Release date:
2026-11-11 18:49:30 UTC
Description:
* SECURITY UPDATE: Authentication bypass in DataSourceRealm and JDBCRealm
- debian/patches/CVE-2026-68569.patch: fail authentication when the
database connection or the user or role lookup fails, require the
user to exist in the database for CLIENT-CERT and SPNEGO
authentication, and skip the role lookup when no role store is
configured in DataSourceRealm and JDBCRealm
- CVE-2026-68569
Updated packages:
-
libtomcat9-embed-java_9.0.31-1~deb10u12+tuxcare.els9_all.deb
sha:3d230080a1e063e2b4f1a0f71d016927969667a4
-
libtomcat9-java_9.0.31-1~deb10u12+tuxcare.els9_all.deb
sha:59a7394ae95913434ddf70220faac394646b5f9e
-
tomcat9_9.0.31-1~deb10u12+tuxcare.els9_all.deb
sha:191204db492519977a7a88f1717499c60a35584b
-
tomcat9-admin_9.0.31-1~deb10u12+tuxcare.els9_all.deb
sha:88950a32b5017bb8dcac901ceddc9eaaf8462897
-
tomcat9-common_9.0.31-1~deb10u12+tuxcare.els9_all.deb
sha:bff5d32471d735b68ec3f63a62d7b1027a91e767
-
tomcat9-docs_9.0.31-1~deb10u12+tuxcare.els9_all.deb
sha:921112a28050535f9769b115580bf1235985e4c7
-
tomcat9-examples_9.0.31-1~deb10u12+tuxcare.els9_all.deb
sha:1286895a59f8c8c60bd52e5f5e395d112acf38ab
-
tomcat9-user_9.0.31-1~deb10u12+tuxcare.els9_all.deb
sha:81e8aec801bf1a1dc22fe3b088d1b5d15b5fe6ac
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
