Vulnerabilities in Tomcat 9.0.120 and Older on SiteMinder Agent for Sharepoint 12.8.x
Article ID: 454483
Updated On:
Products
Issue/Introduction
The SiteMinder Web Agent for Sharepoint 12.8.7 and higher bundles Tomcat 9.0.x as the application server. Tomcat versions vary by the Web Agent for Sharepoint release:
r12.8.7: Tomcat 9.0.70
r12.8.8: Tomcat 9.0.83
KB398401 (archived) delivered Tomcat 9.0.104
KB406223 (archived) delivered Tomcat 9.0.105
KB417957 (archived) delivered Tomcat 9.0.107
KB417957 (archived) delivered Tomcat 9.0.111
KB433468 (archived) delivered Tomcat 9.0.115
KB437759 (archived) delivered Tomcat 9.1.117
KB442459 (archived) delivered Tomcat 9.1.118
KB448541 (archived) delivered Tomcat 9.1.120
There have been a number of vulnerabilities in Tomcat 9.0.120 and older which are remediated in Tomcat 9.0.121.
This KB delivers Tomcat 9.0.121 for SiteMinder Agent for Sharepoint 12.8.7 and higher. For Tomcat 9.0.121 on SiteMinder Access Gateway, see the following KB:
KB 453698 "Vulnerabilities in Tomcat 9.0.120 and Older on Siteminder Access Gateway"
NOTE: Web Agent for Sharepoint r12.52 SP01 ships with Tomcat 7.0.x
Environment
PRODUCT: SiteMinder
COMPONENT: Web Agent for Sharepoint
VERSIONS IMPACTED: r12.8.7 and higher
OS: Any
Cause
The following CVE's impact Tomcat 9.1.120 and older and are remediated with Tomcat 9.0.121:
CVE-2026-73180: Authenticated WebSocket session survives end of HTTP session
SEVERITY: Low
DESCRIPTION: If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.
IMPACTED: 9.0.0-M1 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-68763: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
SEVERITY: Important
DESCRIPTION: An allocation leak in the HTTP/2 backlog tracking when a stream was reset could be manipulated to trigger a denial of service.
IMPACTED: 9.0.39 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-68569: Principal lookup could fail open in some cases
SEVERITY: Important
DESCRIPTION: For some authentication methods (e.g. CLIENT-CERT, SPNEGO), a user would be authenticated even if the user did not exist in the DataSourceRealm and JDBCRealm.
IMPACTED: 9.0.0.M1 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-68525: Redirect after FORM authentication may bypass method specific constraints
SEVERITY: Low
DESCRIPTION: The FORM authentication process allowed the bypassing of a security constraint that limited user access to a resource POST but not GET.
IMPACTED: 10.1.0-M1 to 10.1.57
REMEDIATED: 9.0.121
CVE-2026-66422: Servlet role references can bypass declarative role constraints
SEVERITY: Low
DESCRIPTION: security-role-ref definitions were incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().
IMPACTED: 9.0.25 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-66299: DoS in WebSocket chat example
SEVERITY: Low
DESCRIPTION: The WebSocket chat example provided an unbounded buffer for undelivered messages. A maliciously slow client could cause the buffer to grow continuously, eventually leading to an memory exhaustion and failure of the Tomcat process.
IMPACTED: 9.0.89 to 9.0.120
REMEDIATED: 9.0.121
NOTE: Users who followed the security guidance to remove the examples web application are not affected.
CVE-2026-65927: RewriteValve [N] restarts at the second rule and may bypass access control
SEVERITY: Important
DESCRIPTION: An off-by-one error impacting the [N] flag on the rewrite valves caused rewrite processing to restart at the second rule rather than the first rule.
IMPACTED: 9.0.0-M1 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-65905: Limited replay attack possible with DIGEST authentication
SEVERITY: Low
DESCRIPTION: If, before windowSize requests had been made, a client made a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request was replayable once only while the associated nonceCount remained within the replay window.
IMPACTED: 9.0.0.M1 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-65637: HTTP/2 no-authority bypass of strict SNI validation
SEVERITY: Moderate
DESCRIPTION: The fix for CVE-2026-32990 was incomplete.
IMPACTED: 9.0.115 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-65183: TOCTOU when setting specific permissions for Unix Domain Sockets
SEVERITY: Low
DESCRIPTION: A race condition when creating a Unix Domain Socket allowed an unauthorised local user to access the Unix Domain Socket.
IMPACTED: 9.0.42 to 9.0.120
REMEDIATED: 9.0.121
CVE-2026-65182: Security constraint bypass
SEVERITY: Important
DESCRIPTION: The security constraint processing enabled a security constraint bypass if a constraint for a longer path was specified before a more restrictive constraint for a shorter sub-path.
IMPACTED: 9.0.0.M1 to 9.0.120
REMEDIATED: 9.0.121
Resolution
How to Verify The Version of Tomcat on SiteMinder Web Agent For Sharepoint
Upgrade Tomcat for Symantec SiteMinder Web Agent for Sharepoint to Tomcat 9.0.120
1) Download the 'Tomcat90121.zip' (attached to this KB)
2) Copy 'Tomcat90121.zip' to the Web Agent for Sharepoint Server and unzip it.
3) Stop the Web Agent for Sharepoint Server
4) Back-up the \Agent-for-SharePoint\Tomcat\lib\ directory
EXAMPLE: cp -R <Install_Dir>/Agent-for-SharePoint/Tomcat/lib/ <Install_Dir>/Agent-for-SharePoint/Tomcat/lib-BAK
5) Back-up the \Agent-for-SharePoint\Tomcat\bin directory
EXAMPLE: cp -R <Install_Dir>/Agent-for-SharePoint/Tomcat/bin/ <Install_Dir>/Agent-for-SharePoint/Tomcat/bin-BAK
6) Copy the following jar files from "/Tomcat90121/lib" to "/Agent-for-SharePoint/Tomcat/lib"
websocket-api.jar
tomcat-websocket.jar
tomcat-util-scan.jar
tomcat-util.jar
tomcat-jni.jar
tomcat-jdbc.jar
tomcat-i18n-zh-CN.jar
tomcat-i18n-ru.jar
tomcat-i18n-pt-BR.jar
tomcat-i18n-ko.jar
tomcat-i18n-ja.jar
tomcat-i18n-fr.jar
tomcat-i18n-es.jar
tomcat-i18n-de.jar
tomcat-i18n-cs.jar
tomcat-dbcp.jar
tomcat-coyote-ffm.jar
tomcat-coyote.jar
tomcat-api.jar
servlet-api.jar
jsp-api.jar
jaspic-api.jar
jasper-el.jar
jasper.jar
el-api.jar
ecj-4.20.jar
catalina-tribes.jar
catalina-storeconfig.jar
catalina-ssi.jar
catalina-ha.jar
catalina-ant.jar
catalina.jar
annotations-api.jar
NOTE: Copy the Files from source directory to target directory. Do Not copy the /bin and /lib directories themselves.
EXAMPLE: cp -rf /<Tomcat90121>/lib/* <Install_Dir>/Agent-for-SharePoint/Tomcat/lib/
7) Copy the following jar files from "Tomcat90121/bin" to "/Agent-for-SharePoint/Tomcat/bin"
bootstrap.jar
commons-daemon.jar
tomcat-juli.jar
NOTE: Copy the Files from source directory to target directory. Do not copy the /bin and /lib directories themselves.
EXAMPLE:
cp -rf /<Tomcat90120>/bin/* <Install_Dir>/Agent-for-SharePoint/Tomcat/bin/
8a) Linux - backup your <Install_Dir>/Agent-for-SharePoint/proxy-engine/ProxyServer.sh and add the classpath for the tomcat-juli.jar
Example:
SM_PROXY_CP=${TOMCAT_HOME}/bin/proxybootstrap.jar:${TOMCAT_HOME}/properties:${NETE_SPS_ROOT}/resources:${JAVA_HOME}/lib/tools.jar:${JAVA_HOME}/lib/tools.jar:${TOMCAT_HOME}/bin/bootstrap.jar:${TOMCAT_HOME}/bin/tomcat-juli.jar:${TOMCAT_HOME}/lib/smi18n.jar:${NETE_SPS_ROOT}/agentframework/java/bc-fips-1.0.2.4.jar
8b) Windows - backup your \Agent-for-SharePoint\proxy-engine\conf\SmSpsProxyEngine.properties and add the classpath for the tomcat-juli.jar
Example:
NETE_SPS_PROXYENGINE_CMD="%NETE_SPS_JAVA_HOME%\bin\java.exe" -Xms512m -Xmx1024m -XX:MaxMetaspaceSize=256M -Dcatalina.base="%NETE_SPS_TOMCAT_HOME%" -Dcatalina.home="%NETE_SPS_TOMCAT_HOME%" -Djava.endorsed.dirs="%NETE_SPS_TOMCAT_HOME%\endorsed" -Djava.endorsed.dirs="%NETE_SPS_TOMCAT_HOME%\endorsed" -Djava.io.tmpdir="%NETE_SPS_TOMCAT_HOME%\temp" -DSM_AGENT_LOG_CONFIG="%STS_AGENT_LOG_CONFIG_FILE%" -Dfile.encoding=UTF8 -DIWACONFIGHOME="%IWACONFIGHOME%" -Dlogger.properties="%NETE_SPS_TOMCAT_HOME%\properties\logger.properties" -classpath "%NETE_SPS_TOMCAT_HOME%\bin\proxybootstrap.jar;%NETE_SPS_TOMCAT_HOME%\bin\tomcat-juli.jar;%NETE_SPS_TOMCAT_HOME%\properties;%NETE_SPS_JAVA_HOME%\lib\tools.jar;%NETE_SPS_JAVA_HOME%\lib\tools.jar;%NETE_SPS_TOMCAT_HOME%\bin\bootstrap.jar;%NETE_SPS_ROOT%\resources;%NETE_SPS_ROOT%\agentframework\java\bc-fips-1.0.2.4.jar" com.netegrity.proxy.ProxyBootstrap -config "%NETE_SPS_ROOT%/proxy-engine/conf/server.conf"
9) Start the Agent for Sharepoint Server.
10) Once functionality has been verified, you can delete the backed up directories
<Install_Dir>/Agent-for-SharePoint/Tomcat/lib-BAK
<Install_Dir>/Agent-for-SharePoint/Tomcat/bin-BAK
Additional Information
How to Verify The Version of Tomcat on Siteminder Web Agent For Sharepoint
KB 453698 "Vulnerabilities in Tomcat 9.0.120 and Older on Siteminder Access Gateway"
Fixed_in_Apache_Tomcat_9.0.121
Vulnerabilities in Tomcat 9.0.120 and older:
CVE-2026-73180
CVE-2026-68763
CVE-2026-68569
CVE-2026-68525
CVE-2026-66422
CVE-2026-66299
CVE-2026-65927
CVE-2026-65905
CVE-2026-65637
CVE-2026-65183
CVE-2026-65182
CVE-2026-59084
CVE-2026-59083
CVE-2026-55956
CVE-2026-55955
CVE-2026-55276
CVE-2026-53434
CVE-2026-53404
CVE-2026-55029
CVE-2026-43515
CVE-2026-43514
CVE-2026-43513
CVE-2026-43512
CVE-2026-42498
CVE-2026-41293
CVE-2026-41284
CVE-2026-34500
CVE-2026-34487
CVE-2026-34486
CVE-2025-34483
CVE-2026-32990
CVE-2026-29146
CVE-2026-29145
CVE-2026-29129
CVE-2026-25854
CVE-2026-24880
CVE-2026-24734
CVE-2026-24733
CVE-2025-66614
CVE-2025-61795
CVE-2025-55754
CVE-2025-48989
CVE-2025-52434
CVE-2025-52520
CVE-2025-53506
CVE-2025-49125
CVE-2025-49124
CVE-2025-48988
CVE-2025-18976
CVE-2025-46701
CVE-2025-31651
CVE-2025-31650
CVE-2028-24813
CVE-2024-56337
CVE-2024-54677
CVE-2024-50379
CVE-2024-52318
CVE-2024-52317
CVE-2024-52316
CVE-2024-34750
CVE-2024-38286
CVE-2024-23672
CVE-2024-24549
CVE-2023-46589
CVE-2023-45648
CVE-2023-44487
CVE-2023-42795
CVE-2023-42794
CVE-2023-41080
CVE-2023-34981
CVE-2023-28709
CVE-2023-28708
CVE-2023-24998
CVE-2023-28708
CVE-2023-24998
Attachments
Feedback
