Attestkeep
Dil: Türkçe
Kayıt ol

Zafiyetler / CVE-2025-31651

kritik

CVE-2025-31651

tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve

Yayın Değişiklik CWE 116
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA2.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Red Hat5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Bitnami, Photon OS. Daha düşük diyenler: AlmaLinux (yüksek), Amazon (yüksek), Oracle (yüksek), Rocky Linux (yüksek), Ubuntu (orta), GHSA (düşük), Red Hat (düşük).

Açıklama

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
bitnami::Bitnami Vulnerability Databasetomcat9.0.104, 10.1.40, 11.0.6
Photon OS 4.0apache-tomcat9, apache-tomcat9-webapps9.0.104-1.ph4
Photon OS 5.0apache-tomcat10, apache-tomcat10-webapps, apache-tomcat9 ve 1 tane daha10.1.40-1.ph5 ve 1 tane daha
alma 10tomcat, tomcat-admin-webapps, tomcat-docs-webapp ve 13 tane daha1:10.1.36-3.el10_1.1 ve 1 tane daha
alma 8tomcat, tomcat-admin-webapps, tomcat-docs-webapp ve 5 tane daha1:9.0.87-1.el8_10.7
alma 9tomcat, tomcat-admin-webapps, tomcat-docs-webapp ve 5 tane daha1:9.0.87-6.el9_7.1
amazon linux 2023tomcat10, tomcat10-admin-webapps, tomcat10-docs-webapp ve 13 tane daha1:10.1.40-1.amzn2023.0.1 ve 1 tane daha
chainguardcamunda-zeebe-8.6, thingsboard8.6.15-r1 ve 1 tane daha
debian 11tomcat99.0.107-0+deb11u1
debian 12tomcat10, tomcat910.1.40-1 ve 1 tane daha
debian 13tomcat10, tomcat11, tomcat910.1.40-1 ve 2 tane daha
debian 14tomcat10, tomcat11, tomcat910.1.40-1 ve 2 tane daha
36 kaynaktaki 189 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
bitnami::Bitnami Vulnerability Databasetomcat9.0.104, 10.1.40, 11.0.6
Photon OS 4.0apache-tomcat99.0.104-1.ph4
Photon OS 4.0apache-tomcat9-webapps9.0.104-1.ph4
Photon OS 5.0apache-tomcat1010.1.40-1.ph5
Photon OS 5.0apache-tomcat10-webapps10.1.40-1.ph5
Photon OS 5.0apache-tomcat99.0.104-1.ph5
Photon OS 5.0apache-tomcat9-webapps9.0.104-1.ph5
alma 10tomcat1:10.1.36-3.el10_1.1
alma 10tomcat-admin-webapps1:10.1.36-3.el10_1.1
alma 10tomcat-docs-webapp1:10.1.36-3.el10_1.1
alma 10tomcat-el-5.0-api1:10.1.36-3.el10_1.1
alma 10tomcat-jsp-3.1-api1:10.1.36-3.el10_1.1
alma 10tomcat-lib1:10.1.36-3.el10_1.1
alma 10tomcat-servlet-6.0-api1:10.1.36-3.el10_1.1
alma 10tomcat-webapps1:10.1.36-3.el10_1.1
alma 10tomcat91:9.0.87-8.el10_1.1
alma 10tomcat9-admin-webapps1:9.0.87-8.el10_1.1
alma 10tomcat9-docs-webapp1:9.0.87-8.el10_1.1
alma 10tomcat9-el-3.0-api1:9.0.87-8.el10_1.1
alma 10tomcat9-jsp-2.3-api1:9.0.87-8.el10_1.1
alma 10tomcat9-lib1:9.0.87-8.el10_1.1
alma 10tomcat9-servlet-4.0-api1:9.0.87-8.el10_1.1
alma 10tomcat9-webapps1:9.0.87-8.el10_1.1
alma 8tomcat1:9.0.87-1.el8_10.7
alma 8tomcat-admin-webapps1:9.0.87-1.el8_10.7
alma 8tomcat-docs-webapp1:9.0.87-1.el8_10.7
alma 8tomcat-el-3.0-api1:9.0.87-1.el8_10.7
alma 8tomcat-jsp-2.3-api1:9.0.87-1.el8_10.7
alma 8tomcat-lib1:9.0.87-1.el8_10.7
alma 8tomcat-servlet-4.0-api1:9.0.87-1.el8_10.7
alma 8tomcat-webapps1:9.0.87-1.el8_10.7
alma 9tomcat1:9.0.87-6.el9_7.1
alma 9tomcat-admin-webapps1:9.0.87-6.el9_7.1
alma 9tomcat-docs-webapp1:9.0.87-6.el9_7.1
alma 9tomcat-el-3.0-api1:9.0.87-6.el9_7.1
alma 9tomcat-jsp-2.3-api1:9.0.87-6.el9_7.1
alma 9tomcat-lib1:9.0.87-6.el9_7.1
alma 9tomcat-servlet-4.0-api1:9.0.87-6.el9_7.1
alma 9tomcat-webapps1:9.0.87-6.el9_7.1
amazon linux 2023tomcat101:10.1.40-1.amzn2023.0.1
amazon linux 2023tomcat10-admin-webapps1:10.1.40-1.amzn2023.0.1
amazon linux 2023tomcat10-docs-webapp1:10.1.40-1.amzn2023.0.1
amazon linux 2023tomcat10-el-5.0-api1:10.1.40-1.amzn2023.0.1
amazon linux 2023tomcat10-jsp-3.1-api1:10.1.40-1.amzn2023.0.1
amazon linux 2023tomcat10-lib1:10.1.40-1.amzn2023.0.1
amazon linux 2023tomcat10-servlet-6.0-api1:10.1.40-1.amzn2023.0.1
amazon linux 2023tomcat10-webapps1:10.1.40-1.amzn2023.0.1
amazon linux 2023tomcat91:9.0.104-1.amzn2023.0.1
amazon linux 2023tomcat9-admin-webapps1:9.0.104-1.amzn2023.0.1
amazon linux 2023tomcat9-docs-webapp1:9.0.104-1.amzn2023.0.1
amazon linux 2023tomcat9-el-3.0-api1:9.0.104-1.amzn2023.0.1
amazon linux 2023tomcat9-jsp-2.3-api1:9.0.104-1.amzn2023.0.1
amazon linux 2023tomcat9-lib1:9.0.104-1.amzn2023.0.1
amazon linux 2023tomcat9-servlet-4.0-api1:9.0.104-1.amzn2023.0.1
amazon linux 2023tomcat9-webapps1:9.0.104-1.amzn2023.0.1
chainguardcamunda-zeebe-8.68.6.15-r1
chainguardthingsboard4.0.1-r1
debian 11tomcat99.0.107-0+deb11u1
debian 12tomcat1010.1.40-1
debian 12tomcat99.0.70-2
debian 13tomcat1010.1.40-1
debian 13tomcat1111.0.6-1
debian 13tomcat99.0.70-2
debian 14tomcat1010.1.40-1
debian 14tomcat1111.0.6-1
debian 14tomcat99.0.70-2
echotomcat1010.1.40-1
echotomcat1111.0.6-1
echotomcat99.0.70-2
maven::GitHub Security Advisory Mavenorg.apache.tomcat.embed:tomcat-embed-core9.0.104, 10.1.40, 11.0.6
maven::GitHub Security Advisory Mavenorg.apache.tomcat:tomcat-catalina9.0.104, 10.1.40, 11.0.6
Oracle Linux 8tomcat1:9.0.87-1.el8_10.7
Oracle Linux 8tomcat-admin-webapps1:9.0.87-1.el8_10.7
Oracle Linux 8tomcat-docs-webapp1:9.0.87-1.el8_10.7
Oracle Linux 8tomcat-el-3.0-api1:9.0.87-1.el8_10.7
Oracle Linux 8tomcat-jsp-2.3-api1:9.0.87-1.el8_10.7
Oracle Linux 8tomcat-lib1:9.0.87-1.el8_10.7
Oracle Linux 8tomcat-servlet-4.0-api1:9.0.87-1.el8_10.7
Oracle Linux 8tomcat-webapps1:9.0.87-1.el8_10.7
Oracle Linux 9tomcat1:9.0.87-6.el9_7.1
Oracle Linux 9tomcat-admin-webapps1:9.0.87-6.el9_7.1
Oracle Linux 9tomcat-docs-webapp1:9.0.87-6.el9_7.1
Oracle Linux 9tomcat-el-3.0-api1:9.0.87-6.el9_7.1
Oracle Linux 9tomcat-jsp-2.3-api1:9.0.87-6.el9_7.1
Oracle Linux 9tomcat-lib1:9.0.87-6.el9_7.1
Oracle Linux 9tomcat-servlet-4.0-api1:9.0.87-6.el9_7.1
Oracle Linux 9tomcat-webapps1:9.0.87-6.el9_7.1
rapidfort amazon linux 2023tomcat101:10.1.40-1.amzn2023.0.1
rapidfort amazon linux 2023tomcat10-admin-webapps1:10.1.40-1.amzn2023.0.1
rapidfort amazon linux 2023tomcat10-docs-webapp1:10.1.40-1.amzn2023.0.1
rapidfort amazon linux 2023tomcat10-lib1:10.1.40-1.amzn2023.0.1
rapidfort amazon linux 2023tomcat10-webapps1:10.1.40-1.amzn2023.0.1
rapidfort amazon linux 2023tomcat91:9.0.104-1.amzn2023.0.1
rapidfort amazon linux 2023tomcat9-admin-webapps1:9.0.104-1.amzn2023.0.1
rapidfort amazon linux 2023tomcat9-docs-webapp1:9.0.104-1.amzn2023.0.1
rapidfort amazon linux 2023tomcat9-lib1:9.0.104-1.amzn2023.0.1
rapidfort amazon linux 2023tomcat9-webapps1:9.0.104-1.amzn2023.0.1
rapidfort debian 12tomcat100:10.1.40-1
rapidfort debian 12tomcat90:9.0.107-0+deb11u1
rapidfort debian 13tomcat100:10.1.40-1
rapidfort debian 13tomcat90:9.0.107-0+deb11u1
rapidfort Oracle Linux 10tomcat1:10.1.36-3.el10_1.1
rapidfort Oracle Linux 10tomcat-admin-webapps1:10.1.36-3.el10_1.1
rapidfort Oracle Linux 10tomcat-docs-webapp1:10.1.36-3.el10_1.1
rapidfort Oracle Linux 10tomcat-lib1:10.1.36-3.el10_1.1
rapidfort Oracle Linux 10tomcat-webapps1:10.1.36-3.el10_1.1
rapidfort Oracle Linux 10tomcat91:9.0.87-8.el10_1.1
rapidfort Oracle Linux 10tomcat9-admin-webapps1:9.0.87-8.el10_1.1
rapidfort Oracle Linux 10tomcat9-docs-webapp1:9.0.87-8.el10_1.1
rapidfort Oracle Linux 10tomcat9-lib1:9.0.87-8.el10_1.1
rapidfort Oracle Linux 10tomcat9-webapps1:9.0.87-8.el10_1.1
rapidfort Oracle Linux 9tomcat1:9.0.87-6.el9_7.1
rapidfort Oracle Linux 9tomcat-admin-webapps1:9.0.87-6.el9_7.1
rapidfort Oracle Linux 9tomcat-docs-webapp1:9.0.87-6.el9_7.1
rapidfort Oracle Linux 9tomcat-lib1:9.0.87-6.el9_7.1
rapidfort Oracle Linux 9tomcat-webapps1:9.0.87-6.el9_7.1
rapidfort rocky 9pki-servlet-engine1:9.0.50-1.el9_2.3
rapidfort ubuntu 20.04tomcat100:10.1.55-1ubuntu2~26.04.1
rapidfort ubuntu 20.04tomcat90:9.0.70-2
rapidfort ubuntu 22.04tomcat100:10.1.55-1ubuntu2~26.04.1
rapidfort ubuntu 22.04tomcat90:9.0.70-2
rapidfort ubuntu 24.04tomcat100:10.1.55-1ubuntu2~26.04.1
rapidfort ubuntu 24.04tomcat90:9.0.70-2
Red Hatjws5-tomcatdüzeltme belirtilmemiş
Red Hatpki-deps:10.6::pki-servlet-4.0-apidüzeltme belirtilmemiş
Red Hatpki-deps:10.6::pki-servlet-enginedüzeltme belirtilmemiş
Red Hatpki-servlet-4.0-apidüzeltme belirtilmemiş
Red Hatpki-servlet-enginedüzeltme belirtilmemiş
Red Hattomcatdüzeltme belirtilmemiş
Red Hattomcat-admin-webappsdüzeltme belirtilmemiş
Red Hattomcat-docs-webappdüzeltme belirtilmemiş
Red Hattomcat-el-2.2-apidüzeltme belirtilmemiş
Red Hattomcat-javadocdüzeltme belirtilmemiş
Red Hattomcat-jsp-2.2-apidüzeltme belirtilmemiş
Red Hattomcat-jsvcdüzeltme belirtilmemiş
Red Hattomcat-libdüzeltme belirtilmemiş
Red Hattomcat-servlet-3.0-apidüzeltme belirtilmemiş
Red Hattomcat-webappsdüzeltme belirtilmemiş
Red Hattomcat6düzeltme belirtilmemiş
Red Hattomcat6-admin-webappsdüzeltme belirtilmemiş
Red Hattomcat6-docs-webappdüzeltme belirtilmemiş
Red Hattomcat6-el-2.1-apidüzeltme belirtilmemiş
Red Hattomcat6-javadocdüzeltme belirtilmemiş
Red Hattomcat6-jsp-2.1-apidüzeltme belirtilmemiş
Red Hattomcat6-libdüzeltme belirtilmemiş
Red Hattomcat6-log4jdüzeltme belirtilmemiş
Red Hattomcat6-servlet-2.5-apidüzeltme belirtilmemiş
Red Hattomcat6-webappsdüzeltme belirtilmemiş
rocky 10tomcat1:10.1.36-3.el10_1.1
rocky 10tomcat-admin-webapps1:10.1.36-3.el10_1.1
rocky 10tomcat-docs-webapp1:10.1.36-3.el10_1.1
rocky 10tomcat-el-5.0-api1:10.1.36-3.el10_1.1
rocky 10tomcat-jsp-3.1-api1:10.1.36-3.el10_1.1
rocky 10tomcat-lib1:10.1.36-3.el10_1.1
rocky 10tomcat-servlet-6.0-api1:10.1.36-3.el10_1.1
rocky 10tomcat-webapps1:10.1.36-3.el10_1.1
rocky 10tomcat91:9.0.87-8.el10_1.1
rocky 10tomcat9-admin-webapps1:9.0.87-8.el10_1.1
rocky 10tomcat9-docs-webapp1:9.0.87-8.el10_1.1
rocky 10tomcat9-el-3.0-api1:9.0.87-8.el10_1.1
rocky 10tomcat9-jsp-2.3-api1:9.0.87-8.el10_1.1
rocky 10tomcat9-lib1:9.0.87-8.el10_1.1
rocky 10tomcat9-servlet-4.0-api1:9.0.87-8.el10_1.1
rocky 10tomcat9-webapps1:9.0.87-8.el10_1.1
rocky 8tomcat1:9.0.87-1.el8_10.7
rocky 8tomcat-admin-webapps1:9.0.87-1.el8_10.7
rocky 8tomcat-docs-webapp1:9.0.87-1.el8_10.7
rocky 8tomcat-el-3.0-api1:9.0.87-1.el8_10.7
rocky 8tomcat-jsp-2.3-api1:9.0.87-1.el8_10.7
rocky 8tomcat-lib1:9.0.87-1.el8_10.7
rocky 8tomcat-servlet-4.0-api1:9.0.87-1.el8_10.7
rocky 8tomcat-webapps1:9.0.87-1.el8_10.7
rocky 9tomcat1:9.0.87-6.el9_7.1
rocky 9tomcat-admin-webapps1:9.0.87-6.el9_7.1
rocky 9tomcat-docs-webapp1:9.0.87-6.el9_7.1
rocky 9tomcat-el-3.0-api1:9.0.87-6.el9_7.1
rocky 9tomcat-jsp-2.3-api1:9.0.87-6.el9_7.1
rocky 9tomcat-lib1:9.0.87-6.el9_7.1
rocky 9tomcat-servlet-4.0-api1:9.0.87-6.el9_7.1
rocky 9tomcat-webapps1:9.0.87-6.el9_7.1
seal maven::Seal Security Databaseorg.apache.tomcat.embed:tomcat-embed-core10.1.10+sp2, 10.1.11+sp999, 10.1.16+sp2, 10.1.19+sp2, 10.1.20+sp2, 10.1.26+sp2, 10.1.28+sp2, 10.1.30+sp2, 10.1.34+sp2, 9.0.80+sp2, 9.0.86+sp2
seal maven::Seal Security Databaseseal.sp1.org.apache.tomcat.embed:tomcat-embed-core10.1.10+sp999, 10.1.11+sp999, 10.1.16+sp999, 10.1.19+sp999, 10.1.20+sp999, 10.1.26+sp999, 10.1.28+sp999, 10.1.30+sp999, 10.1.34+sp999, 9.0.80+sp999, 9.0.86+sp999
ubuntu 18.04-ESMtomcat8düzeltme belirtilmemiş
ubuntu 18.04-ESMtomcat9düzeltme belirtilmemiş
ubuntu 20.04-ESMtomcat9düzeltme belirtilmemiş
ubuntu 22.04tomcat9düzeltme belirtilmemiş
ubuntu 24.04tomcat10düzeltme belirtilmemiş
ubuntu 25.04tomcat1010.1.35-1ubuntu0.1
wolfithingsboard4.0.1-r1

Referanslar

27 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.