Описание
Apache Tomcat - AJP secret compared in non-constant time
Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected
Description: The AJP secret was compared in non-constant time allowing an attacker on the local network to mount a timing attack to determine the AJP secret.
Mitigation: Users of the affected versions should apply one of the following mitigations:
- Upgrade to Apache Tomcat 11.0.22 or later
- Upgrade to Apache Tomcat 10.1.55 or later
- Upgrade to Apache Tomcat 9.0.118 or later
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2026-43514
- https://github.com/apache/tomcat/commit/933dcdbf2515972280002929e7e597dead2e9ffa
- https://github.com/apache/tomcat/commit/a102a2a157868ca51d83eaf5a119ccd9976a113e
- https://github.com/apache/tomcat/commit/d35d9d23263c8e4af561f615c960c91697ff200e
- https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-9.html
- http://www.openwall.com/lists/oss-security/2026/05/12/10
Пакеты
org.apache.tomcat.embed:tomcat-embed-core
< 9.0.118
9.0.118
org.apache.tomcat.embed:tomcat-embed-core
>= 10.1.0-M1, < 10.1.55
10.1.55
org.apache.tomcat.embed:tomcat-embed-core
>= 11.0.0-M1, < 11.0.22
11.0.22
org.apache.tomcat:tomcat
< 9.0.118
9.0.118
org.apache.tomcat:tomcat
>= 10.1.0-M1, < 10.1.55
10.1.55
org.apache.tomcat:tomcat
>= 11.0.0-M1, < 11.0.22
11.0.22
org.apache.tomcat:tomcat-catalina
< 9.0.118
9.0.118
org.apache.tomcat:tomcat-catalina
>= 10.1.0-M1, < 10.1.55
10.1.55
org.apache.tomcat:tomcat-catalina
>= 11.0.0-M1, < 11.0.22
11.0.22
Связанные уязвимости
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Observable Timing Discrepancy vulnerabilitywhen comparing AJP secret i ...
Уязвимость сервера приложений Apache Tomcat, связанная с раскрытием информации из-за несоответствия во времени, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации