{"id":"CVE-2022-45143","aliases":["ALSA-2024:3666","BIT-tomcat-2022-45143","CLSA-2025-1748282295","CLSA-2025-1764720465","CLSA-2026-1773188120","CLSA-2026-1792687381","DEBIAN-CVE-2022-45143","DSA-5381-1","EUVD-2023-0546","GHSA-rq2w-37h9-vg94","MGASA-2023-0138","RHSA-2023:1663","RHSA-2024:3307","RHSA-2024:3666","RHSA-2024:3814","ROOT-APP-MAVEN-CVE-2022-45143","SUSE-SU-2023:1853-1","UBUNTU-CVE-2022-45143","openSUSE-SU-2024:12847-1","openSUSE-SU-2024:13441-1"],"status":"published","title":"Apache Tomcat: JsonErrorReportValve escaping","description":"The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02669,"percentile":0.85944,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116","CWE-74"],"published":"2023-01-03T18:12:28Z","modified":"2026-11-03T06:03:12Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["8.5.84","9.0.69","10.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["10.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-util","fixed_in":["8.5.84","9.0.69"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"tomcat","fixed_in":["9.0.69","8.5.84","10.1.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.70-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.70-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.70-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["9.0.63-root.io.1","9.0.63-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["9.0.63-aikido.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"tomcat","fixed_in":["9.0.43-150200.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"tomcat","fixed_in":["9.0.43-150200.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"tomcat","fixed_in":["9.0.43-150200.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"tomcat","fixed_in":["9.0.43-150200.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"tomcat","fixed_in":["9.0.43-150200.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"tomcat","fixed_in":["9.0.43-150200.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"tomcat","fixed_in":["9.0.43-150200.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"tomcat","fixed_in":["9.0.43-150200.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"tomcat","fixed_in":["9.0.43-150200.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"tomcat","fixed_in":["9.0.43-150200.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"tomcat","fixed_in":["9.0.43-150200.38.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"tomcat","fixed_in":["9.0.43-150200.38.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tomcat","fixed_in":["9.0.43-16.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.83"},{"last_affected":"8.5.83"},{"fixed":"8.5.84"}]}],"versions":["8.5.83"]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.40"},{"last_affected":"9.0.68"},{"fixed":"9.0.69"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"last_affected":"10.1.1"},{"fixed":"10.1.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"last_affected":"10.1.1"},{"fixed":"10.1.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.83"},{"last_affected":"8.5.83"},{"fixed":"8.5.84"}]}],"versions":["8.5.83"]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.40"},{"fixed":"9.0.69"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.40"},{"fixed":"9.0.69"},{"introduced":"8.5.83"},{"fixed":"8.5.84"},{"introduced":"10.1.1"},{"fixed":"10.1.2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.5"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.5"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.5"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.5"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.5"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-2~deb11u6"}]}],"versions":["9.0.43-1","9.0.43-2~deb11u1","9.0.43-2~deb11u2","9.0.43-2~deb11u3","9.0.43-2~deb11u4","9.0.43-2~deb11u5"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.83"},{"fixed":"8.5.84"}]}],"versions":["8.5.83"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.40"},{"fixed":"9.0.69"}]}],"versions":["9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.2"}]}],"versions":["10.1.0","10.1.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.2"}]}],"versions":["10.1.0","10.1.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.83"},{"fixed":"8.5.84"}]}],"versions":["8.5.83"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.40"},{"fixed":"9.0.69"}]}],"versions":["9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68"]},{"source":"osv","ecosystem":"Mageia:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.73-1.1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el7jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el7jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el7jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el7jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el7jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el7jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el7jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el7jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el7jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el7jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el7jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el7jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el8jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el8jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el8jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el8jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el8jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el8jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el8jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el8jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el8jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el8jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el9jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el9jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el9jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el9jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el9jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el9jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el9jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el9jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el9jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-13.redhat_00011.1.el9jws"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.63-root.io.1"},{"fixed":"9.0.63-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.63-aikido.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.38.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.38.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1","9.0.58-1ubuntu0.1+esm2","9.0.58-1ubuntu0.1+esm3","9.0.58-1ubuntu0.1+esm4","9.0.58-1ubuntu0.2","9.0.58-1ubuntu0.2+esm1","9.0.58-1ubuntu0.2+esm2","9.0.58-1ubuntu0.2+esm3","9.0.58-1ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14-1.1"}]}],"bundled":49}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"}],"references":[{"url":"https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web","article","report"]},{"url":"https://security.gentoo.org/glsa/202305-37","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230216-0009/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45143","tags":["web","advisory"]},{"url":"https://github.com/apache/tomcat/commit/0cab3a56bd89f70e7481bb0d68395dc7e130dbbf","tags":["web","report"]},{"url":"https://github.com/apache/tomcat/commit/6a0ac6a438cbbb66b6e9c5223842f53bf0cb50aa","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/b336f4e58893ea35114f1e4a415657f723b1298e","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-rq2w-37h9-vg94"},{"url":"https://access.redhat.com/errata/RHSA-2024:3666","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23672","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24549","tags":["report"]},{"url":"https://bugzilla.redhat.com/2269607","tags":["report"]},{"url":"https://bugzilla.redhat.com/2269608","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-3666.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2022-45143.html","tags":["report"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45143.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-45143","tags":["advisory"]},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0138.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30113","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-March/010339.html","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-April/010734.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.65","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.62","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-3160","tags":["web"]},{"url":"https://www.debian.org/security/2022/dsa-5265","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.68","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.69","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.71","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-March/014018.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.72","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1663","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2141329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158695","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1663.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42252","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45143","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3307","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269607","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269608","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3307.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23672","tags":["advisory"]},{"url":"https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24549","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24549","tags":["advisory"]},{"url":"https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3666.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3814","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3814.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172298","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24998","tags":["advisory"]},{"url":"https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28708","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180856","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28708","tags":["advisory"]},{"url":"https://bz.apache.org/bugzilla/show_bug.cgi?id=66471","tags":["article"]},{"url":"https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235370","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41080","tags":["advisory"]},{"url":"https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-42795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243752","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-42795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42795","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/9","tags":["article"]},{"url":"https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243749","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45648","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/10","tags":["article"]},{"url":"https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231853-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206840","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45143","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-45143","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/01/03/1","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-45143","title":"Apache Tomcat: JsonErrorReportValve escaping","description":"The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.","status":"published","published":"2023-01-03T18:12:28.351Z","modified":"2024-08-03T14:09:56.475Z","cwes":["CWE-116"],"updated_at":"2026-11-02T14:34:31.519788Z"}],"euvd":[{"id":"EUVD-2023-0546","description":"The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.","status":"published","published":"2023-01-03T18:12:28Z","modified":"2024-08-03T14:09:56Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"none"}],"updated_at":"2026-11-03T03:25:19.130756Z"}],"ghsa":[{"id":"GHSA-rq2w-37h9-vg94","title":"Apache Tomcat improperly escapes input from JsonErrorReportValve","description":"The `JsonErrorReportValve` in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 does not escape the `type`, `message` or `description` values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.","status":"published","published":"2023-01-03T21:30:21Z","modified":"2024-04-23T21:44:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-74","CWE-116"],"updated_at":"2026-11-02T14:37:44.867253Z"}],"nvd":[{"id":"CVE-2022-45143","description":"The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.","status":"published","published":"2023-01-03T19:15:10.403Z","modified":"2026-06-17T05:09:27.23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:07:34.758863Z"}],"osv":[{"id":"GHSA-rq2w-37h9-vg94","title":"Apache Tomcat improperly escapes input from JsonErrorReportValve","description":"The `JsonErrorReportValve` in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 does not escape the `type`, `message` or `description` values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.","status":"published","published":"2023-01-03T21:30:21Z","modified":"2024-04-23T22:00:59.346897Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-116","CWE-74"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"RHSA-2023:1663","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.2 release and security update","status":"published","published":"2024-09-16T10:48:20Z","modified":"2026-10-02T10:02:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2024:3307","title":"Red Hat Security Advisory: tomcat security and bug fix update","status":"published","published":"2024-09-16T18:43:20Z","modified":"2026-10-02T10:04:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3666","title":"Red Hat Security Advisory: tomcat security and bug fix update","status":"published","published":"2024-09-16T18:43:28Z","modified":"2026-10-02T10:04:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3814","title":"Red Hat Security Advisory: tomcat security and bug fix update","status":"published","published":"2024-09-16T18:43:36Z","modified":"2026-10-13T10:07:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2022-45143","description":"The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.","status":"published","published":"2023-01-03T19:15:00Z","modified":"2026-06-10T09:45:11.158270987Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"ALSA-2024:3666","title":"Important: tomcat security and bug fix update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)\n* Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)\n\nBug Fix(es):\n\n* Rebase tomcat to version 9.0.87 (JIRA:AlmaLinux-35813)\n* Amend tomcat package's changelog so that fixed CVEs are mentioned explicitly (JIRA:AlmaLinux-38548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-06-06T00:00:00Z","modified":"2026-10-29T11:12:03.77247802Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"BIT-tomcat-2022-45143","title":"Apache Tomcat: JsonErrorReportValve escaping","description":"The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.","status":"published","published":"2024-03-06T11:09:02.789Z","modified":"2026-09-08T08:48:20.943336452Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2025-1748282295","title":"Fix of 34 CVEs","description":"   * SECURITY UPDATE: Misc vulnerability fixes\n     - CVE-2019-12418, CVE-2019-17563, CVE-2020-1935,\n       CVE-2020-11996, CVE-2020-13934, CVE-2020-13935,\n       CVE-2020-13943, CVE-2020-17527, CVE-2021-24122,\n       CVE-2021-30639, CVE-2021-30640, CVE-2021-33037,\n       CVE-2021-42340, CVE-2021-43980, CVE-2022-25762,\n       CVE-2022-34305, CVE-2022-45143, CVE-2023-24998,\n       CVE-2023-28709, CVE-2023-34981, CVE-2023-42794,\n       CVE-2024-21733\n   * Update to 8.5.100\n     - debian/rules,\n       debian/libtomcat8-java.poms,\n       debian/maven.rules,\n       debian/tomcat8-common.links,\n       debian/patches/0018-fix-manager-webapp.patch,\n       debian/patches/0019-add-distribution-to-error-page.patch,\n       debian/patches/0021-dont-test-unsupported-ciphers.patch,\n       debian/patches/0101-skipping-tests-incompatible-with-firewall.patch:\n       updated\n     - debian/patches/0002-do-not-load-AJP13-connector-by-default.patch,\n       debian/patches/0026-easymock4-compatibility.patch:\n       removed as they were applied in upstream\n     - CVE-2019-0221.patch, CVE-2019-10072-1.patch,\n       CVE-2019-10072-2.patch, CVE-2022-42252.patch,\n       CVE-2020-1938.patch, CVE-2021-25122.patch,\n       CVE-2021-41079.patch, CVE-2022-29885.patch,\n       CVE-2020-9484.patch, CVE-2021-25329-pre1.patch,\n       CVE-2021-25329.patch, CVE-2022-23181.patch,\n       CVE-2023-44487.patch, CVE-2023-46589-pre1.patch,\n       CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch,\n       CVE-2023-46589-pre4.patch, CVE-2023-46589.patch:\n       removed because these CVEs were fixed in upstream\n   * Internal tests\n     - debian/test_certs/*: updated from upstream branch 9.0.x, as the\n       8.0.x certs were expired","status":"published","published":"2025-05-27T13:45:18Z","modified":"2026-06-04T10:03:30.412984079Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1764720465","title":"TuxCare security update for 5 packages (18 CVEs)","description":"TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.50-tuxcare.2.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:14.144527872Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1773188120","title":"TuxCare security update for 5 packages (23 CVEs)","description":"TuxCare rebuilt 5 packages to address 23 CVEs. Fixed in 9.0.46-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-11-02T19:45:15.814263441Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1792687381","title":"TuxCare security update for 5 packages (4 CVEs)","description":"TuxCare rebuilt 5 packages to address 4 CVEs. Fixed in 7.0.109-tuxcare.5.","status":"published","published":"2026-10-22T16:43:01Z","modified":"2026-11-02T19:46:30.557121765Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CVE-2022-45143","title":"Apache Tomcat: JsonErrorReportValve escaping","description":"The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.","status":"published","published":"2023-01-03T18:12:28.351Z","modified":"2026-10-29T11:12:04.44824388Z","cwes":["CWE-116"],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-45143","description":"The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.","status":"published","published":"2023-01-03T19:15:10.403Z","modified":"2026-11-03T06:03:12.392063996Z","updated_at":"2026-11-03T06:42:33.899035Z"},{"id":"DSA-5381-1","title":"tomcat9 - security update","status":"published","published":"2023-04-05T00:00:00Z","modified":"2026-03-09T02:08:31.649224Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2023-0138","title":"Updated tomcat packages fix security vulnerability","description":"Information disclosure due to concurrency bug (CVE-2021-43980)\nFix for CVE-2020-9484 introduced a time of check, time of use\nvulnerability (CVE-2022-23181)\nCorrect documentation to warn of use over untrusted networks.\n(CVE-2022-29885)\nCorrect documentation showing use of XSS vulnerability. (CVE-2022-34305)\nFix to reject invalid Content-Length header (CVE-2022-42252)\nFix escaping of the type, message or description values. (CVE-2022-45143)\nFix FileUpload limiting of the number of request parts to be processed\nto prevent the possibility of an attacker triggering a DoS (CVE-2023-24998)\nFix setting of session cookie secure attribute when using RemoteIpFilter\nwith X-Forwarded-Proto header set to https (CVE-2023-28708)\nObsolete tomcat-jsvc\n","status":"published","published":"2023-04-15T19:03:44Z","modified":"2026-04-16T04:42:36.513882529Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12847-1","title":"tomcat-9.0.43-16.1 on GA media","description":"These are all security issues fixed in the tomcat-9.0.43-16.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:05:50.485966Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13441-1","title":"tomcat10-10.1.14-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:52.718146Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"ROOT-APP-MAVEN-CVE-2022-45143","title":"CVE-2022-45143 in io.root.org.apache.tomcat.embed:tomcat-embed-core - Patched by Root","description":"Root has patched CVE-2022-45143 in the io.root.org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-07-09T10:48:48Z","modified":"2026-07-09T14:00:24.402613019Z","updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"SUSE-SU-2023:1853-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2022-45143: Fixed JsonErrorReportValve injection (bsc#1206840).\n","status":"published","published":"2023-04-14T13:11:05Z","modified":"2026-02-04T02:52:54.93715Z","updated_at":"2026-11-02T15:53:52.350754Z"}]}}