Find, fix and prevent vulnerabilities in your code.

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Incorrect Authorization via the FormAuthenticator and AuthenticatorBase FORM authentication flow. An attacker can bypass a security constraint that allows access to a resource for POST but not GET by authenticating through FORM login and restoring a saved request with a different HTTP method. This lets a request that should be blocked reach the protected resource, exposing content or actions that the user should not be allowed to access with that method.

Notes

• The issue was fixed in Apache Tomcat 10.1.58, but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.121, 10.1.58, 11.0.25 or higher.

References

• Apache Security Advisory
• GitHub Commit 10.1.58
• GitHub Commit 11.0.25
• GitHub Commit 9.0.121

Overview

org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation.

Affected versions of this package are vulnerable to Replay Attack in the DIGEST authenticator’s nonce-count window handling. An attacker can reuse a valid DIGEST-authenticated request once by sending a request with a nonce count at the upper boundary of the replay window before the window has filled. This allows a captured authentication message to be replayed successfully within the same nonce-count window, letting the attacker impersonate an authenticated user and perform requests accepted as that user.

Notes

• The issue was fixed in Apache Tomcat 10.1.58, but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for this issue, version 10.1.58 is not included in the list of affected versions.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-core to version 9.0.121, 10.1.59, 11.0.25 or higher.

References

• Apache Security Advisory
• GitHub Commit 10.1.58
• GitHub Commit 11.0.25
• GitHub Commit 9.0.121

Overview

Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name via the WebSocket endpoint security constraint handling. An attacker can gain unauthorized access to protected resources by connecting to endpoints using alternate names.

Remediation

Upgrade org.apache.tomcat.embed:tomcat-embed-websocket to version 9.0.122, 10.1.60, 11.0.26 or higher.

References

• Apache Mailing List
• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Improper Certificate Validation in the isEmailConstrained() and isURIConstrained() methods of PKIXNameConstraintValidator, which compare rfc822Name and URI subjectAltName values with a bare equalsIgnoreCase() and do not strip a trailing dot the way the dNSName path does. An attacker who controls a name-constrained intermediate CA can issue certificates for email and URI hosts that an excludedSubtrees constraint was meant to block, for example ceo@bank.com. against an exclusion of bank.com, by appending a trailing dot so the value no longer matches the constraint. This affects only the email and URI constraint paths and not dNSName, and it requires a relying party to validate certificate paths through this validator with name constraints in force.

Remediation

Upgrade org.bouncycastle:bcprov-jdk18on to version 1.85 or higher.

References

• GitHub Commit
• GitHub Wiki

Overview

Affected versions of this package are vulnerable to Improper Certificate Validation in the check() method of ProvOcspRevocationChecker, which verifies a stapled OCSP response's signature and then treats the certificate as unrevoked when no SingleResponse entry matches its CertID, without requiring a binding match. An attacker can present a revoked certificate that BC-based clients accept as valid by stapling any legitimately signed OCSP response from the same CA, such as a good response for a different serial number. This applies when the client uses BC revocation checking with the response supplied through the stapled PKIXRevocationChecker.setOcspResponses() path rather than fetched over the network, and the response must be validly signed by the same issuer.

Remediation

Upgrade org.bouncycastle:bcprov-jdk18on to version 1.85 or higher.

References

• GitHub Commit
• GitHub Wiki