- You are using an Apache Tomcat version affected by the vulnerability CVE-2020-1938
- Tomcat 9.0.22 distributed with ESMC 7.1 is also affected by the vulnerability
See the vulnerability description here: CVE-2020-1938.
The affected Apache Tomcat versions are:
- 9.0.0.M1 - 184.108.40.206
- 8.5.0 - 8.5.50
- 7.0.0 - 7.0.99
In the affected versions, the Apache Tomcat treats AJP connections as having higher trust than other connections. ESET Security Management Center and ESET Remote Administrator are not using the AJP connector.
There are three possible solutions to this issue. You need to apply only one of them:
Solution 1: Update the Apache Tomcat version using the all-in-one installer
Use the ESMC 220.127.116.11 all-in-one installer for Windows to upgrade your Apache Tomcat. See the KB article with detailed steps.
Solution 2: Block the AJP port
Block theApache JServ Protocol(AJP) port 8009 for incoming connections on your firewall:
Windows Server usually blocks the port by default, but you can create a new explicit rule to block the port. If you manage your firewall with a security product, use the product to create a rule to block inbound connections on port 8009.
You can check if the port is open by using the following command:
netstat -ano | findstr 8009
Make sure to block the port 8009 using your security product or via Linux utility iptables.
If you use iptables, run following command as superuser:
iptables -A INPUT -j DROP --destination-port 8009
You can check if the port is open using the following command:
ss -a | grep 8009
ERA / ESMC Virtual Appliance users
No action is required. The firewall on the Appliance is pre-set to block all connections not related to ESET products.
Solution 3: Disable the AJP connector
Disable the AJP connector in the Tomcat configuration. Use this solution if you need to continue using port 8009.
- Open the Tomcat configuration for editing:
C:\Program Files\Apache Software Foundation\[ Tomcat folder ]\conf\server.xml
Search for "8009" and comment out the line about AJP protocol:
- Save the changes in the file.
- Restart the Apache Tomcat service.