deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-rjgh-wgc7-m37j
Package: com.vaadin:vaadin (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 25.0.0, < 25.0.2
Patched in: 25.0.2

Summary: Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash

Details:
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.

Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.

Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and users should update either to the latest 14, 23, 24, 25 version.
GitHub Security Advisory: GHSA-rjgh-wgc7-m37j
Package: com.vaadin:flow-server (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 25.0.0, < 25.0.2
Patched in: 25.0.2

Summary: Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash

Details:
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.

Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.

Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and users should update either to the latest 14, 23, 24, 25 version.
GitHub Security Advisory: GHSA-rjgh-wgc7-m37j
Package: com.vaadin:flow-server (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 24.0.0, < 24.9.8
Patched in: 24.9.8

Summary: Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash

Details:
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.

Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.

Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and users should update either to the latest 14, 23, 24, 25 version.
GitHub Security Advisory: GHSA-rjgh-wgc7-m37j
Package: com.vaadin:flow-server (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 23.0.0, < 23.6.7
Patched in: 23.6.7

Summary: Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash

Details:
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.

Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.

Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and users should update either to the latest 14, 23, 24, 25 version.
GitHub Security Advisory: GHSA-rjgh-wgc7-m37j
Package: com.vaadin:flow-server (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 14.14.1
Patched in: 14.14.1

Summary: Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash

Details:
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.

Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.

Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and users should update either to the latest 14, 23, 24, 25 version.
GitHub Security Advisory: GHSA-jjwr-xmw6-gf78
Package: org.apache.pdfbox:pdfbox-examples (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.0.24, < 3.0.7
Patched in: 3.0.7

Summary: Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function

Details:
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.

The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexFileSpecification.getFilename() is appended to the extraction path.

Users who have copied this example into their production code should review it to ensure that the extraction path is acceptable. The example has been changed accordingly, now the initial path and the extraction paths are converted into canonical paths and it is verified that extraction path contains the initial path. The documentation has also been adjusted.
GitHub Security Advisory: GHSA-6w48-2g9j-v9q5
Package: org.apache.iotdb:iotdb-core (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-20: Improper Input Validation, CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: >= 2.0.0, < 2.0.7
Patched in: 2.0.7

Summary: Apache IoTDB has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
GitHub Security Advisory: GHSA-6w48-2g9j-v9q5
Package: org.apache.iotdb:iotdb-core (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-20: Improper Input Validation, CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: >= 1.0.0, < 1.3.7
Patched in: 1.3.7

Summary: Apache IoTDB has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
GitHub Security Advisory: GHSA-74cf-pgh9-m5q2
Package: org.apache.iotdb:iotdb-core (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-1327: Binding to an Unrestricted IP Address
Vulnerable versions: >= 2.0.0, < 2.0.7
Patched in: 2.0.7

Summary: Apache IoTDB has an Insecure Default Configuration Vulnerability

Details:
A vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
GitHub Security Advisory: GHSA-74cf-pgh9-m5q2
Package: org.apache.iotdb:iotdb-core (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-1327: Binding to an Unrestricted IP Address
Vulnerable versions: >= 1.0.0, < 1.3.7
Patched in: 1.3.7

Summary: Apache IoTDB has an Insecure Default Configuration Vulnerability

Details:
A vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
GitHub Security Advisory: GHSA-7xrh-hqfc-g7qr
Package: org.apache.zookeeper:zookeeper (MAVEN)
Severity: HIGH (CVSS 7.4)
CWE: CWE-295: Improper Certificate Validation, CWE-297: Improper Validation of Certificate with Host Mismatch
Vulnerable versions: >= 3.9.0, < 3.9.5
Patched in: 3.9.5

Summary: Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

Details:
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
GitHub Security Advisory: GHSA-7xrh-hqfc-g7qr
Package: org.apache.zookeeper:zookeeper (MAVEN)
Severity: HIGH (CVSS 7.4)
CWE: CWE-295: Improper Certificate Validation, CWE-297: Improper Validation of Certificate with Host Mismatch
Vulnerable versions: >= 3.8.0, < 3.8.6
Patched in: 3.8.6

Summary: Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

Details:
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
GitHub Security Advisory: GHSA-qq5r-98hh-rxc9
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 9.0.113
Patched in: 9.0.113

Summary: Apache Tomcat - Security constraint bypass with HTTP/0.9

Details:
Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.


Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
GitHub Security Advisory: GHSA-qq5r-98hh-rxc9
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 10.1.0-M1, < 10.1.50
Patched in: 10.1.50

Summary: Apache Tomcat - Security constraint bypass with HTTP/0.9

Details:
Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.


Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
GitHub Security Advisory: GHSA-qq5r-98hh-rxc9
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 11.0.0-M1, < 11.0.15
Patched in: 11.0.15

Summary: Apache Tomcat - Security constraint bypass with HTTP/0.9

Details:
Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.


Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
GitHub Security Advisory: GHSA-qq5r-98hh-rxc9
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 9.0.113
Patched in: 9.0.113

Summary: Apache Tomcat - Security constraint bypass with HTTP/0.9

Details:
Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.


Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
GitHub Security Advisory: GHSA-qq5r-98hh-rxc9
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 10.1.0-M1, < 10.1.50
Patched in: 10.1.50

Summary: Apache Tomcat - Security constraint bypass with HTTP/0.9

Details:
Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.


Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
GitHub Security Advisory: GHSA-qq5r-98hh-rxc9
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 11.0.0-M1, < 11.0.15
Patched in: 11.0.15

Summary: Apache Tomcat - Security constraint bypass with HTTP/0.9

Details:
Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.


Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
GitHub Security Advisory: GHSA-qq5r-98hh-rxc9
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 9.0.113
Patched in: 9.0.113

Summary: Apache Tomcat - Security constraint bypass with HTTP/0.9

Details:
Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.


Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
GitHub Security Advisory: GHSA-qq5r-98hh-rxc9
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 10.1.0-M1, < 10.1.50
Patched in: 10.1.50

Summary: Apache Tomcat - Security constraint bypass with HTTP/0.9

Details:
Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.


Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
GitHub Security Advisory: GHSA-qq5r-98hh-rxc9
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 11.0.0-M1, < 11.0.15
Patched in: 11.0.15

Summary: Apache Tomcat - Security constraint bypass with HTTP/0.9

Details:
Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.


Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
GitHub Security Advisory: GHSA-fpj8-gq4v-p354
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 9.1)
CWE: CWE-20: Improper Input Validation, CWE-295: Improper Certificate Validation
Vulnerable versions: < 9.0.113
Patched in: 9.0.113

Summary: Apache Tomcat - Client certificate verification bypass

Details:
Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.
GitHub Security Advisory: GHSA-fpj8-gq4v-p354
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 9.1)
CWE: CWE-20: Improper Input Validation, CWE-295: Improper Certificate Validation
Vulnerable versions: >= 10.1.0-M1, < 10.1.50
Patched in: 10.1.50

Summary: Apache Tomcat - Client certificate verification bypass

Details:
Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.
GitHub Security Advisory: GHSA-fpj8-gq4v-p354
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 9.1)
CWE: CWE-20: Improper Input Validation, CWE-295: Improper Certificate Validation
Vulnerable versions: >= 11.0.0-M1, < 11.0.15
Patched in: 11.0.15

Summary: Apache Tomcat - Client certificate verification bypass

Details:
Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.