FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

tomcat -- JNDI Realm Authentication Weakness in multiple versions

Affected packages
7.0.0	<=	tomcat7	<=	7.0.108
8.5.0	<=	tomcat85	<=	8.5.65
9.0.0	<=	tomcat9	<=	9.0.45
10.0.0	<=	tomcat10	<=	10.0.5

Details

VuXML ID	8b571fb2-f311-11eb-b12b-fc4dd43e2b6a
Discovery	2021-04-08
Entry	2021-08-01

ilja.farber reports:

Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data (eg user names) as well as configuration data provided by an administrator. In limited circumstances it was possible for users to authenticate using variations of their user name and/or to bypass some of the protection provided by the LockOut Realm.

[source]

References

CVE Name	CVE-2021-30640
URL	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30640