CVE-2024-52316

When Apache Tomcat uses a custom ServerAuthContext component as part of Jakarta Authentication (formerly JASPIC), and the component throws an exception during the authentication process without explicitly setting an HTTP response code signaling failure, the server may incorrectly consider the authentication as successfully completed. This is an error of category CWE-391 (Unchecked Error Condition) and CWE-754 (Improper Check for Unusual Exceptional Conditions) — the application does not properly verify the error state and continues processing the request as if the user were authenticated. Apache indicates that no standard Jakarta Authentication components are known to exhibit such behavior, which limits the vulnerability scope to environments using custom implementations.

An attacker can bypass the authentication mechanism and gain unauthorized access to protected application resources, which may lead to violations of confidentiality, integrity, and availability of data processed by the server.

Apache Tomcat should be updated to version 11.0.0, 10.1.31 or 9.0.96, which contain the fix. Version 8.5.x is marked as EOL and will not receive an official patch — migration to a supported branch is recommended. As a workaround, consider replacing or removing the custom JASPIC ServerAuthContext component that does not explicitly handle HTTP error codes during exceptions.

Apache Tomcat in versions: 11.0.0-M1 through 11.0.0-M26, 10.1.0-M1 through 10.1.30, 9.0.0-M1 through 9.0.95. EOL versions: 8.5.0 through 8.5.100 (and potentially other EOL versions). The vulnerability affects only configurations using a custom JASPIC ServerAuthContext component. It also affects Debian Linux (Apache Tomcat packages).