{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7100c442-a62c-5594-8011-dc758a9ba714", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-storeconfig", "purl": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1", "version": "8.5.46-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat-storeconfig", "purl": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46", "type": "library", "group": "org.apache.tomcat", "version": "8.5.46" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-0762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:d3dfecab-33e3-5feb-bf09-a481c45adae0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0762 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. CVE-2016-0762 is a username-enumeration timing attack: Tomcat Realm implementations skipped processing the supplied password when the username did not exist, so \"user not found\" returned faster than \"user found, wrong password\". The upstream fix adds a \"waste a bit of time\" credential-processing call on the user-not-found path so timing is equalized. Target is Apache Tomcat 8.5.46 (HEAD 914f68b451, detached tag 8.5.46). All four patched Realm classes already contain the exact fix: getCredentialHandler().mutate(credentials) is called in the user-not-found branch of RealmBase.java:346, DataSourceRealm.java:320, JDBCRealm.java:390, and MemoryRealm.java:132, each under the comment \"Waste a bit of time as not to reveal that the user does not exist.\" git blame attributes these lines to upstream commit d79c63d424fe (Mark Thomas, markt@apache.org, 2016-08-30, subject \"Make timing attacks against the Realm implementations harder. (schultz)\") \u2014 which is literally one of the three vendor patch commits supplied in the task. That commit is an ancestor of HEAD and reached it purely through upstream Apache lineage (no tuxcare-current merge on the path). The vulnerable pre-fix pattern is therefore not present in HEAD. Verdict: not_affected (upstream vendor fix baked into the shipped 8.5.x release; CVE affected range stops at 8.5.4, fix shipped in 8.5.5+).", "justification": "code_not_present" } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:a48871b8-bdf6-5612-8c9d-1cfe4079c976", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. CVE-2016-0763: ResourceLinkFactory.setGlobalContext() in Apache Tomcat lacked an authorization check, letting an untrusted web application replace the shared global naming context and bypass SecurityManager restrictions to read/write arbitrary application data or disrupt the app. The target is Tomcat 8.5.46, which already ships the upstream Apache fix. In java/org/apache/naming/factory/ResourceLinkFactory.java, setGlobalContext() (lines 60-67) now obtains System.getSecurityManager() and, when non-null, calls sm.checkPermission(new RuntimePermission(ResourceLinkFactory.class.getName()+\".setGlobalContext\")) BEFORE assigning globalContext. This is the exact mitigation introduced upstream. git blame attributes lines 61-65 to commit bc8717f41a379e812ffbbae2dd71ae6822fe680f (\"Protect initialization of ResourceLinkFactory when running with a SecurityManager. This is the fix for CVE-2016-0763\") by Konstantin Kolinko , 2016-01-21 \u2014 an upstream Apache committer, present as a linear ancestor of HEAD (no TuxCare merge). The CVE lists 8.x before 8.0.31 as affected; 8.5.46 was branched after the fix, so it contains the fix natively. Verdict: not_affected (upstream/vendor fix already present; justification code_not_present).", "justification": "code_not_present" } }, { "id": "CVE-2016-5018", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:dc81a301-9817-50b9-883b-f66b286fd20a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5018 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. CVE-2016-5018 is not present in Tomcat 8.5.46. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions via the PrivilegedIntrospectHelper class in JspRuntimeLibrary.java, which used AccessController.doPrivileged() to execute introspection logic with elevated privileges. The upstream Apache Tomcat project removed this vulnerable code in commit 648122fef8 (authored by markt@apache.org). Version 8.5.46 includes this upstream fix\u2014the PrivilegedIntrospectHelper class and privileged execution wrapper are completely absent from the codebase.", "justification": "code_not_present" } }, { "id": "CVE-2016-6794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:7ba83589-4d74-5e38-857c-6bab64b2b7c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6794 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 CVE-2016-6794 is not present in Apache Tomcat 8.5.46. The vulnerability allowed web applications to bypass SecurityManager restrictions and read system properties through the configuration file property replacement feature. The upstream Apache Tomcat vendor applied a complete fix in August 2016 (commit f8db078f1e) by introducing a PermissionCheck interface and modifying the Digester to verify P...", "justification": "code_not_present" } }, { "id": "CVE-2016-6796", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:ca688531-ca86-5e22-855a-192882695f35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6796 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target Apache Tomcat 8.5.46 is not affected by CVE-2016-6796. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions by manipulating JSP Servlet configuration parameters (engineOptionsClass and scratchdir). The fix was introduced in upstream Apache Tomcat version 8.5.5 via commit f97769f50e, which added checks to ignore these parameters when SecurityManager is enabled. Since 8.5.46 is significantly newer than 8.5.5 (and CVE lists affected versions as 8.5.0-8.5.4), the target inherits the upstream vendor fix and the vulnerable pattern is not present.", "justification": "code_not_present" } }, { "id": "CVE-2016-6797", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:592c6744-b3c7-5cc8-9988-102cfca13931", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6797 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target Apache Tomcat 8.5.46 is NOT affected by CVE-2016-6797. The ResourceLinkFactory access-control fix is fully present in java/org/apache/naming/factory/ResourceLinkFactory.java at HEAD. getObjectInstance() calls validateGlobalResourceAccess(globalName) (lines 148-150) and returns null before performing globalContext.lookup() (line 152) whenever the requesting web application's classloader was not explicitly registered (via registerGlobalResourceAccess) with a ResourceLink to that global name. This is the exact defense the vendor patch installs (globalResourceRegistrations map + register/deregister/validate methods, lines 50-120). The fix was authored upstream by Apache (Mark Thomas, markt@apache.org) in commit d6b5600afe (the 8.5.x branch fix), which is an ancestor of the 8.5.46 tag \u2014 CVE range is 8.5.0\u20138.5.4, fix landed in 8.5.5, so 8.5.46 post-dates it. Attribution ladder yields no TuxCare/CloudLinux signal (author @apache.org, no tuxcare-current merge in ancestry), so this is an upstream vendor fix \u2192 verdict not_affected, justification code_not_present. (The CloudLinux backport commit 24f6e585fe for CVE-2016-6797 exists but targets 7.0.70 and is not in HEAD's history.)", "justification": "code_not_present" } }, { "id": "CVE-2016-6816", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:59bf7e50-4f06-5171-9730-2b7f9e203ad4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6816 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target version 8.5.46 is NOT vulnerable to CVE-2016-6816. The upstream Apache fix (commit f96f5751d4 by Mark Thomas) was integrated in Apache Tomcat 8.5.7 (November 2016), well before version 8.5.46. The fix adds character validation to HTTP request line parsing (method, request target, protocol) via HttpParser.isToken(), isNotRequestTarget(), and isHttpProtocol() methods, preventing invalid characters from reaching response generation code. All three validation points are present and active in the target's Http11InputBuffer.java.", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:7cd25764-64d7-54cb-83bc-3e80ccd60a42", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. CVE-2016-6817: the HTTP/2 header parser in Tomcat 8.5.0\u20138.5.6 (and 9.0.0.M1\u2013M11) entered an infinite loop when a header larger than its fixed 1024-byte read buffer was received, enabling a DoS. The upstream fix (Apache commit 85c63227, Mark Thomas, 2016-10-20, bug 60232; released in 8.5.7) replaced the fixed buffer with a dynamically-expanding one. The target is at tag 8.5.46 \u2014 far downstream of 8.5.7 \u2014 and HEAD contains the complete, exact post-fix code: the ByteBufferUtils import, the `volatile ByteBuffer headerReadBuffer = ByteBuffer.allocate(Constants.DEFAULT_HEADER_READ_BUFFER_SIZE)` field, the expand-on-exhaustion logic in readHeaderPayload(), and the buffer reset in onHeadersComplete(). git blame attributes all fix lines to the upstream commit 85c63227 (markt@apache.org). The vulnerable fixed-buffer pattern is not present in HEAD. Attribution ladder A1\u2013A4 produce no TuxCare/CloudLinux signal (upstream author, no tuxcare-current merge), so this is the vendor-fix flavor of not_affected, not already_fixed. Verdict: not_affected (code_not_present).", "justification": "code_not_present" } }, { "id": "CVE-2016-8745", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:4083ee3d-90de-5251-9f9d-a026980eea35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8745 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Apache Tomcat 8.5.46 is not affected by CVE-2016-8745. The vulnerability (double-caching of Processor objects in NIO HTTP connector sendfile error handling) was fixed by upstream Apache in November 2016 (commit 16a57bc885). The CVE affected versions 8.5.0-8.5.8; the fix was released in 8.5.9. Version 8.5.46 inherited the fix from upstream and does not contain the vulnerable code pattern. The error handling in processSendfile() correctly omits cancelledKey() calls when calledByProcessor is true, preventing double-caching.", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:69f61bf3-730f-5d59-8f7e-e1d2d9fd9a2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. CVE-2016-8747 is an information-disclosure bug in Apache Tomcat's Http11InputBuffer.nextRequest() where incorrect ByteBuffer position/limit handling between pipelined requests on a reused keep-alive connection could leave stale bytes from a prior request associated with a new request (exploitable behind a reverse proxy). Target is Apache Tomcat 8.5.46 (tag, SHA 914f68b...), which is the same product lineage as the advisory. The upstream fix (commit 9601a937ff3b7ef5d04b2a0e950d0e44e1bb4cbd, author markt@apache.org, git-svn r1774166 on tc8.5.x) is an ancestor of HEAD. The fix is absent in tags 8.5.8/8.5.9 but present from 8.5.11 onward, exactly matching the CVE's \"affected 8.5.7\u20138.5.9, fixed in 8.5.11\" boundary. The current nextRequest() (java/org/apache/coyote/http11/Http11InputBuffer.java:303-334) contains the post-fix logic (compact()+flip() when data remains; position(0).limit(0) when empty); the vulnerable pre-fix arithmetic \"byteBuffer.limit(byteBuffer.limit() - byteBuffer.position()).position(0)\" is absent. Verdict not_affected: the vulnerable pattern is not present in HEAD because an UPSTREAM (Apache, non-TuxCare) fix is already baked into the shipped version \u2192 justification code_not_present.", "justification": "code_not_present" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:1da49874-9d17-5486-90d7-ae357b7976ba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target is pristine upstream Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, SHA 914f68b451). CVE-2017-12617 is a JSP-upload RCE: with the Default/WebDAV servlet's readonly init-param set to false, an attacker could PUT a JSP whose target path carries a trailing slash (e.g. `PUT /evil.jsp/`) so it bypasses the `*.jsp`\u2192JspServlet mapping and is written by the DefaultServlet as `evil.jsp` (the File API drops the trailing '/'); a later `GET /evil.jsp` executes it. The upstream remainder-of-fix (apache/tomcat commit 4cf7dab8, Mark Thomas, bug 61542) is present: DirResourceSet.write() rejects any path ending in '/' before creating the file (lines 220-224: `if (path.endsWith(\"/\")) return false;`). DirResourceSet is the sole writable resource set reachable from DefaultServlet.doPut \u2192 StandardRoot.write \u2192 main.write; FileResourceSet.write and EmptyResourceSet.write unconditionally return false. AbstractFileResourceSet.file() additionally enforces canonical-path/case-sensitivity and Windows-filename checks (lines 65, 83, 130). Fix commit (one of the supplied patch URLs) is an upstream, Apache-authored change baked into the 8.5.46 release \u2014 not vulnerable. Verdict: not_affected (upstream fix present; vulnerable pattern absent from HEAD).", "justification": "code_not_present" } }, { "id": "CVE-2017-5647", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:18b09c0d-37b1-5e4e-ab0b-a7e771cc583b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5647 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target is pristine Apache Tomcat 8.5.46. CVE-2017-5647 (pipelined request lost / wrong-response desynchronization when sendfile is used) affects 8.5.0-8.5.12 and was fixed upstream in 8.5.13 by commit f5e06b8c74 (\"Improve sendfile handling when requests are pipelined.\", Mark Thomas). That fix is fully present in 8.5.46: the new SendfileKeepAliveState enum (NONE/PIPELINED/OPEN) exists, SendfileDataBase uses the enum field (the vulnerable boolean keepAlive is gone), Http11Processor sets PIPELINED when buffered request data remains (available(false)!=0), and all three endpoints (NIO, NIO2, APR) switch on keepAliveState and reprocess the buffered pipelined request via OPEN_READ instead of discarding it. The upstream fix commit is a direct ancestor of HEAD with no TuxCare merge, so this is an upstream/vendor fix already shipped -> not_affected / code_not_present.", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:13ea964b-e4f7-536e-b82e-66c6e26046de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. CVE-2017-5648: Tomcat fired request lifecycle events (requestInitialized/requestDestroyed) to application listeners using the raw internal org.apache.catalina.connector.Request object instead of its facade. Under a SecurityManager, an untrusted webapp's listener could retain that reference and reach another webapp's request/response data. Affected: 8.5.0\u20138.5.11; fixed in 8.5.12. Target is 8.5.46. The upstream tc8.5.x fix commit 0f7b9465 (\"Ensure request and response facades are used when firing application listeners\", Mark Thomas, svn r1785775) is an ancestor of HEAD, and all patched call sites now pass the facade: StandardHostValve.java:125/181, AsyncContextImpl.java:112, and FormAuthenticator.java:430/432/476/478 all use context.fireRequestInitEvent/DestroyEvent(request.getRequest()). The vulnerable pre-fix pattern (passing raw `request`) is absent from HEAD. The only remaining raw-`request` callers (ApplicationDispatcher.java:458/476) were intentionally left unchanged upstream because that `request` is the application-facing ServletRequest argument of the public RequestDispatcher.forward/include API \u2014 already a facade/wrapper, never the internal connector.Request. Fix is upstream-authored (apache.org), not a TuxCare backport, so verdict is not_affected / code_not_present rather than already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:26d605a9-090d-529d-a91d-2ca03dc6a118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target is Apache Tomcat 8.5.46 (HEAD 914f68b4, official Apache release tag). CVE-2017-5650 affects 8.5.0\u20138.5.12 and 9.0.0.M1\u2013M18: on receipt of an HTTP/2 GOAWAY frame, the connection did not close streams blocked waiting for a WINDOW_UPDATE, so each stranded stream kept holding a processing thread, enabling thread-pool exhaustion (DoS). The upstream fix (two commits by Mark Thomas, 2017-03-24) is fully present in the target: (1) Http2UpgradeHandler.goaway() now calls close() (line 1743), and (2) close() iterates every active stream and calls stream.receiveReset(Http2Error.CANCEL.getCode()) (lines 1122-1126), which via Stream.receiveReset()->cancelAllocationRequests()/allocationManager.notifyAny() (Stream.java:221-237) wakes any thread blocked on a flow-control window allocation, releasing the thread. upgradeDispatch also only re-arms SocketState.UPGRADED when the connection is not already CLOSED (lines 378-380). The GOAWAY input handler is wired (Http2Parser.java:342 calls output.goaway(...)). Because the vulnerable pre-fix pattern has been removed by an upstream Apache-authored fix already shipped in this version, the pattern is not present in HEAD. Fix commits are authored and committed by markt@apache.org (not a TuxCare/CloudLinux domain) and are plain mainline ancestors (no tuxcare-current merge), so this is a vendor fix -> not_affected, not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2017-5651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:dc9f04b2-c14d-5afc-b8a2-a26632acc42e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5651 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target is stock Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, authored by markt@apache.org). CVE-2017-5651 is the send-file-processing regression where a Processor could be added to the processor cache twice (fixed upstream in 8.5.13 / 9.0.0.M19 via BZ 60918). The affected range is 8.5.0\u20138.5.12 and 9.0.0.M1\u2013M18; 8.5.46 is well past that. Code inspection of java/org/apache/coyote/http11/Http11Processor.java confirms the full post-fix implementation is present and the pre-fix pattern is absent. The service loop declares SendfileState sendfileState = SendfileState.DONE (line 675), gates the keep-alive loop on sendfileState == SendfileState.DONE (line 678), calls sendfileState = processSendfile(socketWrapper) (line 867), and returns SocketState.SENDFILE exactly once when sendfileState == SendfileState.PENDING (lines 879-880). The method processSendfile(...) (lines 1678-1706) returns a SendfileState and only nulls sendfileData inside its own switch. The vulnerable pre-fix markers breakKeepAliveLoop() (boolean) and sendingWithSendfile are entirely absent (0 grep matches). The exact upstream patch commit 494429ca21 is in the target history and reachable from HEAD. This is an upstream/vendor fix already baked into the shipped version, not a TuxCare backport, so the vulnerable pattern is not present in HEAD => not_affected (code_not_present).", "justification": "code_not_present" } }, { "id": "CVE-2017-5664", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:b48fd74d-8675-56db-9c6c-d0480a19ad0f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5664 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Apache Tomcat 8.5.46 is not affected by CVE-2017-5664. The vulnerability was fixed by upstream Apache in versions after 8.5.14 (8.5.x commit 29893e6611 by Mark Thomas). Version 8.5.46 includes this fix: both DefaultServlet (lines 478-486) and WebdavServlet (lines 322-325) check for DispatcherType.ERROR and force error dispatches through doGet(), preventing non-GET methods from modifying/deleting static error pages.", "justification": "code_not_present" } }, { "id": "CVE-2017-7674", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:67f07e68-7d8a-552e-a16a-218f56bf99bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7674 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target is Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, SHA 914f68b4). CVE-2017-7674: the CORS Filter failed to emit a `Vary: Origin` response header, permitting cache poisoning. Affected range is 8.5.0\u20138.5.15; the upstream fix shipped in 8.5.16. The target at 8.5.46 already contains the fix: java/org/apache/catalina/filters/CorsFilter.java emits the Vary header via ResponseUtil.addVaryFieldName inside addStandardHeaders() \u2014 line 414 adds `Vary: Origin` whenever responses are origin-dependent (!anyOriginAllowed), and lines 452\u2013455 add Vary entries for preflight (OPTIONS) requests. addStandardHeaders() is invoked on all three CORS response paths (lines 268, 340, 361), so the Vary header is present on every origin-dependent response. The original fix commit 9044c1672b (\"BZ61101: CORS filter should set Vary header in response\", author remm@apache.org, 2017-05-22) is a natural ancestor of HEAD, later refined by markt@apache.org (1a1e1b3bb6, d8db00eb64) which centralized Vary handling into ResponseUtil. This is an UPSTREAM Apache fix (not a TuxCare backport): no merge into tuxcare-current exists on the ancestry path. Verdict: not_affected \u2014 the vulnerable pattern (missing Vary header) is absent from HEAD because the vendor fix is already baked into the shipped version.", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:3bfc7573-b1fe-5f85-a1cb-22553f3ba650", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. CVE-2017-7675 is not present in Tomcat 8.5.46. The vulnerability affected versions 8.5.0 to 8.5.15 where HTTP/2 request processing used setString() which stripped path parameters, allowing security constraint bypass. The fix (Bug 61120, commit dacb030b85) was applied in upstream Tomcat and shipped in the 8.5.46 release that TuxCare onboarded. The target code correctly uses setBytes() to preserve path parameters for security validation (Stream.java:416-421).", "justification": "code_not_present" } }, { "id": "CVE-2018-1304", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:a24ddae7-830a-5883-abfa-bbb39a0d87ca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1304 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target is Apache Tomcat 8.5.46 (HEAD tag confirmed, SHA 914f68b4). CVE-2018-1304: a security constraint whose URL pattern is the empty string \"\" (which maps to the context root) was ignored in RealmBase.findSecurityConstraints, letting unauthorised users reach the protected context root. The upstream fix (bug 62067) makes two changes in java/org/apache/catalina/realm/RealmBase.java: (1) normalise an empty/null request URI to \"/\", and (2) treat an empty-string pattern as matching the context-root URI \"/\". The target already contains BOTH changes verbatim \u2014 line 557 `if (uri == null || uri.length() == 0) { uri = \"/\"; }` and line 590 `if(uri.equals(patterns[k]) || patterns[k].length() == 0 && uri.equals(\"/\"))` with the comment \"Exact match including special case for the context root.\" git blame attributes both lines to upstream commit 5af7c13cff7 (Mark Thomas , 2018-02-06, the 8.5.x branch fix listed in the patch set). The commit is an ancestor of HEAD and was shipped in the upstream 8.5.46 release \u2014 not a TuxCare backport. Verdict: not_affected (upstream vendor fix already present; justification code_not_present).", "justification": "code_not_present" } }, { "id": "CVE-2018-1305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:83014b84-ad07-58ef-9a0e-54a2bd49cd74", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1305 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target is Apache Tomcat at tag 8.5.46 (HEAD 914f68b451). CVE-2018-1305 affected 8.5.0\u20138.5.27 and was fixed upstream in 8.5.28 by commit 2349801827 (Mark Thomas, markt@apache.org): \"Process all ServletSecurity annotations at web application start rather than at servlet load time to ensure constraints are applied consistently.\" That commit is an ancestor of HEAD and the full post-fix state is present in the target. The vulnerable lazy-registration pattern is absent, so the target is not affected. The fix is upstream-authored (apache.org domain, not TuxCare/CloudLinux), so the verdict is not_affected (vendor-fix branch) with justification code_not_present, rather than already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2018-1336", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:c0edbfd2-aaa3-53fd-8254-aa8eddf76a22", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1336 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target version 8.5.46 is not affected by CVE-2018-1336. The vulnerability affected Apache Tomcat versions 8.5.0 to 8.5.30. The upstream vendor fix (commit e00812b94e, authored by Mark Thomas markt@apache.org on 2018-04-27) was first included in version 8.5.31. The target version 8.5.46 inherits this fix from upstream, with the vulnerable pattern (missing input position rewind on UTF-8 decoder overflow) already removed.", "justification": "code_not_present" } }, { "id": "CVE-2018-8014", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:25cb0be9-2158-5a9f-a4a8-e708a6f38bb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8014 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Apache Tomcat 8.5.46 is not affected by CVE-2018-8014. The upstream vendor (Apache) fixed this vulnerability on 2018-05-16 (commit 60f596a21f), over a year before the 8.5.46 release (2019-09-16). All three components of the fix are present: DEFAULT_ALLOWED_ORIGINS changed from \"*\" to \"\", DEFAULT_SUPPORTS_CREDENTIALS changed from \"true\" to \"false\", and runtime validation preventing the insecure combination.", "justification": "code_not_present" } }, { "id": "CVE-2018-8034", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:8e821004-0acb-5214-906c-ca115fabb6d3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-8034 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Apache Tomcat 8.5.46 is NOT affected by CVE-2018-8034. The upstream vendor (Apache Tomcat) fixed this vulnerability in version 8.5.32 (first version after the affected range 8.5.0-8.5.31). The fix is present in the target code at WsWebSocketContainer.java:939-945, where setEndpointIdentificationAlgorithm(\"HTTPS\") enables hostname verification for TLS WebSocket connections. This is an upstream vendor fix authored by Mark Thomas from Apache, not a TuxCare backport. The vulnerable pattern (missing hostname verification) is not present in version 8.5.46.", "justification": "code_not_present" } }, { "id": "CVE-2019-12418", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:5b8434be-1f45-5277-b932-f880f6efe657", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-12418 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2019-17563", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:5c4d813d-854e-5079-822e-0fc58a98ee06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-17563 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2019-2684", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:1e7e45c4-5d8f-533f-876a-ddc3f4f48d44", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-2684 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ...", "justification": "code_not_reachable" } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:864ec54b-f51d-5157-a621-b5eefdb2cb22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-11996 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:b864ecca-3063-59df-bc5d-680d4ed8615f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:90d64e1c-9c8d-57b5-92ae-4a66530c61bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-13935 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2020-13943", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:5d14633d-198b-50d2-92a4-e403afc57b40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13943 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2020-17527", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:a4c69aa9-c526-52d7-bb16-62cc7b2906b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-17527 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:4f17536d-6b0b-5c3d-9596-8b34f95d03ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1935 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2020-1938", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:3bbf0620-fdd6-5bb3-84e7-827ce913bb0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1938 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:af5121b5-7de1-57f7-9ca3-0d0c648b9ea9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-9484 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2021-24122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:3c46fa03-dfea-5ee4-bdf1-522ec1a1ba43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-24122 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2021-25122", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:b1dd6c16-1036-5651-914f-8da51e265b35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25122 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2021-25329", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:32ed9743-fa1f-543e-9eee-51a6e87d4053", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-25329 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:665edc50-f34c-5d0a-ba24-20f5698a0990", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30639 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target version 8.5.46 is NOT affected by CVE-2021-30639. The vulnerability requires the errorException field in org.apache.coyote.Request, which was introduced in version 8.5.64 as part of improvements to non-blocking I/O error handling. Version 8.5.46 predates this change and does not contain the vulnerable code pattern. The errorException field and its failure-to-recycle behavior do not exist in this version, so the defect cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:6e0e56d4-cbfb-5f89-a483-273b7f07660b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30640 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:b5f94c59-9262-58dc-9cb8-a90cf8f6fd97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-33037 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:cfec1f7a-b9d0-5ecb-9435-4ce9f13a138c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-41079 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:28a76f22-9762-5ad5-b13d-bf3d66992b60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-42340 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:9bed59b1-3061-5ce3-a60d-cfea934cc72d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 Version 8.5.46 is NOT affected by CVE-2021-43980. The vulnerable code pattern (non-atomic `currentProcessor` field in SocketWrapperBase that could cause processor sharing between connections) was never present in this version. The vulnerability was introduced later in version 8.5.76 via a major refactoring (commit 01f2cf25b2, Feb 2022). Version 8.5.46 uses a different, thread-safe architecture ...", "justification": "code_not_present" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:41814fc7-895e-5f99-8300-98954b767316", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-23181 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target version 8.5.46 is not affected by CVE-2022-23181. This TOCTOU vulnerability was introduced by the CVE-2020-9484 fix in version 8.5.55. Since 8.5.46 predates that fix (8.5.46 < 8.5.55), the vulnerable code pattern never existed in this version. The target's FileStore.java has no canonical path validation or TOCTOU race condition.", "justification": "code_not_present" } }, { "id": "CVE-2022-25762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:dfb4a83d-dd37-5e2c-9150-4040ceb4faf5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25762 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:317d9521-496d-555e-be32-1e415c452f0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-29885 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:5debdcc6-1a83-50f7-8d0c-149ad9feafcd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-34305 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 Version 8.5.46 does not contain the vulnerable code pattern described in CVE-2022-34305. The XSS vulnerability concerns displaying session attributes and Principal attributes without HTML filtering in the Form authentication example JSP. These features were added to the codebase AFTER version 8.5.46 was released (session attributes on 2019-11-28, Principal attributes on 2022-02-08, while 8.5.46...", "justification": "code_not_present" } }, { "id": "CVE-2022-42252", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:19120d0c-d25e-5e82-b428-a0eada0c8b3c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-42252 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Tomcat 8.5.46 is not affected by CVE-2022-42252. The vulnerability requires the presence of HttpParser.isControl() validation in header parsing that removes malformed headers without rejecting requests when rejectIllegalHeader=false. Version 8.5.46 lacks this intermediate validation entirely. Instead, a Content-Length header whose value contains a control character other than CR or LF (e.g., Content-Length: 12\\u000734) is kept by header parsing, then rejected by Ascii.parseLong() which throws NumberFormatException, triggering an HTTP 400 response. An invalid Content-Length header is therefore never discarded while the request continues to be processed, which is the condition this vulnerability depends on.", "justification": "code_not_present" } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:a3d53cc2-d0dc-5fe0-9659-60509e85045a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Tomcat 8.5.46 is not affected by CVE-2022-45143. The vulnerable component JsonErrorReportValve does not exist in this version - it was introduced later in version 8.5.83. Version 8.5.46 only has ErrorReportValve which produces HTML error pages, not JSON. The CVE correctly identifies 8.5.83 as the first affected version in the 8.5.x series. No JSON error reporting capability exists in 8.5.46, therefore the vulnerability pattern (unescaped user-controlled values in JSON output) cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:39d2f5b2-a25f-5827-bfa4-f912ace08cfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-28708 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:d9d65488-3f2a-5b65-96bb-330635288680", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:4928e1a5-d674-5bc5-a7c9-cfdc7e3caf9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:7f9adb60-af29-533c-9823-08f205a4d458", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:e553f210-2b78-51aa-ad07-a0bde84cdcaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:b1984bdb-f6a3-5707-ab0b-cec6417311c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-46589 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-21733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:9ca45c92-5e1e-5b35-aca4-bfa1c61962de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-21733 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-23672", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:ed390c72-13bd-59d0-a32f-24b7eaa6cea8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-23672 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-24549", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:f0913b2e-a0f1-5945-9a94-b504dba65944", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-24549 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-34750", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:7e6d2bfc-c184-50e2-871c-a0427359b1e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-34750 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-38286", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:dcf231d0-c9c8-5174-8d85-5f6dd6d0c152", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38286 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:39f5e74f-3920-56e1-8dd1-f364c9529146", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:0bd1e502-017e-5bd4-9c8c-ba92c9250945", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-52316 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:e0fe97a5-121a-54b0-832d-33d36f26d5e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-24813 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-31650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:70e53cbf-89bd-532a-b7a6-e07bdfab8781", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-31650 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. Target version 8.5.46 is NOT affected by CVE-2025-31650. The vulnerability requires RFC 9218 (HTTP/2 Extensible Priorities) support, which was not implemented until Tomcat 8.5.90. Version 8.5.46 only supports RFC 7540's binary PRIORITY frames and lacks the vulnerable text-based priority field parsing code entirely. The CVE explicitly states affected versions start from 8.5.90, and target 8.5.46 predates this by 44 minor versions.", "justification": "code_not_present" } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:721629ae-d106-596b-b3cd-adaaf4c70018", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:b4b0f83f-19e3-5f3c-8ba0-08d2524fe634", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-46701 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:36efb853-50fe-556b-b5cd-1f6c1ef6fa12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-48988 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:c3a34b22-651e-53d7-aaa3-f74734558573", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-49125 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-52434", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:0ddbdafa-2b33-5049-b129-c305c717dac7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52434 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:28d14f30-7d78-530c-9b51-def6a69b4799", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-52520 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-53506", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:2864c72a-d3eb-5b19-abea-af9f0788837d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-53506 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:168d67df-4a11-5ee9-91f3-7f55fc6d3d3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:98dbe364-e33e-5484-9e62-ef150adc7c78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:6195be43-029a-57d6-866b-6657558461f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-24733", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:f023701c-990b-5330-8948-d1b79459556d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24733 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-24880", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:897ffb94-7171-525f-a136-e0fed1dc5d42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-24880 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:cda9f214-8aa7-53c9-af9c-033ba78957c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:9cb8fd55-cda4-54a5-a0c1-ae2d0cdc716d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:f528ddf4-f965-5b7b-9576-6a40efba7589", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig. not_affected \u2014 Apache Tomcat 8.5.46 is not affected by CVE-2026-32990. This CVE fixes a case-sensitivity bug in the checkSni method that was introduced by the CVE-2025-66614 fix. Version 8.5.46 predates CVE-2025-66614 and does not contain the checkSni method at all, therefore the specific vulnerability pattern (case-sensitive protocolHostName comparison in checkSni's fallback clause) cannot exist in this vers...", "justification": "code_not_present" } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:72663042-e55b-5411-ae8f-a8d5225c1706", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:5832ab49-4484-5b63-a562-24e88384ca1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:511f6175-25cf-5f55-a127-fb370605974f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:6b8d0f48-a19c-501b-b330-b8912f24fccb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:9f3e2eea-7adb-571a-94aa-07bc3fd0419e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:7d10fd3a-c253-52b4-813e-467c96cc4578", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:ccba866d-2c8f-52f8-8156-d3c1ad526b04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:54f592ef-60b9-5a31-a54c-f4d5f6d87d61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:265a67bd-9d12-52d2-9af0-7b3f92d25860", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:508144eb-5b94-5799-9286-d06f7b5f0963", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat-storeconfig." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-storeconfig@8.5.46-tuxcare.1" } ] }