[GHSA-f525-44xv-f2qj] Improper Input Validation vulnerability in Apache Tomcat ...

[oscerd]

Updates

• Affected products
• Source code location

Comments
Affected packages (Maven), version ranges and source code location are taken from the official Apache Tomcat security advisory: https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj

Patched versions (11.0.25, 10.1.58, 9.0.121) were added after review. They are named in the CVE record and on the Apache Tomcat security pages (https://tomcat.apache.org/security-11.html, https://tomcat.apache.org/security-10.html, https://tomcat.apache.org/security-9.html). 10.1.58 is not on Maven Central (its release vote did not pass); 10.1.59 is the first published unaffected 10.1.x version.

Claude Code on behalf of oscerd

[hara-satoshi-ymr]

Thanks for this PR. Based on the fix commits and the binary artifacts published to Maven Central, I'd suggest the following changes.

Add patched versions 11.0.25 / 10.1.58 / 9.0.121. The entries in this PR only have an upper bound (<= 11.0.24 / <= 10.1.57 / <= 9.0.120). The affected packages are unchanged.

Suggested affected products:

Ecosystem	Package name	Affected versions	Patched versions
Maven	org.apache.tomcat:tomcat	>= 11.0.20, <= 11.0.24	11.0.25
Maven	org.apache.tomcat:tomcat	>= 10.1.53, <= 10.1.57	10.1.58
Maven	org.apache.tomcat:tomcat	>= 9.0.115, <= 9.0.120	9.0.121
Maven	org.apache.tomcat:tomcat-coyote	>= 11.0.20, <= 11.0.24	11.0.25
Maven	org.apache.tomcat:tomcat-coyote	>= 10.1.53, <= 10.1.57	10.1.58
Maven	org.apache.tomcat:tomcat-coyote	>= 9.0.115, <= 9.0.120	9.0.121
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 11.0.20, <= 11.0.24	11.0.25
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 10.1.53, <= 10.1.57	10.1.58
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 9.0.115, <= 9.0.120	9.0.121

Evidence:

• Apache Tomcat security pages: https://tomcat.apache.org/security-11.html , https://tomcat.apache.org/security-10.html , https://tomcat.apache.org/security-9.html
• Fix commits:
  • 11.0.x: apache/tomcat@8639b20 (first included in 11.0.25)
  • 10.1.x: apache/tomcat@4001241 (first included in 10.1.58)
  • 9.0.x: apache/tomcat@b823e88 (first included in 9.0.121)

[oscerd]

Thanks @hara-satoshi-ymr, agreed. Pushed 6928c25: all nine entries now carry a fixed event (11.0.25 / 10.1.58 / 9.0.121) in place of the last_known_affected_version_range upper bounds. The packages and introduced versions are unchanged.

One note on 10.1.58: it isn't on Maven Central, because the 10.1.58 release vote didn't pass, so 10.1.59 is the first published 10.1.x release with the fix (see the note under "Fixed in Apache Tomcat 10.1.59" on https://tomcat.apache.org/security-10.html). I kept fixed: 10.1.58 because the CVE record names it, the fix commit is first included in the 10.1.58 tag, and it matches the reviewed advisories from the same release batch (GHSA-gcx9-497g-6cp6, GHSA-9xv2-5v5q-p794, GHSA-h3x4-894j-xpx5). Happy to switch it to 10.1.59 if you prefer.

Claude Code on behalf of oscerd