobody actually knows who's building what anymore, probably
The big-name IT vendors skim off their cut like construction contractors,
and the people actually writing the code are unmotivated temp workers
I once worked a job migrating Oracle to Postgres
and Java to PHP
Background and Key Points of This Discussion
Apache Tomcat carries the name “Apache,” but it’s actually a separate project from the Apache HTTP Server itself — it’s an application server that runs Java servlets and JSP, not a web server. It’s commonly paired with frameworks like Spring Boot in corporate business systems and government backend infrastructure, and because end users rarely encounter it directly, the thread was full of people admitting they’d mistaken it for a plain web server. A CVSS score of 9.1 means an attack could potentially succeed without authentication, so leaving it unpatched carries serious risk. That said, whether systems tied to Japan’s My Number ID card are actually affected by this vulnerability was never confirmed within the thread — readers should keep in mind that those claims were nothing more than anxious speculation.
*This article is compiled from excerpts and a summary of the 5ch (Breaking News+) thread “[IT] “Apache Tomcat” Hit by Maximum-Severity “CRITICAL” Vulnerability.”
Leave a Reply