Release date:
2026-10-09 10:13:35 UTC
Description:
* SECURITY UPDATE: DataSourceRealm and JDBCRealm getPrincipal() returned
a principal for a user that does not exist or when the database could
not be reached, and a failed role lookup did not fail authentication
- debian/patches/CVE-2026-68569.patch: validate that the user exists in
getPrincipal(), fail authentication and principal lookup when the
role query fails, and return an empty role list when no role store
is defined
- CVE-2026-68569
Updated packages:
-
libtomcat9-embed-java_9.0.118-0+deb11u1+tuxcare.els2_all.deb
sha:8f3570b42ce72b23dc4d6b82565a96e7ebbca522
-
libtomcat9-java_9.0.118-0+deb11u1+tuxcare.els2_all.deb
sha:3a1547b449034f50515e2d1b7bed41a028f7adc2
-
tomcat9_9.0.118-0+deb11u1+tuxcare.els2_all.deb
sha:f08b83b39e43f4ee44e8c9706980906dbf50c693
-
tomcat9-admin_9.0.118-0+deb11u1+tuxcare.els2_all.deb
sha:e3b3e6de309bca71a01ed097c4c5f6ce21c4d11a
-
tomcat9-common_9.0.118-0+deb11u1+tuxcare.els2_all.deb
sha:b1ae642b84ee171ce0f09357209d8ec6771719c4
-
tomcat9-docs_9.0.118-0+deb11u1+tuxcare.els2_all.deb
sha:d21bbb39f5d2b377e8663c7ccc163d49fd6b3b6f
-
tomcat9-examples_9.0.118-0+deb11u1+tuxcare.els2_all.deb
sha:00b95c8dda72a826cb7f77830131a0b68b6e5be3
-
tomcat9-user_9.0.118-0+deb11u1+tuxcare.els2_all.deb
sha:197e7d00d7f534bb27e439b788c1059d0c09a7ef
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
