Anolis OS update for tomcat
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2024-52316 |
| CWE-ID | CWE-287 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Anolis OS Operating systems & Components / Operating system tomcat-webapps Operating systems & Components / Operating system package or component tomcat-servlet-4.0-api Operating systems & Components / Operating system package or component tomcat-lib Operating systems & Components / Operating system package or component tomcat-jsp-2.3-api Operating systems & Components / Operating system package or component tomcat-el-3.0-api Operating systems & Components / Operating system package or component tomcat-docs-webapp Operating systems & Components / Operating system package or component tomcat-doc Operating systems & Components / Operating system package or component tomcat-admin-webapps Operating systems & Components / Operating system package or component tomcat Operating systems & Components / Operating system package or component |
| Vendor | OpenAnolis |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Improper Authentication
EUVDB-ID: #VU100588
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-52316
CWE-ID:
CWE-287 - Improper Authentication
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests. If Tomcat was configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not have failed, allowing the user to bypass the authentication process.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsAnolis OS: 23
tomcat-webapps: before 9.0.96-1
tomcat-servlet-4.0-api: before 9.0.96-1
tomcat-lib: before 9.0.96-1
tomcat-jsp-2.3-api: before 9.0.96-1
tomcat-el-3.0-api: before 9.0.96-1
tomcat-docs-webapp: before 9.0.96-1
tomcat-doc: before 9.0.96-1
tomcat-admin-webapps: before 9.0.96-1
tomcat: before 9.0.96-1
CPE2.3- cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
- cpe:2.3:o:openanolis:tomcat-webapps:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:tomcat-servlet-4_0-api:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:tomcat-lib:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:tomcat-jsp-2_3-api:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:tomcat-el-3_0-api:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:tomcat-docs-webapp:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:tomcat-doc:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:tomcat-admin-webapps:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:tomcat:*:*:*:*:*:anolis_os:*:*
https://anas.openanolis.cn/errata/detail/ANSA-2024:1213
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
