Apache Tomcat 9.0.0.M1 < 9.0.122 multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(349472);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/23");

  script_cve_id(
    "CVE-2026-73581",
    "CVE-2026-75973",
    "CVE-2026-76183",
    "CVE-2026-77756",
    "CVE-2026-77762",
    "CVE-2026-77791",
    "CVE-2026-78383",
    "CVE-2026-78437",
    "CVE-2026-79677",
    "CVE-2026-86248",
    "CVE-2026-86350",
    "CVE-2026-87022"
  );

  script_name(english:"Apache Tomcat 9.0.0.M1 < 9.0.122 multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 9.0.122. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.122_security-9 advisory.

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled
    vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from
    10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26,
    10.1.60 or 9.0.122, which fix the issue. (CVE-2026-86248)

  - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an
    unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1
    through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be
    affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be
    affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

  - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM
    TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from
    11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following
    versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through
    8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version
    11.0.26, 10.1.59, 9.0.122, which fixes the issue. (CVE-2026-73581)

  - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with
    SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the
    realm for the first web application to authenticate a request would be used for all web applications. This
    issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4
    through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be
    affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are
    recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. (CVE-2026-75973)

  - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints
    for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through
    11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at
    the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through
    7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version
    11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-76183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/apache/tomcat/commit/959a52a227cc35101b92dae35b722546167594d6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5d75c2a1");
  # https://github.com/apache/tomcat/commit/5adadc4ef413d5050f664d40800bbff74bd5d5ed
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?14905a1f");
  # https://github.com/apache/tomcat/commit/fc41d82e0e383e4d6e88ad321d245dafdc17d26d
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?966b4f62");
  # https://github.com/apache/tomcat/commit/c8fa5430233bca5b209c593dd446f88fda9d543e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9d27d49f");
  # https://github.com/apache/tomcat/commit/a28c35055ab11d35929ad564beb1a23a67b39546
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8754859e");
  # https://github.com/apache/tomcat/commit/265bdc0a58b1447ff5d8f8b96ea81de58cb74c8c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9ff94591");
  # https://github.com/apache/tomcat/commit/7a5945f1de1d3310214234dfbbd7c569af52d058
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?40f739a8");
  # https://github.com/apache/tomcat/commit/71f27c2e84810930beda468b5ba732dcd0ef2652
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?00cd670d");
  # https://github.com/apache/tomcat/commit/e590588ab7649c93d49b0eb7b3152700a977880d
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2efa003c");
  # https://github.com/apache/tomcat/commit/a93a60a33f4cc202542eb6a0b87b7142d7db311c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?573b96ae");
  # https://github.com/apache/tomcat/commit/043115414a39127cad015e9d285296e59c18bb41
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?be530724");
  # https://github.com/apache/tomcat/commit/2dce8f26b3ba6a89c8f172b94fa41a5fa2dcc361
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6cd2d87e");
  # https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.122
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?68d82eaf");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 9.0.122 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-78383");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-86248");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/23");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:9");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Tomcat");

  exit(0);
}

include('vcf_extras.inc');

vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');

var constraints = [
  { 'min_version' : '9.0.0.M1', 'max_version' : '9.0.121', 'fixed_version' : '9.0.122' }
];

vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);