Does this impact ACF? https://thehackernews.com/2024/12/apache-tomcat-vulnerability-cve-2024.html

From the reporting, it looks like if you are running it on Linux, no issues. If you are on Windows and not on Java 17, no issues. If you are on Windows and Java 17, you need to make sure you didn't specifically muck with the Tomcat server.xml settings for ACF or Lucee. Default settings from what I can tell are OK.

@quetwo I love your profile picture Good info, I'll check into those things. Hopefully ACF will deploy a patch to ensure the settings are set correctly regardless.

I'm sure they will roll up the latest versions of Tomcat in the next patch. But this vulnerability looks like it could possibly impact only CF installs where people are mucking with the install for a special purpose. So, not a huge audience.

compile, patch, install cf as a war and move on.

ugh - our security team is already bugging us to update Tomcat to deal with this. 😞 (and we're on Java 11 on Windows, so apparently we're not at risk... but they don't care about that. they only care about what version you're running.)