VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.0-M1

Search for packages

Vulnerability	Summary	Fixed by
VCID-7sta-sz5f-aaap Aliases: CVE-2023-28708 GHSA-2c9m-w27f-53rm	Apache Tomcat vulnerable to Unprotected Transport of Credentials	9.0.72 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 10.1.6 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 11.0.0-M3 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-pcvp-wv2z-aaas Aliases: CVE-2023-46589 GHSA-fccv-jmmp-qg76	Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.	9.0.83 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 10.1.16 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 11.0.0-M11 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 11.0.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-7sta-sz5f-aaap
Aliases:
CVE-2023-28708
GHSA-2c9m-w27f-53rm

Apache Tomcat vulnerable to Unprotected Transport of Credentials

9.0.72
Affected by 3 other vulnerabilities.

10.1.6
Affected by 3 other vulnerabilities.

11.0.0-M3
Affected by 3 other vulnerabilities.

VCID-pcvp-wv2z-aaas
Aliases:
CVE-2023-46589
GHSA-fccv-jmmp-qg76

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.

9.0.83
Affected by 2 other vulnerabilities.

10.1.16
Affected by 2 other vulnerabilities.

11.0.0-M11
Affected by 2 other vulnerabilities.

11.0.1
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2024-09-17T22:36:59.116839+00:00	GitLab Importer	Affected by	VCID-7sta-sz5f-aaap	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-catalina/CVE-2023-28708.yml	34.0.1
2024-09-17T22:03:39.470465+00:00	GHSA Importer	Affected by	VCID-7sta-sz5f-aaap	https://github.com/advisories/GHSA-2c9m-w27f-53rm	34.0.1
2024-09-17T22:02:12.813444+00:00	GHSA Importer	Affected by	VCID-pcvp-wv2z-aaas	https://github.com/advisories/GHSA-fccv-jmmp-qg76	34.0.1
2024-07-13T01:45:23.171735+00:00	GHSA Importer	Affected by	VCID-pcvp-wv2z-aaas	https://github.com/advisories/GHSA-fccv-jmmp-qg76	34.0.0rc4
2024-01-14T07:52:22.603804+00:00	GHSA Importer	Affected by	VCID-pcvp-wv2z-aaas	https://github.com/advisories/GHSA-fccv-jmmp-qg76	34.0.0rc2
2024-01-03T18:00:02.933649+00:00	GitLab Importer	Affected by	VCID-7sta-sz5f-aaap	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-catalina/CVE-2023-28708.yml	34.0.0rc1
2024-01-03T17:38:25.796419+00:00	GHSA Importer	Affected by	VCID-7sta-sz5f-aaap	https://github.com/advisories/GHSA-2c9m-w27f-53rm	34.0.0rc1
2024-01-03T17:37:05.584792+00:00	GHSA Importer	Affected by	VCID-pcvp-wv2z-aaas	https://github.com/advisories/GHSA-fccv-jmmp-qg76	34.0.0rc1