=====================================================================

                             CERT-Renater

                  Note d'Information No. 2023/VULN001

_____________________________________________________________________

DATE                : 11/01/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Tomcat versions prior
                                to 10.1.2, 9.0.69, 8.5.84.

=====================================================================
https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
_____________________________________________________________________


CVE-2022-45143 Apache Tomcat - JsonErrorReportValve injection

Severity: Low

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 10.1.0-M1 to 10.1.1
Apache Tomcat 9.0.40 to 9.0.68
Apache Tomcat 8.5.83

Description:
The JsonErrorReportValve did not escape the type, message or description 
values. In some circumstances these are constructed from user provided 
data and it was therefore possible for users to supply values that 
invalidated or manipulated the JSON output.

Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 10.1.2 or later
- Upgrade to Apache Tomcat 9.0.69 or later
- Upgrade to Apache Tomcat 8.5.84 or later

Credit:
This issue was identified by the Apache Tomcat security team.

History:
2023-01-03 Original advisory

References:
[1] https://tomcat.apache.org/security-10.html
[2] https://tomcat.apache.org/security-9.html
[3] https://tomcat.apache.org/security-8.html


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================