Lucene search
+L

10 matches found

Kitploit
Kitploit
added 2026/09/17 1:03 a.m.12 views

cve-2026-29145

CVE-2026-29145 — 即使禁用软失败,OCSP 检查有时仍会软失败 发现者: gregk4sec https://github.com/gregk4sec/cve 发现日期: 2026-02-26 受影响厂商: Apache 受影响产品: Tomcat 严重性: 9.1 严重 CWE: CWE-287 身份验证不当 状态: 审核中 / 已修复 / 私有 / 公开 ✅ 摘要 当禁用软失败时,CLIENTCERT 身份验证在某些场景下未按预期使 OCSP 检查失败。 技术分析 参见:analysis.md 复现步骤 1. 环境搭建 2. 触发条件 3. 预期行为与实际行为 4...

9.1CVSS7.5AI score0.00715EPSS
SaveExploits2References3
Kitploit
Kitploit
added 2026/09/16 4:26 p.m.11 views

CVE-2026-29145-Tester

CVE-2026-29145 测试环境 📌 概述 本仓库包含一个概念验证(PoC)环境,用于测试 CVE-2026-29145 。 该漏洞是 Apache Tomcat 的相互 TLS(CLIENTCERT)实现中的身份验证绕过 。当 OCSP(在线证书状态协议)配置为禁用软失败时,Tomcat 可能无法将 OCSP 检查失败视为硬性拒绝。如果 OCSP 响应器不可达或返回错误,这允许持有可能已吊销或未验证证书的客户端绕过身份验证。 🛡️ 漏洞详情 属性| 值 ---|--- CVE ID| CVE-2026-29145 CVSS 评分| 9.1(严重)-...

9.1CVSS7.5AI score0.00715EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/15 10:42 p.m.12 views

CVE-2026-29145-Tester

CVE-2026-29145 测试环境 📌 概述 本仓库包含一个概念验证(PoC)环境,用于测试 CVE-2026-29145 。 该漏洞是 Apache Tomcat 的相互 TLS(CLIENTCERT)实现中的身份验证绕过 。当 OCSP(在线证书状态协议)配置为禁用软失败时,Tomcat 可能无法将 OCSP 检查失败视为硬性拒绝。如果 OCSP 响应器不可达或返回错误,这允许持有可能已吊销或未验证证书的客户端绕过身份验证。 🛡️ 漏洞详情 属性| 值 ---|--- CVE ID| CVE-2026-29145 CVSS 评分| 9.1(严重)-...

9.1CVSS7.5AI score0.00715EPSS
SaveExploits2
Oracle linux
Oracle linux
added 2026/07/21 12:00 a.m.22 views

tomcat9 security update

1:9.0.117-2 - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds 1:9.0.117-1 - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is...

9.6CVSS7.9AI score0.98616EPSS
SaveExploits12
SUSE Linux
SUSE Linux
added 2026/04/24 11:48 a.m.15 views

Security update for tomcat

This update for tomcat fixes the following issues: Security fixes: CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. CVE-2026-25854: Occasionally open redirect bsc1261851. CVE-2026-29129: TLS cipher order is not preserved bsc1261852. CVE-2026-29145: OCSP checks sometimes...

8.7CVSS5.6AI score0.0885EPSS
SaveExploits2References40
OSV
OSV
added 2026/04/24 11:48 a.m.11 views

SUSE-SU-2026:1604-1 Security update for tomcat

This update for tomcat fixes the following issues: Security fixes: - CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. - CVE-2026-25854: Occasionally open redirect bsc1261851. - CVE-2026-29129: TLS cipher order is not preserved bsc1261852. - CVE-2026-29145: OCSP checks...

9.1CVSS5.4AI score0.98616EPSS
SaveExploits10References21
OSV
OSV
added 2026/04/22 11:07 a.m.9 views

SUSE-SU-2026:21378-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. - CVE-2026-25854: Occasionally open redirect bsc1261851. - CVE-2026-29129: TLS cipher order is not preserved bsc1261852. - CVE-2026-29145: OCSP checks sometimes soft-fail...

9.1CVSS7.4AI score0.98616EPSS
SaveExploits10References21
OSV
OSV
added 2026/04/22 10:52 a.m.12 views

OPENSUSE-SU-2026:20611-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. - CVE-2026-25854: Occasionally open redirect bsc1261851. - CVE-2026-29129: TLS cipher order is not preserved bsc1261852. - CVE-2026-29145: OCSP checks sometimes soft-fail...

9.1CVSS8.6AI score0.98616EPSS
SaveExploits10References20
OSV
OSV
added 2026/04/21 11:42 a.m.11 views

SUSE-SU-2026:21366-1 Security update for tomcat11

This update for tomcat11 fixes the following issues: - Update to Tomcat 11.0.21 - CVE-2026-24880: Request smuggling via invalid chunk extension bsc1261850. - CVE-2026-25854: Occasionally open redirect bsc1261851. - CVE-2026-29129: TLS cipher order is not preserved bsc1261852. - CVE-2026-29145: OC...

9.1CVSS7.4AI score0.98616EPSS
SaveExploits10References21
OSV
OSV
added 2026/04/13 10:19 a.m.15 views

BIT-TOMCAT-2026-29145 Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0 through 11.0.18, from 10.1.0 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: fr...

9.1CVSS5.8AI score0.00715EPSS
SaveExploits2References3
Rows per page
Query Builder