Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.tomcat/tomcat@9.0.81
Typemaven
Namespaceorg.apache.tomcat
Nametomcat
Version9.0.81
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version9.0.86
Latest_non_vulnerable_version11.0.18
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-h6f2-qgnu-bqf4
vulnerability_id VCID-h6f2-qgnu-bqf4
summary 
Apache Tomcat Improper Input Validation vulnerability
Improper Input Validation vulnerability in Apache Tomcat.

Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single
request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.
references
0
reference_url https://github.com/apache/tomcat
reference_id
reference_type
scores
url https://github.com/apache/tomcat
1
reference_url https://github.com/apache/tomcat/commit/59583245639d8c42ae0009f4a4a70464d3ea70a0
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/59583245639d8c42ae0009f4a4a70464d3ea70a0
2
reference_url https://github.com/apache/tomcat/commit/8ecff306507be8e4fd3adee1ae5de1ea6661a8f4
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/8ecff306507be8e4fd3adee1ae5de1ea6661a8f4
3
reference_url https://github.com/apache/tomcat/commit/c83fe47725f7ae9ae213568d9039171124fb7ec6
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/c83fe47725f7ae9ae213568d9039171124fb7ec6
4
reference_url https://github.com/apache/tomcat/commit/eb5c094e5560764cda436362254997511a3ca1f6
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/eb5c094e5560764cda436362254997511a3ca1f6
5
reference_url https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp
reference_id
reference_type
scores
url https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp
6
reference_url https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
7
reference_url https://security.netapp.com/advisory/ntap-20231103-0007
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20231103-0007
8
reference_url https://www.debian.org/security/2023/dsa-5521
reference_id
reference_type
scores
url https://www.debian.org/security/2023/dsa-5521
9
reference_url https://www.debian.org/security/2023/dsa-5522
reference_id
reference_type
scores
url https://www.debian.org/security/2023/dsa-5522
10
reference_url http://www.openwall.com/lists/oss-security/2023/10/10/10
reference_id
reference_type
scores
url http://www.openwall.com/lists/oss-security/2023/10/10/10
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-45648
reference_id CVE-2023-45648
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-45648
12
reference_url https://github.com/advisories/GHSA-r6j3-px5g-cq3x
reference_id GHSA-r6j3-px5g-cq3x
reference_type
scores
url https://github.com/advisories/GHSA-r6j3-px5g-cq3x
fixed_packages
0
url pkg:maven/org.apache.tomcat/tomcat@8.5.94
purl pkg:maven/org.apache.tomcat/tomcat@8.5.94
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@8.5.94
1
url pkg:maven/org.apache.tomcat/tomcat@9.0.81
purl pkg:maven/org.apache.tomcat/tomcat@9.0.81
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.81
2
url pkg:maven/org.apache.tomcat/tomcat@10.1.14
purl pkg:maven/org.apache.tomcat/tomcat@10.1.14
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.14
3
url pkg:maven/org.apache.tomcat/tomcat@11.0.0-M12
purl pkg:maven/org.apache.tomcat/tomcat@11.0.0-M12
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.0-M12
aliases CVE-2023-45648, GHSA-r6j3-px5g-cq3x
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-h6f2-qgnu-bqf4
1
url VCID-jsyt-cmxf-gbh3
vulnerability_id VCID-jsyt-cmxf-gbh3
summary 
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could 
cause Tomcat to skip some parts of the recycling process leading to 
information leaking from the current request/response to the next.

Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
references
0
reference_url https://github.com/apache/tomcat
reference_id
reference_type
scores
url https://github.com/apache/tomcat
1
reference_url https://github.com/apache/tomcat/commit/30f8063d7a9b4c43ae4722f5e382a76af1d7a6bf
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/30f8063d7a9b4c43ae4722f5e382a76af1d7a6bf
2
reference_url https://github.com/apache/tomcat/commit/44d05d75d696ca10ce251e4e370511e38f20ae75
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/44d05d75d696ca10ce251e4e370511e38f20ae75
3
reference_url https://github.com/apache/tomcat/commit/9375d67106f8df9eb9d7b360b2bef052fe67d3d4
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/9375d67106f8df9eb9d7b360b2bef052fe67d3d4
4
reference_url https://github.com/apache/tomcat/commit/d6db22e411307c97ddf78315c15d5889356eca38
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/d6db22e411307c97ddf78315c15d5889356eca38
5
reference_url https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw
reference_id
reference_type
scores
url https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw
6
reference_url https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
7
reference_url https://security.netapp.com/advisory/ntap-20231103-0007
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20231103-0007
8
reference_url https://www.debian.org/security/2023/dsa-5521
reference_id
reference_type
scores
url https://www.debian.org/security/2023/dsa-5521
9
reference_url https://www.debian.org/security/2023/dsa-5522
reference_id
reference_type
scores
url https://www.debian.org/security/2023/dsa-5522
10
reference_url http://www.openwall.com/lists/oss-security/2023/10/10/9
reference_id
reference_type
scores
url http://www.openwall.com/lists/oss-security/2023/10/10/9
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-42795
reference_id CVE-2023-42795
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-42795
12
reference_url https://github.com/advisories/GHSA-g8pj-r55q-5c2v
reference_id GHSA-g8pj-r55q-5c2v
reference_type
scores
url https://github.com/advisories/GHSA-g8pj-r55q-5c2v
fixed_packages
0
url pkg:maven/org.apache.tomcat/tomcat@8.5.94
purl pkg:maven/org.apache.tomcat/tomcat@8.5.94
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@8.5.94
1
url pkg:maven/org.apache.tomcat/tomcat@9.0.81
purl pkg:maven/org.apache.tomcat/tomcat@9.0.81
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.81
aliases CVE-2023-42795, GHSA-g8pj-r55q-5c2v
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jsyt-cmxf-gbh3
2
url VCID-kbpn-7esm-77ew
vulnerability_id VCID-kbpn-7esm-77ew
summary 
Incomplete Cleanup vulnerability in Apache Tomcat.

The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, 
in progress refactoring that exposed a potential denial of service on 
Windows if a web application opened a stream for an uploaded file but 
failed to close the stream. The file would never be deleted from disk 
creating the possibility of an eventual denial of service due to the 
disk being full.

Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
references
0
reference_url https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82
reference_id
reference_type
scores
url https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82
1
reference_url http://www.openwall.com/lists/oss-security/2023/10/10/8
reference_id
reference_type
scores
url http://www.openwall.com/lists/oss-security/2023/10/10/8
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-42794
reference_id CVE-2023-42794
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-42794
3
reference_url https://github.com/advisories/GHSA-jm7m-8jh6-29hp
reference_id GHSA-jm7m-8jh6-29hp
reference_type
scores
url https://github.com/advisories/GHSA-jm7m-8jh6-29hp
fixed_packages
0
url pkg:maven/org.apache.tomcat/tomcat@8.5.94
purl pkg:maven/org.apache.tomcat/tomcat@8.5.94
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@8.5.94
1
url pkg:maven/org.apache.tomcat/tomcat@9.0.81
purl pkg:maven/org.apache.tomcat/tomcat@9.0.81
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.81
aliases CVE-2023-42794, GHSA-jm7m-8jh6-29hp
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-kbpn-7esm-77ew
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@9.0.81