Status/Resolution/Reason: To Track//NeedMoreInfo
Reporter/Name(from Bugbase): Michael L. / ()
Created: 11/06/2019
Components: Installation/Config, Connector
Versions: 2016
Failure Type: Non Functioning
Found In Build/Fixed In Build: 2016,0,12,315717 /
Priority/Frequency: Normal / Some users will encounter
Locale/System: English / Win 2012 Server x64
Vote Count: 0
Problem Description: After applying Update 12, we started to notice errors when accessing some ColdFusion and .NET web sites on the same server. I mention .NET as we use a single connector for all of the web sites, so they all also have the Tomcat ISAPI filter added to them. The errors is:
404 - File or directory not found.
The resource you are looking for might have been removed, had it name changed, or is temporary unavailable.
The requested URL was not found on the server!
If you entered the URL manually please check your spelling and try again.
Tomcat/ISAPI/isapi_redirector/1.2.46
We are getting rather large isapi_redirect.log file in <ColdFusion install>\config\wsconfig\1 with entries like:
[Wed Nov 06 02:48:13.412 2019] [17784:21472] [warn] jk_check_for_path_attack::jk_util.c (2457): Path attack using [/]
Is there a security setting that is too sensitive?
We notice in the patch notes, "It includes some library upgrades and also upgrades the Tomcat version to 8.5.42." so we are kind of thinking Tomcat is the culprit here.
Steps to Reproduce:
Install ColdFusion and apply Update 12.
Actual Result:
Intermittent 404 errors
Expected Result:
No intermittent 404 errors
Any Workarounds:
For non-ColdFusion websites add the following to the web.config under the <system.webServer> to remove the Tomcat ISAPI filter.
<isapiFilters>
<remove name="tomcat" />
</isapiFilters>Attachments:
Comments: