REDHAT-BUG-2476520: Medium severity Apache Tomcat vulnerability
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.22 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.55 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.118
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2476520?
The severity of REDHAT-BUG-2476520 is medium, rated at 4.
What is the nature of the vulnerability described in REDHAT-BUG-2476520?
REDHAT-BUG-2476520 is related to the improper handling of case sensitivity in the LockOutRealm component of Apache Tomcat.
How do I fix the vulnerability identified as REDHAT-BUG-2476520?
To fix REDHAT-BUG-2476520, update Apache Tomcat to a version that is not affected, such as versions beyond 11.0.21, 10.1.54, 9.0.117, 8.5.100, and 7.0.109.
Which versions of Apache Tomcat are affected by REDHAT-BUG-2476520?
REDHAT-BUG-2476520 affects Apache Tomcat versions from 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109.
What are the potential risks of not addressing REDHAT-BUG-2476520?
Failing to address REDHAT-BUG-2476520 could lead to unauthorized access through case sensitivity issues in user credentials in Apache Tomcat.