Apache Tomcat: Bypass of rules in Rewrite Valve
Résumé
Apache Tomcat: Bypass of rules in Rewrite Valve
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible
for a specially crafted request to bypass some rewrite rules. If those
rewrite rules effectively enforced security constraints, those
constraints could be bypassed.
This issue affects Apache Tomcat: from 11.0.0 through 11.0.5, from 10.1.0 through 10.1.39, from 9.0.0 through 9.0.102.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.
Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-31651 tomcat10 Corrigé dans: 10.1.40-1
- Ubuntu UBUNTU-CVE-2025-31651 tomcat8
Références
- advisory openwall.com
- advisory lists.apache.org
- web nvd.nist.gov
- web lists.debian.org