org.apache.tomcat:tomcat-catalina 10.1.59

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat:tomcat-catalina package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Not Failing Securely ('Failing Open') org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Not Failing Securely ('Failing Open') due to the `OpenSSLLifecycleListener` process. An attacker can cause the application to operate in a less secure mode by triggering a failure in FIPS activation, resulting in the system continuing to run with JSSE in non-FIPS mode without proper enforcement of FIPS requirements. How to fix Not Failing Securely ('Failing Open')? Upgrade `org.apache.tomcat:tomcat-catalina` to version 9.0.123, 10.1.61, 11.0.27 or higher.	[9.0.92,9.0.123)[10.1.22,10.1.61)[11.0.0-M14,11.0.27)
C Missing Critical Step in Authentication org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Missing Critical Step in Authentication in the `JNDIRealm` authentication process when configured with a non-GSSAPI SASL mechanism. An attacker can gain unauthorized access by authenticating without providing the correct password. How to fix Missing Critical Step in Authentication? Upgrade `org.apache.tomcat:tomcat-catalina` to version 11.0.27, 10.1.61, 9.0.123 or higher.	[11.0.0-M1,11.0.27)[10.1.0-M1,10.1.61)[9.0.0.M1,9.0.123)

Vulnerability

Vulnerable Version

Not Failing Securely ('Failing Open')

org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations.

Affected versions of this package are vulnerable to Not Failing Securely ('Failing Open') due to the OpenSSLLifecycleListener process. An attacker can cause the application to operate in a less secure mode by triggering a failure in FIPS activation, resulting in the system continuing to run with JSSE in non-FIPS mode without proper enforcement of FIPS requirements.

How to fix Not Failing Securely ('Failing Open')?

Upgrade org.apache.tomcat:tomcat-catalina to version 9.0.123, 10.1.61, 11.0.27 or higher.

[9.0.92,9.0.123)[10.1.22,10.1.61)[11.0.0-M14,11.0.27)

Missing Critical Step in Authentication

org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations.

Affected versions of this package are vulnerable to Missing Critical Step in Authentication in the JNDIRealm authentication process when configured with a non-GSSAPI SASL mechanism. An attacker can gain unauthorized access by authenticating without providing the correct password.

How to fix Missing Critical Step in Authentication?

Upgrade org.apache.tomcat:tomcat-catalina to version 11.0.27, 10.1.61, 9.0.123 or higher.

[11.0.0-M1,11.0.27)[10.1.0-M1,10.1.61)[9.0.0.M1,9.0.123)

org.apache.tomcat:tomcat-catalina@10.1.59

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically