SUSE SLES15: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (SUSE-SU-2026:3430-1)

critical Nessus Plugin ID 331434

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3430-1 advisory.

Update to Tomcat 11.0.24.

Security issues fixed:

- CVE-2026-59083: incorrect URL decoding in `RewriteValve` may allow security control bypass (bsc#1271397).
- CVE-2026-59084: `EncryptInterceptor` requirements are not clearly documented (bsc#1271398).

Other updates and bugfixes:

- Tomcat 11.0.24:
* Catalina
- Fix: Avoid a race condition with concurrent lookups for a singleton JNDI resource. (markt)
- Fix: Improve the performance of range validation for the default servlet. (markt)
- Fix: Avoid NPE in RewriteValve. (markt)
- Fix: 70127: Fix use of Bootstrap through reflection by restoring the public constructor. Use through scripts was not affected. (remm)
- Fix: Restore ability to extend many element classes from AbstractAccessLogValve. (remm)
- Fix: Align DIGEST authentication with RFC 7616 and require clients to provide a valid qop parameter. (markt)
- Fix: Use Files API to create temporary docBase when antiLockingDocBase is enabled. (markt)
- Fix: Improve validation of configuration when DataSourceRealm starts.
(remm)
- Fix: JAASRealm should do a logout if login does not fail outright but does not produce a Principal. (remm)
- Fix: Various edge cases for SSI substitutions, quoting and escaping.
- Fix: unintentional conversion of literal + to a space during rule processing in the RewriteValve. (markt)
* Coyote
- Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native is not available when the connector is explicitly configured to use Tomcat Native with OpenSSL for TLS. (markt)
* Jasper
- Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix for 69333) was incomplete and tags that threw exceptions in doStartTag() and doEndTag() were incorrectly re-used. This fix prevents tags from being re-used if such an exception occurs. (markt)
- Add: support for specifying Java 28 (with the value 28) as the compiler source and/or compiler target for JSP compilation. If used with an Eclipse JDT compiler version that does not support these values, a warning will be logged and the default will be used. (markt)
* WebSocket
- Fix: 70126: Fix WebSocket extension permessage-deflate so that it does not drop bytes if a compressed message inflates to more than the available buffer. Fix written by GPT-5.5. Test case written by Hironori Ichimiya. (markt)
- Fix: Optimise WebSocket client processing of server responses during WebSocket HTTP upgrade process. (markt)
* Other
- Update: to the Eclipse JDT compiler 4.40. (markt)
- Update: Byte Buddy to 1.18.9. (markt)
- Update: UnboundID to 7.0.5. (markt)
- Update: JaCoCo to 0.8.15. (markt)
- Update: BND to 7.3.0. (markt)
- Add: Improvements to French translations. (remm)
- Add: Improvements to Japanese translations provided by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 331434

File Name: suse_SU-2026-3430-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 7/31/2026

Updated: 7/31/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.63

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-59084

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:tomcat11-admin-webapps, p-cpe:/a:novell:suse_linux:tomcat11-el-6_0-api, p-cpe:/a:novell:suse_linux:tomcat11-jsp-4_0-api, p-cpe:/a:novell:suse_linux:tomcat11-lib, p-cpe:/a:novell:suse_linux:tomcat11-servlet-6_1-api, p-cpe:/a:novell:suse_linux:tomcat11-webapps, p-cpe:/a:novell:suse_linux:tomcat11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 7/30/2026

Vulnerability Publication Date: 7/7/2026

Reference Information

CVE: CVE-2026-59083, CVE-2026-59084

IAVA: 2026-A-0709

SuSE: SUSE-SU-2026:3430-1

Detections

Analytics