CVE-2024-52316
Fixed in a distro release EPSS 6%CVSS 9.8
Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
Products: Apache Software Foundation Apache Tomcat, Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat:tomcat-catalina | 9.0.96 |
| Maven | org.apache.tomcat:tomcat-catalina | 10.1.30 |
| Maven | org.apache.tomcat:tomcat-catalina | 11.0.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:10 | tomcat | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-admin-webapps | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-docs-webapp | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-el-5.0-api | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-jsp-3.1-api | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-lib | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-servlet-6.0-api | 1:10.1.36-1.el10_0 |
| AlmaLinux:10 | tomcat-webapps | 1:10.1.36-1.el10_0 |
| Debian:11 | tomcat9 | 9.0.43-2~deb11u11 |
| Debian:12 | tomcat10 | 10.1.34-0+deb12u1 |
| Debian:12 | tomcat9 | 9.0.70-2 |
| Debian:13 | tomcat10 | 10.1.31-1 |
| Debian:13 | tomcat9 | 9.0.70-2 |
| Debian:14 | tomcat10 | 10.1.31-1 |
| Debian:14 | tomcat9 | 9.0.70-2 |
| Red Hat:enterprise_linux:10.0 | tomcat | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-admin-webapps | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-docs-webapp | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-el-5.0-api | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-jsp-3.1-api | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-lib | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-servlet-6.0-api | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:10.0 | tomcat-webapps | 1:10.1.36-1.el10_0 |
| Red Hat:enterprise_linux:8 | tomcat | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-admin-webapps | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-docs-webapp | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-el-3.0-api | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-jsp-2.3-api | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-lib | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-servlet-4.0-api | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:8 | tomcat-webapps | 1:9.0.120-1.el8_10 |
| Red Hat:enterprise_linux:9 | tomcat | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-admin-webapps | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-docs-webapp | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-el-3.0-api | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-jsp-2.3-api | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-lib | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-servlet-4.0-api | 1:9.0.110-2.el9_8 |
| Red Hat:enterprise_linux:9 | tomcat-webapps | 1:9.0.110-2.el9_8 |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat | 0:10.1.36-6.redhat_00007.1.el9jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat | 0:10.1.36-6.redhat_00007.1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-admin-webapps | 0:10.1.36-6.redhat_00007.1.el9jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-admin-webapps | 0:10.1.36-6.redhat_00007.1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-docs-webapp | 0:10.1.36-6.redhat_00007.1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-docs-webapp | 0:10.1.36-6.redhat_00007.1.el9jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-el-5.0-api | 0:10.1.36-6.redhat_00007.1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-el-5.0-api | 0:10.1.36-6.redhat_00007.1.el9jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-jakartaee-migration | 0:1.0.6-2.redhat_00003.1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-jakartaee-migration | 0:1.0.6-2.redhat_00003.1.el9jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-javadoc | 0:10.1.36-6.redhat_00007.1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-javadoc | 0:10.1.36-6.redhat_00007.1.el9jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-jsp-3.1-api | 0:10.1.36-6.redhat_00007.1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-jsp-3.1-api | 0:10.1.36-6.redhat_00007.1.el9jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-lib | 0:10.1.36-6.redhat_00007.1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-lib | 0:10.1.36-6.redhat_00007.1.el9jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-native | 0:1.3.1-1.redhat_1.el9jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-native | 0:1.3.1-1.redhat_1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-native-debuginfo | 0:1.3.1-1.redhat_1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-native-debuginfo | 0:1.3.1-1.redhat_1.el9jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-selinux | 0:10.1.36-6.redhat_00007.1.el9jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-selinux | 0:10.1.36-6.redhat_00007.1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-servlet-6.0-api | 0:10.1.36-6.redhat_00007.1.el9jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-servlet-6.0-api | 0:10.1.36-6.redhat_00007.1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-webapps | 0:10.1.36-6.redhat_00007.1.el8jws |
| Red Hat:jboss_enterprise_web_server:6.1 | jws6-tomcat-webapps | 0:10.1.36-6.redhat_00007.1.el9jws |
| Red Hat:rhel_e4s:8.8 | tomcat | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-admin-webapps | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-docs-webapp | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-el-3.0-api | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-jsp-2.3-api | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-lib | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-servlet-4.0-api | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:8.8 | tomcat-webapps | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_e4s:9.2 | tomcat | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-admin-webapps | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-docs-webapp | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-el-3.0-api | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-jsp-2.3-api | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-lib | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-servlet-4.0-api | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.2 | tomcat-webapps | 1:9.0.120-1.el9_2 |
| Red Hat:rhel_e4s:9.4 | tomcat | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-admin-webapps | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-docs-webapp | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-el-3.0-api | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-jsp-2.3-api | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-lib | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-servlet-4.0-api | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_e4s:9.4 | tomcat-webapps | 1:9.0.120-1.el9_4 |
| Red Hat:rhel_eus:9.6 | tomcat | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-admin-webapps | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-docs-webapp | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-el-3.0-api | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-jsp-2.3-api | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-lib | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-servlet-4.0-api | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_eus:9.6 | tomcat-webapps | 1:9.0.120-1.el9_6 |
| Red Hat:rhel_tus:8.8 | tomcat | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-admin-webapps | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-docs-webapp | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-el-3.0-api | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-jsp-2.3-api | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-lib | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-servlet-4.0-api | 1:9.0.120-1.el8_8 |
| Red Hat:rhel_tus:8.8 | tomcat-webapps | 1:9.0.120-1.el8_8 |
| Rocky Linux:10 | tomcat | 1:10.1.36-1.el10_0 |
| SUSE:Enterprise Storage 7.1 | tomcat | 9.0.97-150200.71.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | tomcat | 9.0.97-150200.71.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | tomcat | 9.0.97-150200.71.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | tomcat | 9.0.97-150200.71.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | tomcat | 9.0.97-150200.71.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP5 | tomcat | 9.0.97-150200.71.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP5 | tomcat10 | 10.1.33-150200.5.28.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP6 | tomcat | 9.0.97-150200.71.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP6 | tomcat10 | 10.1.33-150200.5.28.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | tomcat | 9.0.36-3.133.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | tomcat | 9.0.115-3.160.1 |
| SUSE:Linux Enterprise Server 15 SP2-LTSS | tomcat | 9.0.97-150200.71.1 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | tomcat | 9.0.97-150200.71.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | tomcat | 9.0.97-150200.71.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | tomcat | 9.0.36-3.133.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | tomcat | 9.0.115-3.160.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | tomcat | 9.0.97-150200.71.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | tomcat | 9.0.97-150200.71.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | tomcat | 9.0.97-150200.71.1 |
| SUSE:Manager Server 4.3 | tomcat | 9.0.97-150200.71.1 |
| Ubuntu:Pro:16.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:20.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:22.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:24.04:LTS | tomcat10 | 10.1.16-1ubuntu0.1~esm3 |
| openSUSE:Leap 15.5 | tomcat | 9.0.97-150200.71.1 |
| openSUSE:Leap 15.5 | tomcat10 | 10.1.33-150200.5.28.1 |
| openSUSE:Leap 15.6 | tomcat | 9.0.97-150200.71.1 |
| openSUSE:Leap 15.6 | tomcat10 | 10.1.33-150200.5.28.1 |
| openSUSE:Tumbleweed | tomcat | 9.0.97-1.1 |
| openSUSE:Tumbleweed | tomcat10 | 10.1.33-1.1 |