Maven/org.apache.tomcat.embed:tomcat-embed-core CVE-2022-45143: high 7.5, EPSS 2.57%
Apache Tomcat improperly escapes input from JsonErrorReportValve
Action: Upgrade org.apache.tomcat.embed:tomcat-embed-core to 8.5.84 (8.x), 9.0.69 (9.x) or 10.1.2 (10.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.5.83 | 8.5.84 | - |
| 9.0.40 | 9.0.69 | - |
| 10.1.0 | 10.1.2 | - |
Fixed versions
| 8.5.84 | 9.0.69 | 10.1.2 |
Sources
- osv: GHSA-rq2w-37h9-vg94
- https://nvd.nist.gov/vuln/detail/CVE-2022-45143
- https://github.com/apache/tomcat/commit/0cab3a56bd89f70e7481bb0d68395dc7e130dbbf
- https://github.com/apache/tomcat/commit/6a0ac6a438cbbb66b6e9c5223842f53bf0cb50aa
- https://github.com/apache/tomcat/commit/b336f4e58893ea35114f1e4a415657f723b1298e
- https://github.com/apache/tomcat
- https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
- https://security.gentoo.org/glsa/202305-37
CVE-2022-45143 · published · modified · JSON