<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Date: 2 March 2019<br>
Severity: Informational<br>
Affected versions: all released midPoint versions<br>
Fixed in versions: N/A<br>
<br>
Description<br>
<br>
Apache JServ Protocol (AJP) of Apache Tomcat may be vulnerable to
several types of attack.<br>
<br>
Severity and Impact<br>
<br>
This vulnerability does not affect midPoint application per se.
However, it may impact deployment that are not using the stand-alone
deployment model. Such deployment may use Apache Tomcat servers that
may be vulnerable to Ghostcat attacks.<br>
<br>
Mitigation<br>
<p>Mitigation depends on the deployment model:</p>
* Stand-alone deployment of midPoint (default): no need to mitigate.
Stand-alone midPoint deployment is not vulnerable to Ghostcat as AJP
connector is not enabled in the embedded Tomcat instance.<br>
* Explicit deployment of midPoint (WAR file): disable or secure AJP
connector in your Apache Tomcat instance.<br>
<br>
See Also<br>
<br>
* <a class="external-link"
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1938"
rel="nofollow">CVE-2020-1938</a><br>
* <a moz-do-not-send="true"
href="https://wiki.evolveum.com/display/midPoint/Security+Advisory%3A+Ghostcat+Vulnerability+of+Apache+Tomcat">https://wiki.evolveum.com/display/midPoint/Security+Advisory%3A+Ghostcat+Vulnerability+of+Apache+Tomcat</a><br>
<br>
<pre class="moz-signature">--
Radovan Semancik
Software Architect
evolveum.com
</pre>
</body>
</html>