org.apache.tomcat:tomcat-coyote-ffm 10.1.28

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat:tomcat-coyote-ffm package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improper Authentication Affected versions of this package are vulnerable to Improper Authentication in `processOCSPRequest()`, which is part of the the `CLIENT_CERT` authentication process. In some "edge cases", an attacker can trigger a soft-fail of OCSP checks when soft-fail is disabled. How to fix Improper Authentication? Upgrade `org.apache.tomcat:tomcat-coyote-ffm` to version 9.0.117, 10.1.54, 11.0.21 or higher.	[9.0.93,9.0.117)[10.1.26,10.1.54)[11.0.0-M24,11.0.21)
H Improper Authentication Affected versions of this package are vulnerable to Improper Authentication in `processOCSPRequest()`, which is part of the the `CLIENT_CERT` authentication process. An attacker can trigger a soft-fail of OCSP checks when soft-fail is disabled. How to fix Improper Authentication? Upgrade `org.apache.tomcat:tomcat-coyote-ffm` to version 9.0.116, 10.1.53, 11.0.20 or higher.	[9.0.93,9.0.116)[10.1.26,10.1.53)[11.0.0-M24,11.0.20)
H Incorrect Authorization Affected versions of this package are vulnerable to Incorrect Authorization when using an OCSP responder. OCSP response verification and freshness checks can be bypassed, allowing certificate revocation to be bypassed. How to fix Incorrect Authorization? Upgrade `org.apache.tomcat:tomcat-coyote-ffm` to version 9.0.114, 10.1.52, 11.0.18 or higher.	[9.0.83,9.0.114)[10.1.0-M7,10.1.52)[11.0.0-M1,11.0.18)

Vulnerability

Vulnerable Version

Improper Authentication

Affected versions of this package are vulnerable to Improper Authentication in processOCSPRequest(), which is part of the the CLIENT_CERT authentication process. In some "edge cases", an attacker can trigger a soft-fail of OCSP checks when soft-fail is disabled.

How to fix Improper Authentication?

Upgrade org.apache.tomcat:tomcat-coyote-ffm to version 9.0.117, 10.1.54, 11.0.21 or higher.

[9.0.93,9.0.117)[10.1.26,10.1.54)[11.0.0-M24,11.0.21)

Improper Authentication

Affected versions of this package are vulnerable to Improper Authentication in processOCSPRequest(), which is part of the the CLIENT_CERT authentication process. An attacker can trigger a soft-fail of OCSP checks when soft-fail is disabled.

How to fix Improper Authentication?

Upgrade org.apache.tomcat:tomcat-coyote-ffm to version 9.0.116, 10.1.53, 11.0.20 or higher.

[9.0.93,9.0.116)[10.1.26,10.1.53)[11.0.0-M24,11.0.20)

Incorrect Authorization

Affected versions of this package are vulnerable to Incorrect Authorization when using an OCSP responder. OCSP response verification and freshness checks can be bypassed, allowing certificate revocation to be bypassed.

How to fix Incorrect Authorization?

Upgrade org.apache.tomcat:tomcat-coyote-ffm to version 9.0.114, 10.1.52, 11.0.18 or higher.

[9.0.83,9.0.114)[10.1.0-M7,10.1.52)[11.0.0-M1,11.0.18)

org.apache.tomcat:tomcat-coyote-ffm@10.1.28

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically