{
  "schema_version": "1.7.0",
  "id": "MGASA-2026-0568",
  "published": "2026-10-30T01:10:00Z",
  "modified": "2026-10-30T00:55:46Z",
  "summary": "Updated tomcat package fixes security vulnerabilities",
  "details": "OpenSSL-FFM FIPS failure does not prevent start-up. (CVE-2026-74048)\nJasper JSTL plug-in implementation omits page abort (SKIP_PAGE).\n(CVE-2026-74049)\nTOCTOU when setting specific permissions for Unix Domain Sockets - Fix\nfor CVE-2026-65183 did not address APR connector. (CVE-2026-80353)\nHTTP/2 trailer header cross-contamination. (CVE-2026-88041)\nPossible TLS 1.3 connection failures. (CVE-2026-93446)\nJNDIRealm bind credential validation fails open for non-GSSAPI SASL\nmechanisms. (CVE-2026-101296)\nHTTP/2 request/response mix-up after error during async processing.\n(CVE-2026-101356)\n",
  "upstream": [
    "CVE-2026-74048",
    "CVE-2026-74049",
    "CVE-2026-80353",
    "CVE-2026-88041",
    "CVE-2026-93446",
    "CVE-2026-101296",
    "CVE-2026-101356"
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2026-0568.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=36554"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/10/20/21"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/10/20/22"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/10/20/23"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/10/20/24"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/10/20/25"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/10/20/26"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/10/20/27"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:10",
        "name": "tomcat",
        "purl": "pkg:rpm/mageia/tomcat?arch=source&distro=mageia-10"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0.123-1.mga10"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}