Описание
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 10.1.53 |
| esm-apps/noble | needed | |
| esm-apps/resolute | needed | |
| jammy | DNE | |
| noble | needed | |
| questing | ignored | end of life, was needed |
| resolute | needed | |
| upstream | released | 10.1.53 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 11.0.20 |
| esm-apps/resolute | needed | |
| jammy | DNE | |
| noble | DNE | |
| questing | ignored | end of life, was needed |
| resolute | needed | |
| upstream | released | 11.0.20 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps-legacy/xenial | not-affected | code not present |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| esm-infra-legacy/trusty | not-affected | code not present |
| jammy | DNE | |
| noble | DNE | |
| questing | DNE | |
| resolute | DNE | |
| upstream | ignored | end of life |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps-legacy/xenial | not-affected | code not present |
| esm-apps/bionic | not-affected | code not present |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| esm-infra-legacy/trusty | not-affected | code not present |
| jammy | DNE | |
| noble | DNE | |
| questing | DNE | |
| resolute | DNE | |
| upstream | ignored | end of life |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/bionic | not-affected | code not present |
| esm-infra-legacy/xenial | not-affected | code not present |
| esm-infra/xenial | ignored | end of ESM support, was needs-triage |
| jammy | DNE | |
| noble | DNE | |
| questing | DNE | |
| resolute | DNE | |
| upstream | ignored | end of life |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 9.0.116 |
| esm-apps/bionic | not-affected | code not present |
| esm-apps/focal | not-affected | code not present |
| esm-apps/jammy | not-affected | code not present |
| esm-apps/noble | not-affected | code not present |
| esm-apps/resolute | needed | |
| jammy | not-affected | code not present |
| noble | not-affected | code not present |
| questing | ignored | end of life, was needed |
| resolute | needed |
Показывать по
EPSS
9.1 Critical
CVSS3
Связанные уязвимости
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
CLIENT_CERT authentication does not fail as expected for some scenario ...
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
Уязвимость сервера приложений Apache Tomcat, связанная с недостатками процедуры аутентификации, позволяющая нарушителю повысить свои привилегии
EPSS
9.1 Critical
CVSS3