Apache Tomcat 11.0.26 Fixes 12 WebSocket, HTTP/2, AJP, and TLS Flaws
The Apache Software Foundation released Apache Tomcat 11.0.26 to remediate 12 vulnerabilities affecting WebSocket, HTTP/2, AJP, authentication handling, and TLS certificate validation. The issues broadly affect Tomcat versions 11.0.0-M1 through 11.0.25 and include four Important-, three Moderate-, and five Low-severity flaws. Reported impacts include WebSocket message smuggling and authorization bypass, HTTP/2 request-header mix-ups, request disruption and denial of service, cross-application authentication-realm reuse, and incomplete certificate-revocation validation. Apache does not provide individual binary patches and advises organizations to upgrade directly to 11.0.26. Administrators should prioritize internet-facing services using WebSocket, HTTP/2, or AJP; validate deployment artifacts and application compatibility; restart updated instances; and monitor for connection exhaustion, authorization failures, and anomalous cross-request behavior.. Fonte: https://mallory.ai/stories/01a0d1a2-a056-781e-af05-6f823da6e228
Itagora tiene in archivio titolo e sommario per la ricerca interna. Il testo completo resta sulla fonte. Il link in uscita non invia referrer.