Threats Tagged 'cve-2026-29146'

Two security vulnerabilities affecting Apache Tomcat in Red Hat Enterprise Linux 10.0 Extended Update Support have been addressed. The first is an information disclosure vulnerability via a Padding Oracle attack in the EncryptInterceptor component (CVE-2026-29146). The second involves missing encryption of sensitive data due to an EncryptInterceptor bypass (CVE-2026-34486). Red Hat has released updated packages to fix these issues. The update is rated as Important by Red Hat Product Security.

This advisory addresses two security vulnerabilities in Apache Tomcat related to the EncryptInterceptor component. The first vulnerability (CVE-2026-29146) is an information disclosure issue via a Padding Oracle attack. The second vulnerability (CVE-2026-34486) involves missing encryption of sensitive data due to an EncryptInterceptor bypass. Red Hat has released an update for Red Hat Enterprise Linux 10 to fix these issues and also removed the tomcat clustering JAR from RPM builds. The update is rated as Important by Red Hat Product Security.

Red Hat has issued a security advisory for tomcat9 addressing two vulnerabilities related to the EncryptInterceptor component. These include an information disclosure vulnerability via a Padding Oracle attack (CVE-2026-29146) and a missing encryption of sensitive data due to an EncryptInterceptor bypass (CVE-2026-34486). The advisory rates the security impact as Important and provides updated packages to remediate these issues in Red Hat Enterprise Linux 10.0 Extended Update Support. No CVSS scores are provided in the advisory.

Red Hat has issued a security advisory for tomcat9 in Red Hat Enterprise Linux 10, addressing two vulnerabilities: an information disclosure via a Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) and missing encryption of sensitive data due to EncryptInterceptor bypass (CVE-2026-34486). The update also removes the tomcat clustering JAR from RPM builds. The advisory rates the security impact as Important. Updated packages are available for multiple architectures of Red Hat Enterprise Linux 10 and its extended update support versions.

Red Hat has issued a security advisory for Apache Tomcat addressing two vulnerabilities related to the EncryptInterceptor component. The first vulnerability (CVE-2026-29146) involves information disclosure via a Padding Oracle attack. The second vulnerability (CVE-2026-34486) concerns missing encryption of sensitive data due to an EncryptInterceptor bypass. These issues affect Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related variants. An update to Tomcat 9.0.87-2.el9_4 is available to remediate these vulnerabilities.

Two security vulnerabilities affecting Apache Tomcat in Red Hat Enterprise Linux 9.6 Extended Update Support have been addressed. The first is an information disclosure vulnerability via a Padding Oracle attack in the EncryptInterceptor component (CVE-2026-29146). The second involves missing encryption of sensitive data due to an EncryptInterceptor bypass (CVE-2026-34486). Red Hat has released updated Tomcat packages to fix these issues. The update is rated as Important by Red Hat Product Security. Users of the affected Red Hat Enterprise Linux 9.6 Extended Update Support versions should apply the provided security update to remediate these vulnerabilities.

Two security vulnerabilities affecting Apache Tomcat in Red Hat Enterprise Linux 9.2 have been addressed. The first is an information disclosure issue via a Padding Oracle vulnerability in the EncryptInterceptor component (CVE-2026-29146). The second involves missing encryption of sensitive data due to an EncryptInterceptor bypass (CVE-2026-34486). Red Hat has released updated Tomcat packages to remediate these issues.

Two security vulnerabilities have been identified in Apache Tomcat related to the EncryptInterceptor component. CVE-2026-29146 is an information disclosure vulnerability via a Padding Oracle attack, and CVE-2026-34486 involves missing encryption of sensitive data due to an EncryptInterceptor bypass. These issues affect Red Hat Enterprise Linux 9 distributions and related variants. A security update addressing these vulnerabilities has been released by Red Hat. The update also includes bug fixes and removal of the tomcat clustering JAR from RPM builds.

Two security vulnerabilities have been identified in Apache Tomcat related to the EncryptInterceptor component. The first vulnerability (CVE-2026-29146) involves information disclosure via a Padding Oracle attack. The second vulnerability (CVE-2026-34486) involves missing encryption of sensitive data due to an EncryptInterceptor bypass. Red Hat has issued a security advisory and released updated Tomcat packages for Red Hat Enterprise Linux 8.8 to address these issues.