Skip to content
OpenAdvisories
High · 7.5 CVE-2022-45143 BIT-tomcat-2022-45143EUVD-2023-0546GHSA-rq2w-37h9-vg94

Apache Tomcat: JsonErrorReportValve escaping

Published Jan 3, 2023 · Updated Aug 3, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat-catalina Package: org.apache.tomcat:tomcat-util Package: org.apache.tomcat.embed:tomcat-embed-core Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 10.1.0-M1 – ≤ 10.1.1, 9.0.40 – ≤ 9.0.68, 8.5.83 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat9 9.0.70-1 —
Debian 13 tomcat9 9.0.70-1 —
Debian 12 tomcat9 9.0.70-1 —
Debian 11 tomcat9 9.0.43-2~deb11u6 DSA-5381-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS tomcat9 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 tomcat +7 1:9.0.87-1.el9_4.1 RHSA-2024:3307
RHEL 8 tomcat +7 1:9.0.87-1.el8_10.1 RHSA-2024:3666
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.8 EUS tomcat +7 1:9.0.87-1.el8_8.2 RHSA-2024:3814
Red Hat JBoss Web Server 5 jws5-tomcat +11 9.0.62-13.redhat_00011.1.el7jws RHSA-2023:1663

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 tomcat +7 1:9.0.87-1.el8_10.1.alma.1 ALSA-2024:3666

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 tomcat 9.0.43-150200.38.1 SUSE-SU-2023:1853-1
SLES 15 SP3 tomcat 9.0.43-150200.38.1 SUSE-SU-2023:1853-1
SLES 15 SP2 tomcat 9.0.43-150200.38.1 SUSE-SU-2023:1853-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP3 tomcat 9.0.43-150200.38.1 SUSE-SU-2023:1853-1
SLES for SAP 15 SP2 tomcat 9.0.43-150200.38.1 SUSE-SU-2023:1853-1
SLE HPC 15 SP3 tomcat 9.0.43-150200.38.1 SUSE-SU-2023:1853-1
SLE HPC 15 SP2 tomcat 9.0.43-150200.38.1 SUSE-SU-2023:1853-1
SUSE Manager Server 4.2 tomcat 9.0.43-150200.38.1 SUSE-SU-2023:1853-1
SUSE Enterprise Storage 7.1 tomcat 9.0.43-150200.38.1 SUSE-SU-2023:1853-1
SUSE Enterprise Storage 7 tomcat 9.0.43-150200.38.1 SUSE-SU-2023:1853-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.43-16.1 openSUSE-SU-2024:12847-1
openSUSE Tumbleweed tomcat10 10.1.14-1.1 openSUSE-SU-2024:13441-1
openSUSE Leap 15.4 tomcat 9.0.43-150200.38.1 SUSE-SU-2023:1853-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tomcat9 +7 1:9.0.71-1.amzn2023.0.2 ALAS2023-2023-176

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat-catalina >= 10.1.0, < 10.1.2 10.1.2 GHSA-rq2w-37h9-vg94
Maven org.apache.tomcat:tomcat-util >= 8.5.83, < 8.5.84 8.5.84 GHSA-rq2w-37h9-vg94
Maven org.apache.tomcat:tomcat-util >= 9.0.40, < 9.0.69 9.0.69 GHSA-rq2w-37h9-vg94
Maven org.apache.tomcat.embed:tomcat-embed-core >= 8.5.83, < 8.5.84 8.5.84 GHSA-rq2w-37h9-vg94
Maven org.apache.tomcat.embed:tomcat-embed-core >= 9.0.40, < 9.0.69 9.0.69 GHSA-rq2w-37h9-vg94
Maven org.apache.tomcat.embed:tomcat-embed-core >= 10.1.0, < 10.1.2 10.1.2 GHSA-rq2w-37h9-vg94

Advisories 22

References