DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Weakness
This weakness has been deprecated because it covered redundant concepts already described in CWE-287.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Tomcat | Apache | 7.0.0 (including) | 7.0.109 (including) |
| Tomcat | Apache | 8.5.0 (including) | 8.5.100 (including) |
| Tomcat | Apache | 9.0.0 (including) | 9.0.118 (excluding) |
| Tomcat | Apache | 10.1.0 (including) | 10.1.55 (excluding) |
| Tomcat | Apache | 11.0.0 (including) | 11.0.22 (excluding) |
| Red Hat Enterprise Linux 10 | RedHat | tomcat9-1:9.0.120-1.el10_2 | * |
| Red Hat Enterprise Linux 10 | RedHat | tomcat-1:10.1.49-4.el10_2 | * |
| Red Hat Enterprise Linux 10.0 Extended Update Support | RedHat | tomcat9-1:9.0.120-1.el10_0 | * |
| Red Hat Enterprise Linux 10.0 Extended Update Support | RedHat | tomcat-1:10.1.49-1.el10_0 | * |
| Red Hat Enterprise Linux 8 | RedHat | tomcat-1:9.0.120-1.el8_10 | * |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | RedHat | tomcat-1:9.0.120-1.el8_8 | * |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | RedHat | tomcat-1:9.0.120-1.el8_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | tomcat-1:9.0.120-2.el9_8 | * |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | RedHat | tomcat-1:9.0.120-1.el9_2 | * |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | RedHat | tomcat-1:9.0.120-1.el9_4 | * |
| Red Hat Enterprise Linux 9.6 Extended Update Support | RedHat | tomcat-1:9.0.120-1.el9_6 | * |
| Red Hat JBoss Web Server 6.2.4 | RedHat | tomcat-coyote | * |
| Red Hat JBoss Web Server 6.2 on RHEL 10 | RedHat | jws6-tomcat-0:10.1.49-15.redhat_00013.1.el10jws | * |
| Red Hat JBoss Web Server 6.2 on RHEL 8 | RedHat | jws6-tomcat-0:10.1.49-15.redhat_00013.1.el8jws | * |
| Red Hat JBoss Web Server 6.2 on RHEL 9 | RedHat | jws6-tomcat-0:10.1.49-15.redhat_00013.1.el9jws | * |
| Red Hat JBoss Web Server 7.0.0 | RedHat | tomcat-coyote | * |
| Red Hat JBoss Web Server 7.0 on RHEL 10 | RedHat | jws7-tomcat-0:11.0.21-5.redhat_00004.1.el10jws | * |
| Red Hat JBoss Web Server 7.0 on RHEL 8 | RedHat | jws7-tomcat-0:11.0.21-5.redhat_00004.1.el8jws | * |
| Red Hat JBoss Web Server 7.0 on RHEL 9 | RedHat | jws7-tomcat-0:11.0.21-5.redhat_00004.1.el9jws | * |
| Red Hat Hardened Images | RedHat | tomcat11-main-11.0.22-0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | tomcat10-main-10.1.55-1.hum1 | * |
| Red Hat OpenShift Dev Spaces 3.28 | RedHat | devspaces/server-rhel9:1780694994 | * |
| Tomcat10 | Ubuntu | esm-apps/noble | * |
| Tomcat10 | Ubuntu | esm-apps/resolute | * |
| Tomcat10 | Ubuntu | noble | * |
| Tomcat10 | Ubuntu | questing | * |
| Tomcat10 | Ubuntu | resolute | * |
| Tomcat10 | Ubuntu | upstream | * |
| Tomcat11 | Ubuntu | esm-apps/resolute | * |
| Tomcat11 | Ubuntu | questing | * |
| Tomcat11 | Ubuntu | resolute | * |
| Tomcat11 | Ubuntu | upstream | * |
| Tomcat6 | Ubuntu | esm-infra-legacy/trusty | * |
| Tomcat6 | Ubuntu | upstream | * |
| Tomcat7 | Ubuntu | esm-apps-legacy/xenial | * |
| Tomcat7 | Ubuntu | esm-infra-legacy/trusty | * |
| Tomcat7 | Ubuntu | upstream | * |
| Tomcat8 | Ubuntu | esm-apps/bionic | * |
| Tomcat8 | Ubuntu | esm-infra-legacy/xenial | * |
| Tomcat8 | Ubuntu | upstream | * |
| Tomcat9 | Ubuntu | esm-apps/bionic | * |
| Tomcat9 | Ubuntu | esm-apps/focal | * |
| Tomcat9 | Ubuntu | esm-apps/jammy | * |
| Tomcat9 | Ubuntu | esm-apps/noble | * |
| Tomcat9 | Ubuntu | esm-apps/resolute | * |
| Tomcat9 | Ubuntu | jammy | * |
| Tomcat9 | Ubuntu | noble | * |
| Tomcat9 | Ubuntu | questing | * |
| Tomcat9 | Ubuntu | resolute | * |
| Tomcat9 | Ubuntu | upstream | * |