[kaito-yamaguchi-assured]

Updates

• Affected products
• CVSS v4
• References
• Summary

Comments
Add the affected Maven packages. This advisory currently has no affected packages.

• The fix changes org.apache.catalina.realm.JNDIRealm. In the binary jars on Maven Central, the changed classes are packaged in tomcat-catalina and tomcat-embed-core (checked in 11.0.26 / 10.1.60 / 9.0.122). They are also shipped in the binary distribution org.apache.tomcat:tomcat.
• Patched versions are the first upstream tags containing the fix commits (11.0.27 / 10.1.61 / 9.0.123).
• 8.5.0-8.5.100 and 7.0.0-7.0.109 are also included without patched versions (EOL). The CVE record lists them as affected, and in 8.5.100 and 7.0.109 JNDIRealm.bindAsUser() binds with the configured authentication mechanism without forcing a simple bind.

Evidence:

• Apache Tomcat security pages: https://tomcat.apache.org/security-11.html , https://tomcat.apache.org/security-10.html , https://tomcat.apache.org/security-9.html
• Fix commits:
  • 11.0.x: apache/tomcat@e43453f (first included in 11.0.27)
  • 10.1.x: apache/tomcat@8fafc6f (first included in 10.1.61)
  • 9.0.x: apache/tomcat@42827af (first included in 9.0.123)

CVSS (for reference only):

• Apache Tomcat security team rating: important
• NVD (provided by CISA ADP): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N (9.1, Critical). This is a CVSS v4.0 score; the CVE record has no CVSS v3.1 score.
• Current GitHub advisory (GHSA-5q2g-877c-9cwh): the same CVSS v4.0 vector (9.1, Critical), which matches the NVD score

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.