Описание
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists (CRLs) for a FFM (presumably a specific type of connector), the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security controls might not be properly enforced.
Отчет
A flaw in Apache Tomcat's FFM-based connector causes errors loading configured Certificate Revocation Lists (CRLs) to be ignored, which could allow certificates that should be rejected to be accepted. Upstream affected versions are 9.0.83 through 9.0.118, 10.1.0-M7 through 10.1.55, and 11.0.0-M1 through 11.0.22. The affected path requires the FFM connector and CRL-based certificate revocation checking with invalid CRL data.
Меры по смягчению последствий
This vulnerability only affects Tomcat deployments using the FFM-based connector (requires Java 22+) with CRL-based certificate revocation checking. Deployments using the standard NIO/NIO2 connectors or not using CRL checking are not affected.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | tomcat | Fix deferred | ||
| Red Hat Enterprise Linux 6 | tomcat6 | Fix deferred | ||
| Red Hat Enterprise Linux 7 | tomcat | Fix deferred | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/pki-servlet-engine | Fix deferred | ||
| Red Hat Enterprise Linux 9 | pki-servlet-engine | Fix deferred | ||
| Red Hat JBoss Web Server 5 | jws5-tomcat | Fix deferred | ||
| Red Hat Enterprise Linux 10 | tomcat9 | Fixed | RHSA-2026:68651 | 18.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | tomcat9 | Fixed | RHSA-2026:67163 | 14.09.2026 |
| Red Hat Enterprise Linux 8 | tomcat | Fixed | RHSA-2026:68677 | 17.09.2026 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | tomcat | Fixed | RHSA-2026:68680 | 17.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
Detection of Error Condition Without Action vulnerability in Apache To ...
EPSS
3.7 Low
CVSS3