Описание
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Older unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks.
Отчет
A flaw was found in Apache Tomcat's LockOutRealm. When configured with an underlying Realm where usernames are case-insensitive, the LockOutRealm does not account for case differences, potentially reducing the effectiveness of brute-force protection. Exploitation requires LockOutRealm to be configured with a case-insensitive authentication backend, which is a non-default configuration.
Меры по смягчению последствий
This vulnerability only affects Tomcat deployments using the LockOutRealm with a case-insensitive authentication backend. Deployments not using LockOutRealm or using case-sensitive authentication backends are not affected.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | tomcat | Affected | ||
| Red Hat Enterprise Linux 10 | tomcat9 | Affected | ||
| Red Hat Enterprise Linux 6 | tomcat6 | Out of support scope | ||
| Red Hat Enterprise Linux 7 | tomcat | Will not fix | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/pki-servlet-engine | Affected | ||
| Red Hat Enterprise Linux 8 | tomcat | Affected | ||
| Red Hat Enterprise Linux 9 | pki-servlet-engine | Affected | ||
| Red Hat Enterprise Linux 9 | tomcat | Affected | ||
| Red Hat JBoss Web Server 6.2.4 | tomcat-catalina | Fixed | RHSA-2026:43402 | 22.07.2026 |
| Red Hat JBoss Web Server 6.2 on RHEL 10 | jws6-tomcat | Fixed | RHSA-2026:43401 | 22.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in ...
EPSS
5.3 Medium
CVSS3