DSA-2020-070: Dell Wyse Management Suite and Dell Wyse Management Repository Security Update for Apache Tomcat Vulnerability

The component below is updated for the following vulnerability:

• Apache Tomcat

CVE-2020-1938

For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here, consult the National Vulnerability Database (NVD) at http://nvd.nist.gov/home.cfm.   To search for a particular CVE, use the database’s search utility at http://web.nvd.nist.gov/view/vuln/search.

Affected products:

Dell Wyse Management Suite versions prior to 2.0

Dell Wyse Management Repository versions prior to 2.0

Remediation:
 

The following Dell Wyse Management Suite and Dell Wyse Management Repository releases contains a mitigation to this vulnerability:

• Dell Wyse Management Suite 2.0 or later
• Dell Wyse Management Repository 2.0 or later

Workaround:

Customers can either upgrade to 2.0 or later or choose to apply the workaround listed below to mitigate this vulnerability for existing Dell Wyse Management Suite and Dell Wyse Management Repository releases 1.4.1, 1.4 and 1.3.

1. Identifying the Tomcat installation directory

1. Open the window service panel using "services.msc" command in command prompt.
2. Search "Dell WMS: Tomcat Service" service from the service panel.
3. Open the properties of the searched services.
4. Excluding "bin/Tomcat9.exe" from the "Path to executable" property of the above located service will be the path of Tomcat installation.
5. This obtained value from step (d) will be considered as <CATALINA_BASE> in the steps listed below.

2. Configuration changes
   1. Edit <CATALINA_BASE>/conf/server.xml and locate the following line: (<CATALINA_BASE> is the Tomcat work directory): <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
   2. Comment out (or just delete it): <!--<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />-->
   3. Save the edit.
   4. Restart Tomcat.