deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-95jq-rwvf-vjx4
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 11.0.0-M1, < 11.0.20
Patched in: 11.0.20

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-95jq-rwvf-vjx4
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 10.1.0-M7, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-95jq-rwvf-vjx4
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 9.0.83, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-95jq-rwvf-vjx4
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 11.0.0-M1, < 11.0.20
Patched in: 11.0.20

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-95jq-rwvf-vjx4
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 10.1.0-M7, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-95jq-rwvf-vjx4
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 9.0.83, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-69cc-cv78-qc8g
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 11.0.16, < 11.0.20
Patched in: 11.0.20

Summary: Apache Tomcat: Configured cipher preference order not preserved

Details:
Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-69cc-cv78-qc8g
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 10.1.51, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat: Configured cipher preference order not preserved

Details:
Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-69cc-cv78-qc8g
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 9.0.114, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat: Configured cipher preference order not preserved

Details:
Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-69cc-cv78-qc8g
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 11.0.16, < 11.0.20
Patched in: 11.0.20

Summary: Apache Tomcat: Configured cipher preference order not preserved

Details:
Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-69cc-cv78-qc8g
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 10.1.51, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat: Configured cipher preference order not preserved

Details:
Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-69cc-cv78-qc8g
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 9.0.114, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat: Configured cipher preference order not preserved

Details:
Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-69cc-cv78-qc8g
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 11.0.16, < 11.0.20
Patched in: 11.0.20

Summary: Apache Tomcat: Configured cipher preference order not preserved

Details:
Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-69cc-cv78-qc8g
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 10.1.51, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat: Configured cipher preference order not preserved

Details:
Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-69cc-cv78-qc8g
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 9.0.114, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat: Configured cipher preference order not preserved

Details:
Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-563x-q5rq-57qp
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 10.1.0-M1, < 10.1.52
Patched in: 10.1.52

Summary: Apache Tomcat has an HTTP Request/Response Smuggling vulnerability

Details:
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-563x-q5rq-57qp
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 7.0.0, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat has an HTTP Request/Response Smuggling vulnerability

Details:
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-24j9-x2wg-9qv6
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 11.0.0-M14, < 11.0.21
Patched in: 11.0.21

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
GitHub Security Advisory: GHSA-24j9-x2wg-9qv6
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 10.1.22, < 10.1.54
Patched in: 10.1.54

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
GitHub Security Advisory: GHSA-24j9-x2wg-9qv6
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 9.0.92, < 9.0.117
Patched in: 9.0.117

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
GitHub Security Advisory: GHSA-24j9-x2wg-9qv6
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 11.0.0-M14, < 11.0.21
Patched in: 11.0.21

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
GitHub Security Advisory: GHSA-24j9-x2wg-9qv6
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 10.1.22, < 10.1.54
Patched in: 10.1.54

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
GitHub Security Advisory: GHSA-24j9-x2wg-9qv6
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 9.0.92, < 9.0.117
Patched in: 9.0.117

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
GitHub Security Advisory: GHSA-24j9-x2wg-9qv6
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 11.0.0-M14, < 11.0.21
Patched in: 11.0.21

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
GitHub Security Advisory: GHSA-24j9-x2wg-9qv6
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 10.1.22, < 10.1.54
Patched in: 10.1.54

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
GitHub Security Advisory: GHSA-24j9-x2wg-9qv6
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 9.0.92, < 9.0.117
Patched in: 9.0.117

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
GitHub Security Advisory: GHSA-x4m4-345f-5h5g
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 11.0.0-M1, < 11.0.21
Patched in: 11.0.21

Summary: Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

Details:
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-x4m4-345f-5h5g
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 10.1.0-M1, < 10.1.54
Patched in: 10.1.54

Summary: Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

Details:
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-x4m4-345f-5h5g
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 9.0.13, < 9.0.117
Patched in: 9.0.117

Summary: Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

Details:
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-x4m4-345f-5h5g
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 11.0.0-M1, < 11.0.21
Patched in: 11.0.21

Summary: Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

Details:
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-x4m4-345f-5h5g
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 10.1.0-M1, < 10.1.54
Patched in: 10.1.54

Summary: Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

Details:
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-x4m4-345f-5h5g
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 9.0.13, < 9.0.117
Patched in: 9.0.117

Summary: Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

Details:
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-x4m4-345f-5h5g
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 11.0.0-M1, < 11.0.21
Patched in: 11.0.21

Summary: Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

Details:
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-x4m4-345f-5h5g
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 10.1.0-M1, < 10.1.54
Patched in: 10.1.54

Summary: Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File

Details:
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.