Authentication Bypass

2019-05-1603:23:23

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

73.4%

JSON

Tomcat is vulnerable to authentication bypass vulnerability. This is because, when using an OCSP responder Apache Tomcat Native does not correctly handle invalid responses. Users could authenticate with revoked certificates when using mutual TLS as the revoked client certificates are improperly validated.

CPENameOperatorVersion
tomcat-nativeeq1.2.17__1.el7
tomcat-nativeeq1.1.32__3.redhat_1.ep6.el6
tomcat-nativeeq1.2.8__11.redhat_11.ep7.el7
tomcat-nativeeq1.1.27__4.redhat_1.ep6.el6
tomcat-nativeeq1.1.32__2.redhat_2.ep7.el7
tomcat-nativeeq1.2.8__10.redhat_10.ep7.el7
tomcat-nativeeq1.1.34__1.el6
tomcat-nativeeq1.1.23__4.ep6.el6
tomcat-nativeeq1.1.24__1.ep6.el6
tomcat-nativeeq1.1.34__5.redhat_1.ep6.el7

Name	Operator	Version
tomcat-native	eq	1.2.17__1.el7
tomcat-native	eq	1.1.32__3.redhat_1.ep6.el6
tomcat-native	eq	1.2.8__11.redhat_11.ep7.el7
tomcat-native	eq	1.1.27__4.redhat_1.ep6.el6
tomcat-native	eq	1.1.32__2.redhat_2.ep7.el7
tomcat-native	eq	1.2.8__10.redhat_10.ep7.el7
tomcat-native	eq	1.1.34__1.el6
tomcat-native	eq	1.1.23__4.ep6.el6
tomcat-native	eq	1.1.24__1.ep6.el6
tomcat-native	eq	1.1.34__5.redhat_1.ep6.el7