Vulnerabilities in Tomcat 9.0.120 and Older on Siteminder Access Gateway
Article ID: 453698
Updated On:
Products
Issue/Introduction
Siteminder Access Gateway r12.8.7 and higher bundles Apache Tomcat 9.0.x as the application server. Tomcat versions vary by the Access Gateway release:
r12.8.7: Apache Tomcat 9.0.65
r12.8.8: Apache Tomcat 9.0.83
r12.8.8.1 Apache Tomcat 9.0.86
r12.9 ships with Apache Tomcat 9.0.100.0
KB281190 (archived) delivered Tomcat 9.0.86
KB381451 (archived) delivered Tomcat 9.0.96
KB383137 (archived) delivered Tomcat 9.0.97
KB384944 (archived) delivered Tomcat 9.0.98
KB397315 (archived) delivered Tomcat 9.0.104
KB403333 (archived) delivered Tomcat 9.0.106
KB406223 (archived) delivered Tomcat 9.1.107
KB417926 (archived) delivered Tomcat 9.0.110
KB431996 (archived) delivered Tomcat 9.0.115
KB437528 (archived) delivered Tomcat 9.0.117
KB441198 (archived) delivered Tomcat 9.0.118
KB448422 (archived) delivered Tomcat 9.0.120
There have been a number of vulnerabilities in Tomcat 9.0.120 and older which are remediated in Tomcat 9.0.121 and higher.
This KB delivers Tomcat 9.0.121 for Siteminder Access Gateway. For Tomcat 9.0.121 on SiteMinder Agent for Sharepoint, see the following KB:
KB 454483 "Vulnerabilities in Tomcat 9.0.120 and Older on SiteMinder Agent for Sharepoint 12.8.x"
Environment
PRODUCT: Siteminder
COMPONENT: Access Gateway
VERSIONS IMPACTED: r12.8.x; r12.9
OS: Any
Cause
The following CVE's were reported in Tomcat 9.0.120 and older. These are remediated with Tomcat 9.0.121.
The following CVE's impact Tomcat 9.1.120 and older and are remediated with Tomcat 9.0.121:
CVE-2026-73180: Authenticated WebSocket session survives end of HTTP session
SEVERITY: Low
DESCRIPTION: If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.
IMPACTED: 9.0.0-M1 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-68763: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
SEVERITY: Important
DESCRIPTION: An allocation leak in the HTTP/2 backlog tracking when a stream was reset could be manipulated to trigger a denial of service.
IMPACTED: 9.0.39 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-68569: Principal lookup could fail open in some cases
SEVERITY: Important
DESCRIPTION: For some authentication methods (e.g. CLIENT-CERT, SPNEGO), a user would be authenticated even if the user did not exist in the DataSourceRealm and JDBCRealm.
IMPACTED: 9.0.0.M1 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-68525: Redirect after FORM authentication may bypass method specific constraints
SEVERITY: Low
DESCRIPTION: The FORM authentication process allowed the bypassing of a security constraint that limited user access to a resource POST but not GET.
IMPACTED: 10.1.0-M1 to 10.1.57
REMEDIATED: 9.0.121
CVE-2026-66422: Servlet role references can bypass declarative role constraints
SEVERITY: Low
DESCRIPTION: security-role-ref definitions were incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().
IMPACTED: 9.0.25 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-66299: DoS in WebSocket chat example
SEVERITY: Low
DESCRIPTION: The WebSocket chat example provided an unbounded buffer for undelivered messages. A maliciously slow client could cause the buffer to grow continuously, eventually leading to an memory exhaustion and failure of the Tomcat process.
IMPACTED: 9.0.89 to 9.0.120
REMEDIATED: 9.0.121
NOTE: Users who followed the security guidance to remove the examples web application are not affected.
CVE-2026-65927: RewriteValve [N] restarts at the second rule and may bypass access control
SEVERITY: Important
DESCRIPTION: An off-by-one error impacting the [N] flag on the rewrite valves caused rewrite processing to restart at the second rule rather than the first rule.
IMPACTED: 9.0.0-M1 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-65905: Limited replay attack possible with DIGEST authentication
SEVERITY: Low
DESCRIPTION: If, before windowSize requests had been made, a client made a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request was replayable once only while the associated nonceCount remained within the replay window.
IMPACTED: 9.0.0.M1 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation
SEVERITY: Moderate
DESCRIPTION: The fix for CVE-2026-32990 was incomplete.
IMPACTED: 9.0.115 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets
SEVERITY: Low
DESCRIPTION: A race condition when creating a Unix Domain Socket allowed an unauthorised local user to access the Unix Domain Socket.
IMPACTED: 9.0.42 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-65182: Security constraint bypass
SEVERITY: Important
DESCRIPTION: The security constraint processing enabled a security constraint bypass if a constraint for a longer path was specified before a more restrictive constraint for a shorter sub-path.
IMPACTED: 9.0.0.M1 to 9.0.120
REMEDIATED: 9.0.121
Resolution
How to Verify The Version of Tomcat on Siteminder Access Gateway
Upgrade Tomcat for Symantec Siteminder Access Gateway to Tomcat 9.0.121
1) Download the Tomcat 9.0.121 patch ['Tomcat90121.zip' (attached to this KB)]
2) Copy 'Tomcat90121.zip' to the Access Gateway Server and unzip it.
3) Stop the Access Gateway Server
4) Back-up the <Install_Dir>\secure-proxy\Tomcat\lib directory
Defaults:
LINUX: <Install_Dir> = /opt/CA/secure-proxy/Tomcat/
WINDOWS: <Install_Dir> = C:\Program Files\CA\secure-proxy\Tomcat\
cp -R /<Install_Dir>/secure-proxy/Tomcat/lib/ /<Install_Dir>/secure-proxy/Tomcat/lib-BAK
5) Back-up the <Install_Dir>\secure-proxy\Tomcat\bin directory
cp -R /<Install_Dir>/secure-proxy/Tomcat/bin/ /<Install_Dir>/secure-proxy/Tomcat/bin-BAK
6) Copy the following jar files from "Tomcat90121.zip/lib" to "<Install_Dir>/secure-proxy/Tomcat/lib"
websocket-api.jar
tomcat-websocket.jar
tomcat-util-scan.jar
tomcat-util.jar
tomcat-jni.jar
tomcat-jdbc.jar
tomcat-i18n-zh-CN.jar
tomcat-i18n-ru.jar
tomcat-i18n-pt-BR.jar
tomcat-i18n-ko.jar
tomcat-i18n-ja.jar
tomcat-i18n-fr.jar
tomcat-i18n-es.jar
tomcat-i18n-de.jar
tomcat-i18n-cs.jar
tomcat-dbcp.jar
tomcat-coyote-ffm.jar
tomcat-coyote.jar
tomcat-api.jar
servlet-api.jar
jsp-api.jar
jaspic-api.jar
jasper-el.jar
jasper.jar
el-api.jar
ecj-4.20.jar
catalina-tribes.jar
catalina-storeconfig.jar
catalina-ssi.jar
catalina-ha.jar
catalina-ant.jar
catalina.jar
annotations-api.jar
NOTE: Copy the Files from source directory to target directory. Do Not copy the /bin and /lib directories themselves.
EXAMPLE:
cp -rf /<Path_to_Tomcat90121>/lib/* /<Install_Dir>/secure-proxy/Tomcat/lib/
7) Copy the following jar files from "Tomcat90121.zip/bin" to "<Install_Dir>/secure-proxy/Tomcat/bin"
tomcat-juli.jar
commons-daemon.jar
bootstrap.jar
NOTE: Copy the Files from source directory to target directory. Do not copy the /bin and /lib directories themselves.
EXAMPLE:
cp -rf /<Path_to_Tomcat90121>/bin/* /<Install_Dir>/secure-proxy/Tomcat/bin/
8a) Linux - backup your /secure-proxy/proxy-engine/ProxyServer.sh and add the classpath for the tomcat-juli.jar
Example:
SM_PROXY_CP=${TOMCAT_HOME}/bin/proxybootstrap.jar:${TOMCAT_HOME}/properties:${NETE_SPS_ROOT}/resources:${JAVA_HOME}/lib/tools.jar:${JAVA_HOME}/lib/tools.jar:${TOMCAT_HOME}/bin/bootstrap.jar:${TOMCAT_HOME}/bin/tomcat-juli.jar:${TOMCAT_HOME}/lib/smi18n.jar:${NETE_SPS_ROOT}/agentframework/java/bc-fips-1.0.2.4.jar
8b) Windows - backup your secure-proxy\proxy-engine\conf\SmSpsProxyEngine.properties and add the classpath for the tomcat-juli.jar
Example:
NETE_SPS_PROXYENGINE_CMD="%NETE_SPS_JAVA_HOME%\bin\java.exe" -Xms512m -Xmx1024m -XX:MaxMetaspaceSize=256M -Dcatalina.base="%NETE_SPS_TOMCAT_HOME%" -Dcatalina.home="%NETE_SPS_TOMCAT_HOME%" -Djava.endorsed.dirs="%NETE_SPS_TOMCAT_HOME%\endorsed" -Djava.endorsed.dirs="%NETE_SPS_TOMCAT_HOME%\endorsed" -Djava.io.tmpdir="%NETE_SPS_TOMCAT_HOME%\temp" -DSM_AGENT_LOG_CONFIG="%STS_AGENT_LOG_CONFIG_FILE%" -Dfile.encoding=UTF8 -DIWACONFIGHOME="%IWACONFIGHOME%" -Dlogger.properties="%NETE_SPS_TOMCAT_HOME%\properties\logger.properties" -classpath "%NETE_SPS_TOMCAT_HOME%\bin\proxybootstrap.jar;%NETE_SPS_TOMCAT_HOME%\bin\tomcat-juli.jar;%NETE_SPS_TOMCAT_HOME%\properties;%NETE_SPS_JAVA_HOME%\lib\tools.jar;%NETE_SPS_JAVA_HOME%\lib\tools.jar;%NETE_SPS_TOMCAT_HOME%\bin\bootstrap.jar;%NETE_SPS_ROOT%\resources;%NETE_SPS_ROOT%\agentframework\java\bc-fips-1.0.2.4.jar" com.netegrity.proxy.ProxyBootstrap -config "%NETE_SPS_ROOT%/proxy-engine/conf/server.conf"
9) Start the Access Gateway Server.
10) Once functionality has been verified, you can delete the backed up directories.
/<Install_Dir>/secure-proxy/Tomcat/lib-BAK
/<Install_Dir>/secure-proxy/Tomcat/bin-BAK
Additional Information
How to Verify The Version of Tomcat on Siteminder Access Gateway
KB 454483 "Vulnerabilities in Tomcat 9.0.120 and Older on SiteMinder Agent for Sharepoint 12.8.x"
Fixed_in_Apache_Tomcat_9.0.121
Vulnerabilities in Tomcat 9.0.120 and older:
CVE-2026-73180
CVE-2026-68763
CVE-2026-68569
CVE-2026-68525
CVE-2026-66422
CVE-2026-66299
CVE-2026-65927
CVE-2026-65905
CVE-2026-65637
CVE-2026-65183
CVE-2026-65182
CVE-2026-59084
CVE-2026-59083
CVE-2026-55956
CVE-2026-55955
CVE-2026-55276
CVE-2026-53434
CVE-2026-53404
CVE-2026-55029
CVE-2026-43515
CVE-2026-43514
CVE-2026-43513
CVE-2026-43512
CVE-2026-42498
CVE-2026-41293
CVE-2026-41284
CVE-2026-34500
CVE-2026-34487
CVE-2026-34486
CVE-2025-34483
CVE-2026-32990
CVE-2026-29146
CVE-2026-29145
CVE-2026-29129
CVE-2026-25854
CVE-2026-24880
CVE-2026-24734
CVE-2026-24733
CVE-2025-66614
CVE-2025-61795
CVE-2025-55754
CVE-2025-48989
CVE-2025-52434
CVE-2025-52520
CVE-2025-53506
CVE-2025-49125
CVE-2025-49124
CVE-2025-48988
CVE-2025-18976
CVE-2025-46701
CVE-2025-31651
CVE-2025-31650
CVE-2028-24813
CVE-2024-56337
CVE-2024-54677
CVE-2024-50379
CVE-2024-52318
CVE-2024-52317
CVE-2024-52316
CVE-2024-34750
CVE-2024-38286
CVE-2024-23672
CVE-2024-24549
CVE-2023-46589
CVE-2023-45648
CVE-2023-44487
CVE-2023-42795
CVE-2023-42794
CVE-2023-41080
CVE-2023-34981
CVE-2023-28709
CVE-2023-28708
CVE-2023-24998
CVE-2023-28708
CVE-2023-24998
CVE-2022-45143
CVE-2022-42252
Attachments
Feedback
