CVE-2022-45143
Apache Tomcat: JsonErrorReportValve escaping
Summary
Apache Tomcat: JsonErrorReportValve escaping
Original description
The description as published by the source.
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
tomcat
[{"type":"SEMVER","events":[{"introduced":"9.0.40"},{"fixed":"9.0.69"},{"introduced":"8.5.83"},{"fixed":"8.5.84"},{"introduced":"10.1.1"},{"fixed":"10.1.2"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-45143 tomcat9 Fixed in: 9.0.43-2~deb11u6
- Ubuntu UBUNTU-CVE-2022-45143 tomcat6
References
- advisory lists.apache.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com