Описание
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
A flaw was found in Apache Tomcat Native, which enabled several insecure OpenSSL options by default: ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX. These defaults can weaken TLS protections. Apache Tomcat Native versions 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 are affected; the issue is fixed in versions 1.3.9 and 2.0.16.
Отчет
Red Hat rates this flaw Moderate. Apache also rates it Moderate. The issue is caused by insecure OpenSSL options being enabled by default in Apache Tomcat Native. Red Hat's CVSS 3.1 score is 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). The CVE record also includes a CISA ADP score of 9.1 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The assessments differ in their evaluation of attack complexity and confidentiality and integrity impact.
Меры по смягчению последствий
Upgrade Apache Tomcat Native to version 1.3.9 or 2.0.16, as applicable. For JBoss Web Server, apply the corresponding Red Hat security update when available. Apache’s advisory does not list an alternative workaround.
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
Initialization of a resource with an insecure default vulnerability in ...
EPSS
5.3 Medium
CVSS3