A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
JNDI レルムで GSSAPI 以外の SASL 認証方式を使用している場合、攻撃者が正しいパスワードを提示せずに認証を通過できる脆弱性です。影響を受けるのは Apache Tomcat 11.0.26 以前、10.1.60 以前、9.0.122 以前などです。11.0.27、10.1.61、9.0.123 以降へ更新してください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat |
11.0.0-M1 – 11.0.26 10.1.0-M1 – 10.1.60 9.0.0.M1 – 9.0.122 8.5.0 – 8.5.100 7.0.0 – 7.0.109 |
— — — — — |
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-101296 tomcat11
Description d'origine La description telle que publiée par la source (souvent en anglais).
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Références
- REDHAT Red Hat
- web security@apache.org
- web nvd.nist.gov
- web github.com
- web openwall.com