Bartlomiej Dmitruk

**Name of the Vulnerable Software and Affected Versions** Apache Shiro versions 2.0-alpha through 2.2.0 Apache Shiro version 3.0.0-alpha-1 **Description** The Jakarta EE module in Apache Shiro uses the HTTP Referer header to issue redirects after user login. Insufficient validation of this client-controlled value allows an attacker to influence the redirect target in applications utilizing the `shiro-jakarta-ee` integration module. **Recommendations** Update Apache Shiro versions 2.0-alpha through 2.2.0 to a fixed version. Update Apache Shiro version 3.0.0-alpha-1 to a fixed version. Restrict the use of the `shiro-jakarta-ee` integration module as a temporary mitigation.

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server versions 2.4.0 through 2.4.67 **Description** A buffer underwrite issue exists when using crafted regular expressions within the configuration. **Recommendations** Upgrade to version 2.4.68.

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.20, 10.1.0-M1 through 10.1.53, and 9.0.40 through 9.0.116 Description A flaw exists within the JsonAccessLogValve component of Apache Tomcat related to improper encoding or escaping of output. Recommendations Upgrade to version 11.0.21 Upgrade to version 10.1.54 Upgrade to version 9.0.117

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat version 11.0.20 Apache Tomcat version 10.1.53 Apache Tomcat version 9.0.116 **Description** A flaw exists where the `EncryptInterceptor`, a component designed to ensure data encryption, can be bypassed. This issue was introduced as a result of a fix for a previous vulnerability. The bypass allows sensitive data to remain unencrypted, which may lead to unauthorized access to protected information or information disclosure. In the context of Tribes clustering, the `EncryptInterceptor` incorrectly forwards failed decryption attempts to internal deserialization logic instead of dropping them, which could allow a remote attacker to trigger arbitrary code execution if they can reach the Tribes receiver on TCP port 4000 and the target has usable gadget classes on the classpath. **Recommendations** Upgrade Apache Tomcat version 11.0.20 to 11.0.21. Upgrade Apache Tomcat version 10.1.53 to 10.1.54. Upgrade Apache Tomcat version 9.0.116 to 9.0.117.

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.20, versions 10.1.0-M1 through 10.1.53, and versions 9.0.13 through 9.0.116 Description An issue exists in the cloud membership for clustering component of Apache Tomcat that allows for the insertion of sensitive information into log files, specifically exposing the Kubernetes bearer token. Recommendations Upgrade to version 11.0.21 Upgrade to version 10.1.54 Upgrade to version 9.0.117

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server version 2.4.66 **Description** A double free error exists within the HTTP/2 protocol implementation. A double free occurs when the software attempts to release the same memory space twice, which can corrupt heap structures. This flaw allows a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service by sending specially crafted HTTP/2 traffic. The issue is particularly critical for servers handling multiple tenants or user-driven content, as attackers can establish numerous connections and streams to trigger the flaw. Standard authentication methods, such as basic authentication or reverse proxy authentication, do not prevent the establishment of the malicious HTTP/2 connections required for exploitation. **Recommendations** Upgrade Apache HTTP Server to version 2.4.67 or later.