CVE-2022-45143
Fixed in a distro release EPSS 3%
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.84 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.69 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.1.2 |
| Maven | org.apache.tomcat:tomcat-catalina | 10.1.2 |
| Maven | org.apache.tomcat:tomcat-util | 8.5.84 |
| Maven | org.apache.tomcat:tomcat-util | 9.0.69 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | tomcat9 | 9.0.43-2~deb11u6 |
| Debian 12 | tomcat9 | 9.0.70-1 |
| Debian 13 | tomcat9 | 9.0.70-1 |
| Debian 14 | tomcat9 | 9.0.70-1 |
| Red Hat Enterprise Linux 8 | tomcat | 1:9.0.87-1.el8_10.1 |
| Red Hat Enterprise Linux 8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.1 |
| Red Hat Enterprise Linux 8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.1 |
| Red Hat Enterprise Linux 8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.1 |
| Red Hat Enterprise Linux 8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.1 |
| Red Hat Enterprise Linux 8 | tomcat-lib | 1:9.0.87-1.el8_10.1 |
| Red Hat Enterprise Linux 8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.1 |
| Red Hat Enterprise Linux 8 | tomcat-webapps | 1:9.0.87-1.el8_10.1 |
| Red Hat Enterprise Linux 9 | tomcat | 1:9.0.87-1.el9_4.1 |
| Red Hat Enterprise Linux 9 | tomcat-admin-webapps | 1:9.0.87-1.el9_4.1 |
| Red Hat Enterprise Linux 9 | tomcat-docs-webapp | 1:9.0.87-1.el9_4.1 |
| Red Hat Enterprise Linux 9 | tomcat-el-3.0-api | 1:9.0.87-1.el9_4.1 |
| Red Hat Enterprise Linux 9 | tomcat-jsp-2.3-api | 1:9.0.87-1.el9_4.1 |
| Red Hat Enterprise Linux 9 | tomcat-lib | 1:9.0.87-1.el9_4.1 |
| Red Hat Enterprise Linux 9 | tomcat-servlet-4.0-api | 1:9.0.87-1.el9_4.1 |
| Red Hat Enterprise Linux 9 | tomcat-webapps | 1:9.0.87-1.el9_4.1 |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat | 0:9.0.62-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat | 0:9.0.62-13.redhat_00011.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat | 0:9.0.62-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-admin-webapps | 0:9.0.62-13.redhat_00011.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-admin-webapps | 0:9.0.62-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-admin-webapps | 0:9.0.62-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-docs-webapp | 0:9.0.62-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-docs-webapp | 0:9.0.62-13.redhat_00011.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-docs-webapp | 0:9.0.62-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-el-3.0-api | 0:9.0.62-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-el-3.0-api | 0:9.0.62-13.redhat_00011.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-el-3.0-api | 0:9.0.62-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-java-jdk11 | 0:9.0.62-13.redhat_00011.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-java-jdk8 | 0:9.0.62-13.redhat_00011.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-javadoc | 0:9.0.62-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-javadoc | 0:9.0.62-13.redhat_00011.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-javadoc | 0:9.0.62-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-jsp-2.3-api | 0:9.0.62-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-jsp-2.3-api | 0:9.0.62-13.redhat_00011.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-jsp-2.3-api | 0:9.0.62-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-lib | 0:9.0.62-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-lib | 0:9.0.62-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-lib | 0:9.0.62-13.redhat_00011.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-selinux | 0:9.0.62-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-selinux | 0:9.0.62-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-selinux | 0:9.0.62-13.redhat_00011.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-servlet-4.0-api | 0:9.0.62-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-servlet-4.0-api | 0:9.0.62-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-servlet-4.0-api | 0:9.0.62-13.redhat_00011.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-webapps | 0:9.0.62-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-webapps | 0:9.0.62-13.redhat_00011.1.el7jws |
| Red Hat jboss enterprise web server 5.7 | jws5-tomcat-webapps | 0:9.0.62-13.redhat_00011.1.el8jws |
| Red Hat rhel eus 8.8 | tomcat | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-admin-webapps | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-docs-webapp | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-lib | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_8.2 |
| Red Hat rhel eus 8.8 | tomcat-webapps | 1:9.0.87-1.el8_8.2 |
| SUSE Enterprise Storage 7 | tomcat | 9.0.43-150200.38.1 |
| SUSE Enterprise Storage 7.1 | tomcat | 9.0.43-150200.38.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | tomcat | 9.0.43-150200.38.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | tomcat | 9.0.43-150200.38.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | tomcat | 9.0.43-150200.38.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP4 | tomcat | 9.0.43-150200.38.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | tomcat | 9.0.43-150200.38.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | tomcat | 9.0.43-150200.38.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | tomcat | 9.0.43-150200.38.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | tomcat | 9.0.43-150200.38.1 |
| SUSE Manager Server 4.2 | tomcat | 9.0.43-150200.38.1 |
| Ubuntu Pro 22.04 LTS | tomcat9 | no fix |
| openSUSE Leap 15.4 | tomcat | 9.0.43-150200.38.1 |
| openSUSE Tumbleweed | tomcat | 9.0.43-16.1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 |