Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN335

_____________________________________________________________________

DATE                : 05/06/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Tomcat versions prior to
                                11.0.7, 10.1.41, 9.0.105.

=====================================================================
https://lists.apache.org/thread/qyrz13o6960cfg33tz9ghld647884kvd
_____________________________________________________________________

[SECURITY] CVE-2025-46701 Apache Tomcat - CGI security constraint
bypass
CVE-2025-46701 Apache Tomcat - CGI security constraint bypass

Severity: Low

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 11.0.0-M1 to 11.0.6
Apache Tomcat 10.1.0-M1 to 10.1.40
Apache Tomcat 9.0.0.M1 to 9.0.104


Description:
When running on a case insensitive file system with security
constraints configured for the <code>pathInfo</code> component of
a URL that mapped to the CGI servlet, it was possible to bypass
those security constraints with a specially crafted URL.


Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 11.0.7 or later
- Upgrade to Apache Tomcat 10.1.41 or later
- Upgrade to Apache Tomcat 9.0.105 or later


Credit:
The vulnerability was identified by Greg K
(https://github.com/gregk4sec)


History:
2025-05-29 Original advisory


References:
[1] https://tomcat.apache.org/security-11.html
[2] https://tomcat.apache.org/security-10.html
[3] https://tomcat.apache.org/security-9.html


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================