Description
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | commons-daemon | 1.0.7-1 | — |
| Debian 13 | commons-daemon | 1.0.7-1 | — |
| Debian 12 | commons-daemon | 1.0.7-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 1 | jakarta-commons-daemon-jsvc | 1:1.0.5-1.5.patch01.ep5.el4 | RHSA-2011:1292 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-commons-daemon | 1.0.15-7.7 | openSUSE-SU-2024:10167-1 |
Advisories 2
- RHSA-2011:1292 Red Hat Security Advisory: jakarta-commons-daemon-jsvc security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- openSUSE-SU-2024:10167-1 apache-commons-daemon-1.0.15-7.7 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- tomcat-jsvc-info-disclosure(69161) vdb-entry
- openSUSE-SU-2011:1062 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1153824
- HPSBUX02860 vendor-advisory
- 1025925 vdb-entry
- http://people.apache.org/~markt/patches/2011-08-12-cve2011-2729-tc5.patch
- http://tomcat.apache.org/security-7.html
- HPSBOV02762 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=730400
- RHSA-2011:1291 vendor-advisory
- SSRT100627 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1152701
- http://svn.apache.org/viewvc?view=revision&revision=1153379
- 20110812 [SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat) mailing-list
- http://tomcat.apache.org/security-6.html
- 57126 third-party-advisory
- [commons-dev] 20110812 [AANNOUNCE] Apache Commons Daemon 1.0.7 released mailing-list
- https://issues.apache.org/jira/browse/DAEMON-214
- 49143 vdb-entry
- oval:org.mitre.oval:def:19450 vdb-entry signature
- 46030 third-party-advisory
- http://tomcat.apache.org/security-5.html
- RHSA-2011:1292 vendor-advisory
- [tomcat-announce] 20110812 [SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat) mailing-list
- HPSBST02955 vendor-advisory
- oval:org.mitre.oval:def:14743 vdb-entry signature
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list