MEDIUM6.1
GHSA-q3mw-pvr8-9ggc
Apache Tomcat Open Redirect vulnerability
Quick fix
GHSA-q3mw-pvr8-9ggc — org.apache.tomcat:tomcat: upgrade to the fixed version with the command below.
# pom.xml: bump <version>11.0.0-M11</version> for org.apache.tomcat:tomcatDetails
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.apache.tomcat:tomcat
Introduced in:
11.0.0-M1Fixed in: 11.0.0-M11Fix
# pom.xml: bump <version>11.0.0-M11</version> for org.apache.tomcat:tomcatMaven/org.apache.tomcat:tomcat
Introduced in:
10.1.0-M1Fixed in: 10.1.13Fix
# pom.xml: bump <version>10.1.13</version> for org.apache.tomcat:tomcatMaven/org.apache.tomcat:tomcat
Introduced in:
9.0.0-M1Fixed in: 9.0.80Fix
# pom.xml: bump <version>9.0.80</version> for org.apache.tomcat:tomcatMaven/org.apache.tomcat:tomcat
Introduced in:
8.5.0Fixed in: 8.5.93Fix
# pom.xml: bump <version>8.5.93</version> for org.apache.tomcat:tomcatMaven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in:
8.5.0Fixed in: 8.5.93Fix
# pom.xml: bump <version>8.5.93</version> for org.apache.tomcat.embed:tomcat-embed-coreMaven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in:
9.0.0-M1Fixed in: 9.0.80Fix
# pom.xml: bump <version>9.0.80</version> for org.apache.tomcat.embed:tomcat-embed-coreMaven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in:
10.1.0-M1Fixed in: 10.1.13Fix
# pom.xml: bump <version>10.1.13</version> for org.apache.tomcat.embed:tomcat-embed-coreMaven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in:
11.0.0-M1Fixed in: 11.0.0-M11Fix
# pom.xml: bump <version>11.0.0-M11</version> for org.apache.tomcat.embed:tomcat-embed-coreMaven/org.apache.tomcat:tomcat-catalina
Introduced in:
10.1.0-M1Fixed in: 10.1.13Fix
# pom.xml: bump <version>10.1.13</version> for org.apache.tomcat:tomcat-catalinaMaven/org.apache.tomcat:tomcat-catalina
Introduced in:
9.0.0-M1Fixed in: 9.0.80Fix
# pom.xml: bump <version>9.0.80</version> for org.apache.tomcat:tomcat-catalinaMaven/org.apache.tomcat:tomcat-catalina
Introduced in:
8.5.0Fixed in: 8.5.93Fix
# pom.xml: bump <version>8.5.93</version> for org.apache.tomcat:tomcat-catalinaReferences
- https://nvd.nist.gov/vuln/detail/CVE-2023-41080[ADVISORY]
- https://github.com/apache/tomcat/commit/4998ad745b67edeadefe541c94ed029b53933d3b[WEB]
- https://github.com/apache/tomcat/commit/77c0ce2d169efa248b64b992e547aad549ec906b[WEB]
- https://github.com/apache/tomcat/commit/bb4624a9f3e69d495182ebfa68d7983076407a27[WEB]
- https://github.com/apache/tomcat/commit/e3703c9abb8fe0d5602f6ba8a8f11d4b6940815a[WEB]
- https://github.com/apache/tomcat[PACKAGE]
- https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f[WEB]
- https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html[WEB]
- https://security.netapp.com/advisory/ntap-20230921-0006[WEB]
- https://www.debian.org/security/2023/dsa-5521[WEB]
- https://www.debian.org/security/2023/dsa-5522[WEB]