This vulnerability in Apache Tomcat involves the failure to properly act upon detected error conditions when configuring CRLs for an FFM based connector. Affected versions include 9.0.83 through 9.0.118, 10.1.0-M7 through 10.1.55, and 11.0.0-M1 through 11.0.22. The issue is fixed in versions 9.0.119, 10.1.56, and 11.0.23. The vulnerability has a CVSS 3.1 vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability.

Successful exploitation could lead to a high impact on confidentiality and integrity of the affected system, as indicated by the CVSS vector. The vulnerability arises from Tomcat not properly handling error conditions related to CRL configuration, potentially allowing attackers to bypass certain security checks or cause incorrect validation outcomes. There is no known exploitation in the wild at this time.

A fix is available. Users are strongly recommended to upgrade to Apache Tomcat versions 11.0.23, 10.1.56, or 9.0.119 or later, which address this vulnerability. No additional mitigation steps are indicated beyond applying the official updates.