0Xcc.Zhang

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Struts versions 2.5.14 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 **Description** An asymmetric resource consumption (amplification) issue exists when a request parameter is bound to a `java.math.BigDecimal` property and subsequently rendered via the Struts tag library. This allows an unauthenticated remote attacker to trigger responses significantly larger than the initial request, potentially exhausting server CPU and outbound network capacity through sustained low-volume traffic. **Recommendations** Upgrade versions 2.5.14 through 2.5.33 to version 6.12.0 or 7.4.0. Upgrade versions 6.0.0 through 6.11.0 to version 6.12.0 or 7.4.0. Upgrade versions 7.0.0 through 7.3.0 to version 7.4.0.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.25 Apache Tomcat versions 10.1.0-M1 through 10.1.59 Apache Tomcat versions 9.0.0.M4 through 9.0.121 Apache Tomcat versions 8.5.0 through 8.5.100 **Description** An improper authentication issue exists when Jakarta Authentication is configured using `SimpleAuthConfigProvider` as the default provider across multiple web applications. In this scenario, the realm used by the first web application to authenticate a request is incorrectly applied to all other web applications. **Recommendations** Upgrade to version 11.0.26 Upgrade to version 10.1.60 Upgrade to version 9.0.122 Restrict the use of `SimpleAuthConfigProvider` as the default provider when multiple web applications are deployed.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Apache Tomcat من 11.0.0-M1 حتى 11.0.24 إصدارات Apache Tomcat من 10.1.0-M1 حتى 10.1.57 إصدارات Apache Tomcat من 9.0.0.M1 حتى 9.0.120 إصدارات Apache Tomcat من 8.5.0 إلى 8.5.100 إصدارات Apache Tomcat من 7.0.43 إلى 7.0.109 **الوصف** يحدث انتهاء صلاحية الجلسة غير الكافي عندما يتم تغيير معرّف الجلسة لجلسة HTTP تم توثيقها بعد إنشاء اتصال WebSocket. في مثل هذه الحالات، تظل جلسة WebSocket مفتوحة بدلاً من إغلاقها كما تنص مواصفات Jakarta WebSocket عند انتهاء جلسة HTTP. **التوصيات** الترقية إلى الإصدار 11.0.25 الترقية إلى الإصدار 10.1.58 الترقية إلى الإصدار 9.0.121