You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@tomee.apache.org by "Richard Zowalla (Jira)" <ji...@apache.org> on 2023/01/17 07:27:00 UTC

[jira] [Resolved] (TOMEE-4176) CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection on TomEE's tomcat-websocket.jar

     [ https://issues.apache.org/jira/browse/TOMEE-4176?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Richard Zowalla resolved TOMEE-4176.
------------------------------------
    Fix Version/s: 8.0.14
         Assignee: Richard Zowalla
       Resolution: Fixed

> CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection on TomEE's tomcat-websocket.jar
> ---------------------------------------------------------------------------------------------
>
>                 Key: TOMEE-4176
>                 URL: https://issues.apache.org/jira/browse/TOMEE-4176
>             Project: TomEE
>          Issue Type: Bug
>    Affects Versions: 8.0.13
>            Reporter: Yugandher reddy vonteddu
>            Assignee: Richard Zowalla
>            Priority: Major
>              Labels: CVE
>             Fix For: 8.0.14
>
>
>  
> More details on : [https://nvd.nist.gov/vuln/detail/CVE-2022-45143]
> h2. CVE-2022-45143 Detail
> h3. Description
> The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)