Описание
Apache Tomcat - Digest authenticator will authenticate any unknown user
Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected
Description: When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null".
Mitigation: Users of the affected versions should apply one of the following mitigations:
- Upgrade to Apache Tomcat 11.0.22 or later
- Upgrade to Apache Tomcat 10.1.55 or later
- Upgrade to Apache Tomcat 9.0.118 or later
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2026-43512
- https://github.com/apache/tomcat/commit/3d4d3fae07a6cd9c2eb193c5491001740ec64448
- https://github.com/apache/tomcat/commit/6565a6cb6499e56fe2f34457cec99f9d1c4f39e9
- https://github.com/apache/tomcat/commit/a99c355e8199adbfd67c9a1fffbd85b810b196cd
- https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-9.html
- http://www.openwall.com/lists/oss-security/2026/05/12/8
Пакеты
org.apache.tomcat.embed:tomcat-embed-core
< 9.0.118
9.0.118
org.apache.tomcat.embed:tomcat-embed-core
>= 10.1.0-M1, < 10.1.55
10.1.55
org.apache.tomcat.embed:tomcat-embed-core
>= 11.0.0-M1, < 11.0.22
11.0.22
org.apache.tomcat:tomcat
< 9.0.118
9.0.118
org.apache.tomcat:tomcat
>= 10.1.0-M1, < 10.1.55
10.1.55
org.apache.tomcat:tomcat
>= 11.0.0-M1, < 11.0.22
11.0.22
org.apache.tomcat:tomcat-catalina
< 9.0.118
9.0.118
org.apache.tomcat:tomcat-catalina
>= 10.1.0-M1, < 10.1.55
10.1.55
org.apache.tomcat:tomcat-catalina
>= 11.0.0-M1, < 11.0.22
11.0.22
Связанные уязвимости
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
DEPRECATED: Authentication Bypass Issues vulnerability in digest authe ...
Уязвимость сервера приложений Apache Tomcat, связанная с обходом аутентификации, позволяющая нарушителю повысить свои привилегии