REDHAT-BUG-2326972: Low severity Apache Tomcat vulnerability
Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.
Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache/tomcatto a version that resolves this vulnerability.Fixed in 11.0.0 - Upgrade
Upgrade
apache/tomcatto a version that resolves this vulnerability.Fixed in 10.1.31 - Upgrade
Upgrade
apache/tomcatto a version that resolves this vulnerability.Fixed in 9.0.96
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2326972?
The severity of REDHAT-BUG-2326972 is currently rated as critical due to the potential impacts on authentication security in Apache Tomcat.
How do I fix REDHAT-BUG-2326972?
To fix REDHAT-BUG-2326972, ensure that any custom Jakarta Authentication ServerAuthContext components correctly handle exceptions and explicitly set an HTTP status on failure.
What versions of Apache Tomcat are affected by REDHAT-BUG-2326972?
Apache Tomcat versions 11.0.0-M1 to 11.0.0-M26, 10.1.0-M1 to 10.1.30, and 9.0.0-M1 to 9.0.95 are affected by REDHAT-BUG-2326972.
What components are involved in REDHAT-BUG-2326972?
REDHAT-BUG-2326972 involves the Jakarta Authentication ServerAuthContext component within Apache Tomcat.
What could happen if REDHAT-BUG-2326972 is exploited?
If REDHAT-BUG-2326972 is exploited, it could lead to unhandled authentication failures, potentially allowing unauthorized access to the application.