CVE-2024-52316
Description
A flaw was found in Apache Tomcat when configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component. This vulnerability allows authentication bypass via improperly handled exceptions during the authentication process.
Statement
Red Hat Product Security has assessed this flaw at Attack Complexity as High, and impact metrics Confidentiality and Integrity as High, with a resultant base flaw Security Impact of Important. However, the factors involved in successful exploitation--usage of a custom Jakarta ServerAuthContext component, possible mishandling of exception management in that custom component, and failure in such a way as to allow a failed authentication to proceed in that exception mishandling--are sufficiently unlikely, such that Apache determined the impact to be Low. While Red Hat concurs with the worst-case assessment of Important for the base flaw, all products are assessed as Low, per individual risk assessment and in concurrence with Apache's rating.
Red Hat Satellite is not directly impacted by this issue as it does not include the affected Tomcat package. However, Tomcat is consumed by Candlepin, a component of Satellite. Red Hat Satellite users are advised to check the impact state of Red Hat Enterprise Linux as any necessary fixes will be distributed through the platform.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
