跳转到帖子

Debian: CVE-2024-52316: tomcat10, tomcat9 -- security update

recommended_posts

发布于
  • Members

Debian: CVE-2024-52316: tomcat10, tomcat9 -- security update

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
11/18/2024
Created
11/26/2024
Added
11/25/2024
Modified
01/20/2025

Description

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

Solution(s)

  • debian-upgrade-tomcat10
  • debian-upgrade-tomcat9

References

  • https://attackerkb.com/topics/cve-2024-52316
  • CVE - 2024-52316
  • DLA-4017-1
  • DSA-5845-1
  • 查看数 695
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…