REDHAT-BUG-2539355: High severity Apache Tomcat vulnerability
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.
The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.26 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.60 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.122
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running affected Apache Tomcat versions with WebSocket endpoints protected by security constraints are exposed. The issue affects the listed supported release lines as well as the identified end-of-support Tomcat 8.5 and 7.0 versions; other unsupported versions may also be affected.
What does an attacker need to exploit the vulnerability?
The vulnerability concerns bypassing security constraints for WebSocket endpoints by using an alternate name. The provided information does not specify any additional attacker prerequisites.
What versions remediate the issue?
Upgrade to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122. These versions fix the vulnerability.