Apache Tomcat 11.0.0.M25 < 11.0.27 multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(367788);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/20");

  script_cve_id(
    "CVE-2026-88041",
    "CVE-2026-93446",
    "CVE-2026-101296",
    "CVE-2026-101356",
    "CVE-2026-103119"
  );

  script_name(english:"Apache Tomcat 11.0.0.M25 < 11.0.27 multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 11.0.27. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.27_security-11 advisory.

  - A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was
    configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without
    providing the correct password. (CVE-2026-101296)

  - A buffer under-read meant that a large non-blocking write could result in the response body being split
    between the current request and the next request received on that connection leading most likely to
    failure of the second request and possibly leakage of data from the first response to the second.
    (CVE-2026-103119)

  - Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger
    request and/or response mix-up between users. (CVE-2026-101356)

  - Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.
    (CVE-2026-93446)

  - Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request
    to leak into a subsequent request. (CVE-2026-88041)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/apache/tomcat/commit/f13748baa17a5e28925be455e0e2832e2032f58c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5a7d3499");
  # https://github.com/apache/tomcat/commit/1dc6aa151b3b99b32ac9ae7c60e41c326063321b
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?60b65ff4");
  # https://github.com/apache/tomcat/commit/e43453fc04abb44f64faf571ca98af71aa3c20a1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fe04d2a6");
  # https://github.com/apache/tomcat/commit/e49e0c47ea925ad9442ba933a144ea62433d6a06
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?762ff696");
  # https://github.com/apache/tomcat/commit/a276dea827437090498678e09df0539ec397a7b5
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b4dbadbe");
  # https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.27
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?890f78f0");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 11.0.27 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-101296");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/20");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:11");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Tomcat");

  exit(0);
}

include('vcf_extras.inc');

vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');

var constraints = [
  { 'min_version' : '11.0.0.M25', 'max_version' : '11.0.26', 'fixed_version' : '11.0.27' }
];

vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);