REDHAT-BUG-2457037: Medium severity Apache Tomcat vulnerability
CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.
Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcat Nativeto a version that resolves this vulnerability.Fixed in 1.3.7 - Upgrade
Upgrade
Apache Tomcat Nativeto a version that resolves this vulnerability.Fixed in 2.0.14 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.20 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.53 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.116
Event History
Frequently Asked Questions
What is the vulnerability described in REDHAT-BUG-2457037?
REDHAT-BUG-2457037 describes a vulnerability in Apache Tomcat where CLIENT_CERT authentication does not fail as expected when soft fail is disabled.
What is the severity of REDHAT-BUG-2457037?
The severity of REDHAT-BUG-2457037 is classified as medium, with a score of 4.
Which versions of Apache Tomcat are affected by REDHAT-BUG-2457037?
Apache Tomcat versions affected by REDHAT-BUG-2457037 include 11.0.0-M1 through 11.0.18, 10.1.0-M7 through 10.1.52, and 9.0.83 through 9.0.115.
How can I resolve the vulnerability in REDHAT-BUG-2457037?
To resolve the vulnerability in REDHAT-BUG-2457037, it is recommended to upgrade to a patched version of Apache Tomcat that addresses the issue.
What impact does REDHAT-BUG-2457037 have on security?
The impact of REDHAT-BUG-2457037 can lead to authentication failures not being handled properly, possibly allowing unauthorized access if misconfigured.