Date: Tue, 3 Jan 2023 17:50:57 +0000 From: Mark Thomas <markt@...che.org> To: oss-security@...ts.openwall.com Subject: CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 10.1.0-M1 to 10.1.1 Apache Tomcat 9.0.40 to 9.0.68 Apache Tomcat 8.5.83 Description: The JsonErrorReportValve did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 10.1.2 or later - Upgrade to Apache Tomcat 9.0.69 or later - Upgrade to Apache Tomcat 8.5.84 or later Credit: This issue was identified by the Apache Tomcat security team. History: 2023-01-03 Original advisory References:  https://tomcat.apache.org/security-10.html  https://tomcat.apache.org/security-9.html  https://tomcat.apache.org/security-8.html
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.