Skip to content
OpenAdvisories
High ALAS2023-2023-140 1 CVE

Important: tomcat9 security update (Amazon Linux 2023)

Published Mar 20, 2023 · Updated Mar 22, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-42252: If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2023 tomcat9 1:9.0.71-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-admin-webapps 1:9.0.71-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-docs-webapp 1:9.0.71-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-el-3.0-api 1:9.0.71-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-jsp-2.3-api 1:9.0.71-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-lib 1:9.0.71-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-servlet-4.0-api 1:9.0.71-1.amzn2023.0.1
Amazon Linux · 2023 tomcat9-webapps 1:9.0.71-1.amzn2023.0.1

Vulnerabilities 1

  • High 7.5
    CVE-2022-42252

    Apache Tomcat request smuggling via malformed content-length

    If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing a…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-42252.html