1:29 p.m.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
Bug ID: 2047417
Summary: CVE-2022-23181 tomcat: local privilege escalation
vulnerability
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bgeorges(a)redhat.com, bmaxwell(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, cmoulliard(a)redhat.com,
coolsvap(a)gmail.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dbecker(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, eleandro(a)redhat.com,
emingora(a)redhat.com, etirelli(a)redhat.com,
fjuma(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gzaronikas(a)gmail.com,
gzaronik(a)redhat.com, huwang(a)redhat.com,
ibek(a)redhat.com, ikanello(a)redhat.com,
ivan.afonichev(a)gmail.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jclere(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jolee(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jrokos(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, krathod(a)redhat.com,
krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, lthon(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, nwallace(a)redhat.com,
pdelbell(a)redhat.com, peholase(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, rguimara(a)redhat.com,
rhcs-maint(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, slinaber(a)redhat.com,
smaestri(a)redhat.com, szappis(a)redhat.com,
tom.jenkinson(a)redhat.com, tzimanyi(a)redhat.com,
yborgess(a)redhat.com
Target Milestone: ---
Classification: Other
The fix for bug CVE-2020-9484 introduced a time of check, time of use
vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14,
9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform
actions with the privileges of the user that the Tomcat process is using. This
issue is only exploitable when Tomcat is configured to persist sessions using
the FileStore.
Reference:
https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
1:29 p.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |2047419, 2047418
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2047418
[Bug 2047418] CVE-2022-23181 tomcat:master/tomcat: local privilege escalation
vulnerability [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2047419
[Bug 2047419] CVE-2022-23181 tomcat: local privilege escalation vulnerability
[fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
1:29 p.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
--- Comment #1 from Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> ---
Created tomcat tracking bugs for this issue:
Affects: fedora-all [bug 2047419]
Created tomcat:master/tomcat tracking bugs for this issue:
Affects: fedora-all [bug 2047418]
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
1:29 p.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |2047420
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
7:37 p.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
Ted Jongseok Won <jwon(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Severity|high |medium
Priority|high |medium
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
2:43 p.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
Bug 2047417 depends on bug 2047418, which changed state.
Bug 2047418 Summary: CVE-2022-23181 tomcat:master/tomcat: local privilege escalation
vulnerability [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2047418
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |WONTFIX
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
10:04 a.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
--- Comment #7 from Mauro Matteo Cascella <mcascell(a)redhat.com> ---
Upstream commit:
https://github.com/apache/tomcat/commit/70da1aaa51e0f9d088438e9d958812a14...
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
10:40 a.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
Mauro Matteo Cascella <mcascell(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |2052082
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
7:01 p.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
Bug 2047417 depends on bug 2047419, which changed state.
Bug 2047419 Summary: CVE-2022-23181 tomcat: local privilege escalation vulnerability
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2047419
What |Removed |Added
----------------------------------------------------------------------------
Status|MODIFIED |CLOSED
Resolution|--- |ERRATA
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
9:22 a.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
--- Comment #11 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Fuse 7.11
Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
9:22 a.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:5532
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
5:40 a.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
--- Comment #16 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
JWS 5.7.0
Via RHSA-2022:7273 https://access.redhat.com/errata/RHSA-2022:7273
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
5:40 a.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:7273
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
5:43 a.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
--- Comment #17 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat JBoss Web Server 5.7 on RHEL 9
Red Hat JBoss Web Server 5.7 on RHEL 7
Red Hat JBoss Web Server 5.7 on RHEL 8
Via RHSA-2022:7272 https://access.redhat.com/errata/RHSA-2022:7272
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
5:43 a.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2022:7272
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
9:03 p.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
--- Comment #19 from Product Security DevOps Team <prodsec-dev(a)redhat.com> ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2022-23181
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
9:03 p.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |ERRATA
Status|NEW |CLOSED
Last Closed| |2022-12-03 03:03:25
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
8:38 a.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
--- Comment #20 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Spring Boot 2.7.2.SP1
Via RHSA-2023:0272 https://access.redhat.com/errata/RHSA-2023:0272
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
8:38 a.m.
New subject: [Bug 2047417] CVE-2022-23181 tomcat: local privilege escalation vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2023:0272
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047417
466
days inactive
841
days old
java-sig-commits@lists.fedoraproject.org
18 comments
1 participants
participants (1)
-
bugzilla＠redhat.com