CVE-2022-45143
Apache Tomcat: JsonErrorReportValve escaping
Résumé
Apache Tomcat: JsonErrorReportValve escaping
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
tomcat
[{"type":"SEMVER","events":[{"introduced":"9.0.40"},{"fixed":"9.0.69"},{"introduced":"8.5.83"},{"fixed":"8.5.84"},{"introduced":"10.1.1"},{"fixed":"10.1.2"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-45143 tomcat9 Corrigé dans: 9.0.43-2~deb11u6
- Ubuntu UBUNTU-CVE-2022-45143 tomcat6
Références
- advisory lists.apache.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com