Apache Tomcat Vulnerabilities (CVE-2024-50379 and CVE-2024-56337)

Hi Tiago,

Thanks fr reaching out to support.

We have an upgraded Tomcat set to be included in an upcoming release -

Upgraded Apache Tomcat to 9.0.98 for new installs.

In the meantime upgrading Tomcat outside Yellowfin is always a viable option, let us know if there are any impacts with the new version in this case.

Thanks,

Eric

Hi Eric.

Since you are Ok with an immediately upgrade, I will do that.

I will let you know the result of the upgrade.

Thank you.

Best regards,

Tiago

Hi Eric.

After an internal conversation in my company, we think that we should wait for a clear response from your side, stating that it is secure to implement this Apache Tomcat upgrade.

We are not the only ones affected by these CVEs. All, or a high percentage, of your customers must be, as well, affected by this problem.

Yellowfin must have performed tests by now to the most recent version of Apache Tomcat, 9.0.98, to ensure Yellowfin BI runs without any issues.

Thank you.

Best regards,

Tiago

Hi Tiago,

With a ne Tomcat implementation there's quite a bit of testing involved, our operations is in the progress of full testing at this time, and we will be able to confirm support 9.0.98 upon the next official release, I can also request comment on the CVE IDs directly to confirm the impact status of the application, and ask for additional compatibility comments / potential breaking changes related to the upgrades if this sounds like a good way forward. Hope this helps let me know if you have any additional questions.

Hi Eric.

How can I check if the default servlet is enabled for write operations?

I want to update my customers with the current status and I want to be sure about what information I am giving to them.

Thank you.

Best regards,

Tiago

Hi Tiago,

To check if the default servlet is enabled for write operations in Yellowfin, you would typically need to inspect the configuration settings of the Yellowfin server. This involves checking the servlet configuration in the web.xml file or equivalent configuration files where servlets are defined. The Yellowfin configuration DB is de

However, since this is a server-side configuration, it cannot be directly checked using the Yellowfin JS API or any client-side code. You would need access to the server's configuration files to verify this.

If you have access to the server configuration, you can look for the servlet definition related to write operations and check if it is enabled. This might involve checking for specific parameters or flags that indicate whether write operations are allowed.

If you do not have access to the server configuration, you may need to contact your system administrator or the person responsible for managing the Yellowfin server to verify this information.

Hope this helps, let me know if you need anything additionally here.

Thanks,
Eric

Hi Eric.

I did the Yellowfin installation so I have access to the server, but I need specific directions to get the answer I need.

...to inspect the configuration settings...

Which settings?

...checking the servlet configuration in the web.xml file...

...or equivalent configuration files where servlets are defined.

I didn't changed nothing. It is as it was installed.

The Yellowfin configuration DB is de

Some words missing here?

If you have access to the server configuration...

I have access.

...you can look for the servlet definition related to write operations and check if it is enabled. 

web.xml? Other?

This might involve checking for specific parameters or flags...

Which ones? Which value configured to these parameters/flags means that it is configured as read only? Which value configured to these parameters/flags means that it is configured with write permissions?

In the case those parameters/flags doesn't exit in the file. Does it means it allows write operations?

Sorry for the long post, but I need a step-by-step, with everything, in order to get the answer I need. If the answer is inside a file, this includes the path for the file, the name of the file, and what to search for in that file (the parameter, the meaning of the value configured, or if the parameter is missing what that means).

Thank you.

Bets regards,

Tiago

Hi Tiago,

Yellowfin server is configured to be able to write to the SQL server it is installed on. This is by default. The configuration DB needs to be updated along with content and configuration changes. There is no parameter that defines this in either web.xml by default. Clients can implement their own tomcats and JDBC connections, which can set this "read-only" switch differently depending on the implementation. Hope this helps, let me know if you have any additional questions.

Thanks,
Eric