[<prev] [next>] [day] [month] [year] [list]
Message-ID: <1420fa80-17ba-e9fa-c6f9-5c917f2b6af3@apache.org>
Date: Tue, 3 Jan 2023 17:50:57 +0000
From: Mark Thomas <markt@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection
CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 10.1.0-M1 to 10.1.1
Apache Tomcat 9.0.40 to 9.0.68
Apache Tomcat 8.5.83
Description:
The JsonErrorReportValve did not escape the type, message or description
values. In some circumstances these are constructed from user provided
data and it was therefore possible for users to supply values that
invalidated or manipulated the JSON output.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 10.1.2 or later
- Upgrade to Apache Tomcat 9.0.69 or later
- Upgrade to Apache Tomcat 8.5.84 or later
Credit:
This issue was identified by the Apache Tomcat security team.
History:
2023-01-03 Original advisory
References:
[1] https://tomcat.apache.org/security-10.html
[2] https://tomcat.apache.org/security-9.html
[3] https://tomcat.apache.org/security-8.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
