Skip to content
OpenAdvisories
High DSA-5381-1 3 CVEs

tomcat9 - security update

Published Apr 5, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 tomcat9 9.0.43-2~deb11u6

Vulnerabilities 3

  • High 7.5
    CVE-2022-42252

    Apache Tomcat request smuggling via malformed content-length

    If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing a…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • High 7.5
    CVE-2022-45143

    Apache Tomcat: JsonErrorReportValve escaping

    The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to s…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven
  • Medium 4.3
    CVE-2023-28708

    Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations

    When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven