Описание
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.
A flaw was found in Apache Tomcat. When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker could exploit a missing critical step in the authentication process. This allowed the attacker to bypass password verification and authenticate without providing the correct password, leading to unauthorized access.
Отчет
This issue is rated as Important severity because it allows an attacker to fully bypass password verification when authenticating against a Tomcat instance, potentially gaining unauthorized access to protected resources without any privileges or user interaction required.
Меры по смягчению последствий
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | tomcat6 | Not affected | ||
| Red Hat Enterprise Linux 7 | tomcat | Affected | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/pki-servlet-engine | Not affected | ||
| Red Hat Enterprise Linux 9 | pki-servlet-engine | Not affected | ||
| Red Hat JBoss Web Server 5 | jws5-tomcat | Will not fix | ||
| Red Hat Enterprise Linux 10 | tomcat9 | Fixed | RHSA-2026:18536 | 19.05.2026 |
| Red Hat Enterprise Linux 10 | tomcat | Fixed | RHSA-2026:18537 | 19.05.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | tomcat9 | Fixed | RHSA-2026:67163 | 14.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | tomcat | Fixed | RHSA-2026:67164 | 14.09.2026 |
| Red Hat Enterprise Linux 8 | tomcat | Fixed | RHSA-2026:68677 | 17.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.
Missing Critical Step in Authentication vulnerability in Apache Tomcat ...
Apache Tomcat has a Missing Critical Step in Authentication vulnerability
EPSS
7.3 High
CVSS3