GHSA-rq2w-37h9-vg94
Apache Tomcat improperly escapes input from JsonErrorReportValve
At a glance
- Published
- Updated
- CVE
- CVE-2022-45143
- Aliases
- BIT-tomcat-2022-45143
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
The `JsonErrorReportValve` in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 does not escape the `type`, `message` or `description` values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 8.5.83, fixed 8.5.84 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 9.0.40, fixed 9.0.69 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 10.1.0, fixed 10.1.2 |
| Maven · org.apache.tomcat:tomcat-catalina | introduced 10.1.0, fixed 10.1.2 |
| Maven · org.apache.tomcat:tomcat-util | introduced 8.5.83, fixed 8.5.84 |
| Maven · org.apache.tomcat:tomcat-util | introduced 9.0.40, fixed 9.0.69 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-45143 ADVISORY
- https://github.com/apache/tomcat/commit/0cab3a56bd89f70e7481bb0d68395dc7e130dbbf WEB
- https://github.com/apache/tomcat/commit/6a0ac6a438cbbb66b6e9c5223842f53bf0cb50aa WEB
- https://github.com/apache/tomcat/commit/b336f4e58893ea35114f1e4a415657f723b1298e WEB
- https://github.com/apache/tomcat PACKAGE
- https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj WEB
- https://security.gentoo.org/glsa/202305-37 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |