GHSA-73rx-3f9r-x949

Suggest an improvement
Source
https://github.com/advisories/GHSA-73rx-3f9r-x949
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-73rx-3f9r-x949/GHSA-73rx-3f9r-x949.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-73rx-3f9r-x949
Aliases
Published
2022-05-14T01:10:15Z
Modified
2024-03-11T05:31:12.135729Z
Severity
  • CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Summary
Insufficient Verification of Data Authenticity in Apache Tomcat
Details

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

References

Affected packages

Maven / org.apache.tomcat:tomcat

Package

Name
org.apache.tomcat:tomcat
Purl
pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9.0.0.M1
Fixed
9.0.0.M22

Affected versions

9.*

9.0.0.M1
9.0.0.M3
9.0.0.M4
9.0.0.M6
9.0.0.M8
9.0.0.M9
9.0.0.M10
9.0.0.M11
9.0.0.M13
9.0.0.M15
9.0.0.M17
9.0.0.M18
9.0.0.M19
9.0.0.M20
9.0.0.M21

Database specific

{
    "last_known_affected_version_range": "<= 9.0.0.M21"
}

Maven / org.apache.tomcat:tomcat

Package

Name
org.apache.tomcat:tomcat
Purl
pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
8.5.0
Fixed
8.5.16

Affected versions

8.*

8.5.0
8.5.2
8.5.3
8.5.4
8.5.5
8.5.6
8.5.8
8.5.9
8.5.11
8.5.12
8.5.13
8.5.14
8.5.15

Database specific

{
    "last_known_affected_version_range": "<= 8.5.15"
}

Maven / org.apache.tomcat:tomcat

Package

Name
org.apache.tomcat:tomcat
Purl
pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
8.0.0.RC1
Fixed
8.0.45

Affected versions

8.*

8.0.1
8.0.3
8.0.5
8.0.8
8.0.9
8.0.11
8.0.12
8.0.14
8.0.15
8.0.17
8.0.18
8.0.20
8.0.21
8.0.22
8.0.23
8.0.24
8.0.26
8.0.27
8.0.28
8.0.29
8.0.30
8.0.32
8.0.33
8.0.35
8.0.36
8.0.37
8.0.38
8.0.39
8.0.41
8.0.42
8.0.43
8.0.44

Database specific

{
    "last_known_affected_version_range": "<= 8.0.44"
}

Maven / org.apache.tomcat:tomcat

Package

Name
org.apache.tomcat:tomcat
Purl
pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.0.41
Fixed
7.0.79

Affected versions

7.*

7.0.41
7.0.42
7.0.47
7.0.50
7.0.52
7.0.53
7.0.54
7.0.55
7.0.56
7.0.57
7.0.59
7.0.61
7.0.62
7.0.63
7.0.64
7.0.65
7.0.67
7.0.68
7.0.69
7.0.70
7.0.72
7.0.73
7.0.75
7.0.76
7.0.77
7.0.78

Database specific

{
    "last_known_affected_version_range": "<= 7.0.78"
}