Описание
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or reduced security posture.
Отчет
This flaw is rated as Moderate severity because successful exploitation requires winning a precise race condition during concurrent TLS handshakes, limiting the predictability of an attack. Impact is restricted to environments where Apache Tomcat Native is explicitly configured to perform mutual TLS and validate client certificates, which is not an active configuration by default in Red Hat JBoss Web Server. An attacker must precisely time multi-threaded connection requests to cause an authentication requirement downgrade.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Web Server 5 | jws5-tomcat-native | Will not fix | ||
| Red Hat JBoss Web Server 6.2.6 | jws6-tomcat-native | Fixed | RHSA-2026:96229 | 09.11.2026 |
| Red Hat JBoss Web Server 6.2 on RHEL 10 | jws6-mod_cluster | Fixed | RHSA-2026:96228 | 09.11.2026 |
| Red Hat JBoss Web Server 6.2 on RHEL 10 | jws6-tomcat | Fixed | RHSA-2026:96228 | 09.11.2026 |
| Red Hat JBoss Web Server 6.2 on RHEL 10 | jws6-tomcat-native | Fixed | RHSA-2026:96228 | 09.11.2026 |
| Red Hat JBoss Web Server 6.2 on RHEL 8 | jws6-mod_cluster | Fixed | RHSA-2026:96228 | 09.11.2026 |
| Red Hat JBoss Web Server 6.2 on RHEL 8 | jws6-tomcat | Fixed | RHSA-2026:96228 | 09.11.2026 |
| Red Hat JBoss Web Server 6.2 on RHEL 8 | jws6-tomcat-native | Fixed | RHSA-2026:96228 | 09.11.2026 |
| Red Hat JBoss Web Server 6.2 on RHEL 9 | jws6-mod_cluster | Fixed | RHSA-2026:96228 | 09.11.2026 |
| Red Hat JBoss Web Server 6.2 on RHEL 9 | jws6-tomcat | Fixed | RHSA-2026:96228 | 09.11.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.8 Medium
CVSS3
Связанные уязвимости
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
Race condition within a thread vulnerability in Apache Tomcat Native a ...
EPSS
4.8 Medium
CVSS3