VDB
Sign up
MEDIUM6.1

GHSA-9m3c-qcxr-9x87

Apache Tomcat has an Open Redirect vulnerability

Quick fix

GHSA-9m3c-qcxr-9x87 — org.apache.tomcat:tomcat-catalina: upgrade to the fixed version with the command below.

# pom.xml: bump <version>9.0.116</version> for org.apache.tomcat:tomcat-catalina

Details

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.apache.tomcat:tomcat-catalina
Introduced in: 8.5.30Fixed in: 9.0.116
Fix# pom.xml: bump <version>9.0.116</version> for org.apache.tomcat:tomcat-catalina
Maven/org.apache.tomcat:tomcat-catalina
Introduced in: 10.1.0-M1Fixed in: 10.1.53
Fix# pom.xml: bump <version>10.1.53</version> for org.apache.tomcat:tomcat-catalina
Maven/org.apache.tomcat:tomcat-catalina
Introduced in: 11.0.0-M1Fixed in: 11.0.20
Fix# pom.xml: bump <version>11.0.20</version> for org.apache.tomcat:tomcat-catalina
Maven/org.apache.tomcat:tomcat
Introduced in: 8.5.30Fixed in: 9.0.116
Fix# pom.xml: bump <version>9.0.116</version> for org.apache.tomcat:tomcat
Maven/org.apache.tomcat:tomcat
Introduced in: 10.1.0-M1Fixed in: 10.1.53
Fix# pom.xml: bump <version>10.1.53</version> for org.apache.tomcat:tomcat
Maven/org.apache.tomcat:tomcat
Introduced in: 11.0.0-M1Fixed in: 11.0.20
Fix# pom.xml: bump <version>11.0.20</version> for org.apache.tomcat:tomcat
Maven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in: 8.5.30Fixed in: 9.0.116
Fix# pom.xml: bump <version>9.0.116</version> for org.apache.tomcat.embed:tomcat-embed-core
Maven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in: 10.1.0-M1Fixed in: 10.1.53
Fix# pom.xml: bump <version>10.1.53</version> for org.apache.tomcat.embed:tomcat-embed-core
Maven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in: 11.0.0-M1Fixed in: 11.0.20
Fix# pom.xml: bump <version>11.0.20</version> for org.apache.tomcat.embed:tomcat-embed-core

References