GHSA-4x29-79gh-6v8q Apache Tomcat util accepted misconfigured CRLs

• Maven org.apache.tomcat:tomcat-util: >= 11.0.0-M1, < 11.0.23 → fixed in 11.0.23 • Maven org.apache.tomcat:tomcat-util: >= 10.1.0-M7, < 10.1.56 → fixed in 10.1.56 • Maven org.apache.tomcat:tomcat-util: >= 9.0.83, < 9.0.119 → fixed in 9.0.119

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.