{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c9e1fdcb-e220-5f45-9698-5dc21dae2e5d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1", "version": "8.5.46-tuxcare.1", "pedigree": { "ancestors": [ { "name": "tomcat", "purl": "pkg:maven/org.apache.tomcat/tomcat@8.5.46", "type": "library", "group": "org.apache.tomcat", "version": "8.5.46" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2008-1947", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:11354c50-b88a-5e73-a6ee-781b0db594d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2008-1947 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2013-4590", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:0ea6855e-b078-5779-8ee2-c8c999763266", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-4590 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2015-5174", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:91397406-8379-5436-97d8-14b65559594d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5174 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2015-5346", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:e3e4ae86-99a9-581a-a85f-cc20aeeb4253", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5346 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0706", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:07ed142d-216b-5ba9-8a62-e2887941b133", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-0706 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2016-0762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:67b2288f-09a0-5dfb-bf63-ede3da15d105", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0762 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2016-0762 is a username-enumeration timing attack: Tomcat Realm implementations skipped processing the supplied password when the username did not exist, so \"user not found\" returned faster than \"user found, wrong password\". The upstream fix adds a \"waste a bit of time\" credential-processing call on the user-not-found path so timing is equalized. Target is Apache Tomcat 8.5.46 (HEAD 914f68b451, detached tag 8.5.46). All four patched Realm classes already contain the exact fix: getCredentialHandler().mutate(credentials) is called in the user-not-found branch of RealmBase.java:346, DataSourceRealm.java:320, JDBCRealm.java:390, and MemoryRealm.java:132, each under the comment \"Waste a bit of time as not to reveal that the user does not exist.\" git blame attributes these lines to upstream commit d79c63d424fe (Mark Thomas, markt@apache.org, 2016-08-30, subject \"Make timing attacks against the Realm implementations harder. (schultz)\") \u2014 which is literally one of the three vendor patch commits supplied in the task. That commit is an ancestor of HEAD and reached it purely through upstream Apache lineage (no tuxcare-current merge on the path). The vulnerable pre-fix pattern is therefore not present in HEAD. Verdict: not_affected (upstream vendor fix baked into the shipped 8.5.x release; CVE affected range stops at 8.5.4, fix shipped in 8.5.5+).", "justification": "code_not_present" } }, { "id": "CVE-2016-0763", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:50db3361-e33a-5a36-9881-fc5fe81291c0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-0763 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2016-0763: ResourceLinkFactory.setGlobalContext() in Apache Tomcat lacked an authorization check, letting an untrusted web application replace the shared global naming context and bypass SecurityManager restrictions to read/write arbitrary application data or disrupt the app. The target is Tomcat 8.5.46, which already ships the upstream Apache fix. In java/org/apache/naming/factory/ResourceLinkFactory.java, setGlobalContext() (lines 60-67) now obtains System.getSecurityManager() and, when non-null, calls sm.checkPermission(new RuntimePermission(ResourceLinkFactory.class.getName()+\".setGlobalContext\")) BEFORE assigning globalContext. This is the exact mitigation introduced upstream. git blame attributes lines 61-65 to commit bc8717f41a379e812ffbbae2dd71ae6822fe680f (\"Protect initialization of ResourceLinkFactory when running with a SecurityManager. This is the fix for CVE-2016-0763\") by Konstantin Kolinko , 2016-01-21 \u2014 an upstream Apache committer, present as a linear ancestor of HEAD (no TuxCare merge). The CVE lists 8.x before 8.0.31 as affected; 8.5.46 was branched after the fix, so it contains the fix natively. Verdict: not_affected (upstream/vendor fix already present; justification code_not_present).", "justification": "code_not_present" } }, { "id": "CVE-2016-6794", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:cea502e8-ad73-59d9-805c-f977c076a820", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6794 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 CVE-2016-6794 is not present in Apache Tomcat 8.5.46. The vulnerability allowed web applications to bypass SecurityManager restrictions and read system properties through the configuration file property replacement feature. The upstream Apache Tomcat vendor applied a complete fix in August 2016 (commit f8db078f1e) by introducing a PermissionCheck interface and modifying the Digester to verify P...", "justification": "code_not_present" } }, { "id": "CVE-2016-6796", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:da15aef6-cfc4-5907-bb38-e4aafdddef75", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6796 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. Target Apache Tomcat 8.5.46 is not affected by CVE-2016-6796. The vulnerability allowed malicious web applications to bypass SecurityManager restrictions by manipulating JSP Servlet configuration parameters (engineOptionsClass and scratchdir). The fix was introduced in upstream Apache Tomcat version 8.5.5 via commit f97769f50e, which added checks to ignore these parameters when SecurityManager is enabled. Since 8.5.46 is significantly newer than 8.5.5 (and CVE lists affected versions as 8.5.0-8.5.4), the target inherits the upstream vendor fix and the vulnerable pattern is not present.", "justification": "code_not_present" } }, { "id": "CVE-2016-6797", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:94918e9f-7a20-53e9-b1aa-7b67b561c8ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6797 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. Target Apache Tomcat 8.5.46 is NOT affected by CVE-2016-6797. The ResourceLinkFactory access-control fix is fully present in java/org/apache/naming/factory/ResourceLinkFactory.java at HEAD. getObjectInstance() calls validateGlobalResourceAccess(globalName) (lines 148-150) and returns null before performing globalContext.lookup() (line 152) whenever the requesting web application's classloader was not explicitly registered (via registerGlobalResourceAccess) with a ResourceLink to that global name. This is the exact defense the vendor patch installs (globalResourceRegistrations map + register/deregister/validate methods, lines 50-120). The fix was authored upstream by Apache (Mark Thomas, markt@apache.org) in commit d6b5600afe (the 8.5.x branch fix), which is an ancestor of the 8.5.46 tag \u2014 CVE range is 8.5.0\u20138.5.4, fix landed in 8.5.5, so 8.5.46 post-dates it. Attribution ladder yields no TuxCare/CloudLinux signal (author @apache.org, no tuxcare-current merge in ancestry), so this is an upstream vendor fix \u2192 verdict not_affected, justification code_not_present. (The CloudLinux backport commit 24f6e585fe for CVE-2016-6797 exists but targets 7.0.70 and is not in HEAD's history.)", "justification": "code_not_present" } }, { "id": "CVE-2016-6817", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:c0c98e32-7f8e-586b-8c27-96377cc9d3c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-6817 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2016-6817: the HTTP/2 header parser in Tomcat 8.5.0\u20138.5.6 (and 9.0.0.M1\u2013M11) entered an infinite loop when a header larger than its fixed 1024-byte read buffer was received, enabling a DoS. The upstream fix (Apache commit 85c63227, Mark Thomas, 2016-10-20, bug 60232; released in 8.5.7) replaced the fixed buffer with a dynamically-expanding one. The target is at tag 8.5.46 \u2014 far downstream of 8.5.7 \u2014 and HEAD contains the complete, exact post-fix code: the ByteBufferUtils import, the `volatile ByteBuffer headerReadBuffer = ByteBuffer.allocate(Constants.DEFAULT_HEADER_READ_BUFFER_SIZE)` field, the expand-on-exhaustion logic in readHeaderPayload(), and the buffer reset in onHeadersComplete(). git blame attributes all fix lines to the upstream commit 85c63227 (markt@apache.org). The vulnerable fixed-buffer pattern is not present in HEAD. Attribution ladder A1\u2013A4 produce no TuxCare/CloudLinux signal (upstream author, no tuxcare-current merge), so this is the vendor-fix flavor of not_affected, not already_fixed. Verdict: not_affected (code_not_present).", "justification": "code_not_present" } }, { "id": "CVE-2016-8747", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:a6a02092-f601-5fc1-9c55-667afe1980ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8747 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2016-8747 is an information-disclosure bug in Apache Tomcat's Http11InputBuffer.nextRequest() where incorrect ByteBuffer position/limit handling between pipelined requests on a reused keep-alive connection could leave stale bytes from a prior request associated with a new request (exploitable behind a reverse proxy). Target is Apache Tomcat 8.5.46 (tag, SHA 914f68b...), which is the same product lineage as the advisory. The upstream fix (commit 9601a937ff3b7ef5d04b2a0e950d0e44e1bb4cbd, author markt@apache.org, git-svn r1774166 on tc8.5.x) is an ancestor of HEAD. The fix is absent in tags 8.5.8/8.5.9 but present from 8.5.11 onward, exactly matching the CVE's \"affected 8.5.7\u20138.5.9, fixed in 8.5.11\" boundary. The current nextRequest() (java/org/apache/coyote/http11/Http11InputBuffer.java:303-334) contains the post-fix logic (compact()+flip() when data remains; position(0).limit(0) when empty); the vulnerable pre-fix arithmetic \"byteBuffer.limit(byteBuffer.limit() - byteBuffer.position()).position(0)\" is absent. Verdict not_affected: the vulnerable pattern is not present in HEAD because an UPSTREAM (Apache, non-TuxCare) fix is already baked into the shipped version \u2192 justification code_not_present.", "justification": "code_not_present" } }, { "id": "CVE-2017-5647", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:52c64a15-d600-52c8-b36f-261cb31800d2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5647 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. Target is pristine Apache Tomcat 8.5.46. CVE-2017-5647 (pipelined request lost / wrong-response desynchronization when sendfile is used) affects 8.5.0-8.5.12 and was fixed upstream in 8.5.13 by commit f5e06b8c74 (\"Improve sendfile handling when requests are pipelined.\", Mark Thomas). That fix is fully present in 8.5.46: the new SendfileKeepAliveState enum (NONE/PIPELINED/OPEN) exists, SendfileDataBase uses the enum field (the vulnerable boolean keepAlive is gone), Http11Processor sets PIPELINED when buffered request data remains (available(false)!=0), and all three endpoints (NIO, NIO2, APR) switch on keepAliveState and reprocess the buffered pipelined request via OPEN_READ instead of discarding it. The upstream fix commit is a direct ancestor of HEAD with no TuxCare merge, so this is an upstream/vendor fix already shipped -> not_affected / code_not_present.", "justification": "code_not_present" } }, { "id": "CVE-2017-5650", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:2a9d11ad-ad54-5524-924b-d284d19f2f79", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5650 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. Target is Apache Tomcat 8.5.46 (HEAD 914f68b4, official Apache release tag). CVE-2017-5650 affects 8.5.0\u20138.5.12 and 9.0.0.M1\u2013M18: on receipt of an HTTP/2 GOAWAY frame, the connection did not close streams blocked waiting for a WINDOW_UPDATE, so each stranded stream kept holding a processing thread, enabling thread-pool exhaustion (DoS). The upstream fix (two commits by Mark Thomas, 2017-03-24) is fully present in the target: (1) Http2UpgradeHandler.goaway() now calls close() (line 1743), and (2) close() iterates every active stream and calls stream.receiveReset(Http2Error.CANCEL.getCode()) (lines 1122-1126), which via Stream.receiveReset()->cancelAllocationRequests()/allocationManager.notifyAny() (Stream.java:221-237) wakes any thread blocked on a flow-control window allocation, releasing the thread. upgradeDispatch also only re-arms SocketState.UPGRADED when the connection is not already CLOSED (lines 378-380). The GOAWAY input handler is wired (Http2Parser.java:342 calls output.goaway(...)). Because the vulnerable pre-fix pattern has been removed by an upstream Apache-authored fix already shipped in this version, the pattern is not present in HEAD. Fix commits are authored and committed by markt@apache.org (not a TuxCare/CloudLinux domain) and are plain mainline ancestors (no tuxcare-current merge), so this is a vendor fix -> not_affected, not already_fixed.", "justification": "code_not_present" } }, { "id": "CVE-2017-5664", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:b946c3c3-8912-5df4-9203-cc6844f0881d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5664 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. Apache Tomcat 8.5.46 is not affected by CVE-2017-5664. The vulnerability was fixed by upstream Apache in versions after 8.5.14 (8.5.x commit 29893e6611 by Mark Thomas). Version 8.5.46 includes this fix: both DefaultServlet (lines 478-486) and WebdavServlet (lines 322-325) check for DispatcherType.ERROR and force error dispatches through doGet(), preventing non-GET methods from modifying/deleting static error pages.", "justification": "code_not_present" } }, { "id": "CVE-2017-7674", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:35dccff6-fc55-5a91-8f7a-33a2022441de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7674 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. Target is Apache Tomcat 8.5.46 (HEAD detached at tag 8.5.46, SHA 914f68b4). CVE-2017-7674: the CORS Filter failed to emit a `Vary: Origin` response header, permitting cache poisoning. Affected range is 8.5.0\u20138.5.15; the upstream fix shipped in 8.5.16. The target at 8.5.46 already contains the fix: java/org/apache/catalina/filters/CorsFilter.java emits the Vary header via ResponseUtil.addVaryFieldName inside addStandardHeaders() \u2014 line 414 adds `Vary: Origin` whenever responses are origin-dependent (!anyOriginAllowed), and lines 452\u2013455 add Vary entries for preflight (OPTIONS) requests. addStandardHeaders() is invoked on all three CORS response paths (lines 268, 340, 361), so the Vary header is present on every origin-dependent response. The original fix commit 9044c1672b (\"BZ61101: CORS filter should set Vary header in response\", author remm@apache.org, 2017-05-22) is a natural ancestor of HEAD, later refined by markt@apache.org (1a1e1b3bb6, d8db00eb64) which centralized Vary handling into ResponseUtil. This is an UPSTREAM Apache fix (not a TuxCare backport): no merge into tuxcare-current exists on the ancestry path. Verdict: not_affected \u2014 the vulnerable pattern (missing Vary header) is absent from HEAD because the vendor fix is already baked into the shipped version.", "justification": "code_not_present" } }, { "id": "CVE-2017-7675", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:c7e9cb2a-26e9-5f67-a32f-f90305f9536c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-7675 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. CVE-2017-7675 is not present in Tomcat 8.5.46. The vulnerability affected versions 8.5.0 to 8.5.15 where HTTP/2 request processing used setString() which stripped path parameters, allowing security constraint bypass. The fix (Bug 61120, commit dacb030b85) was applied in upstream Tomcat and shipped in the 8.5.46 release that TuxCare onboarded. The target code correctly uses setBytes() to preserve path parameters for security validation (Stream.java:416-421).", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:45676971-9f10-5192-a2e8-8b0a79b9d8dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-0221 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2019-17569", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:ce728efd-6ae1-53b7-800f-a8fc4820b3eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17569 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2019-2684", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:fd6fd755-9313-5daf-ae2f-9de3337767b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-2684 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Tomcat 8.5.46 contains vulnerable JMX/RMI code that could expose CVE-2019-2684 (Java SE RMI deserialization), but this code is not reachable in the default shipped configuration. The vulnerable JmxRemoteLifecycleListener class exists in the codebase and uses the unpatched `LocateRegistry.createRegistry()` + `registry.bind()` pattern that allows unauthorized RMI registry modifications. However, ...", "justification": "code_not_reachable" } }, { "id": "CVE-2020-11996", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:8310a6dc-8471-5749-84d7-194677f90c3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-11996 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-13934", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:c9c8cd6f-560a-5d7b-8456-3596290dfe39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-13934 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-13935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:1a73a8d5-8359-595f-930c-73d21789593c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-13935 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-1935", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:46ea032c-706d-57f9-a501-e5b13ef0fc9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-1935 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2020-8022", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:efa34f39-fc0e-537d-a378-2ebcde64942e", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2020-8022 is a false positive for org.apache.tomcat:tomcat 8.5.46-tuxcare.1." } }, { "id": "CVE-2021-30639", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:aa1d1ccd-8d85-5b1c-914a-a20b014f9b78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-30639 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. Target version 8.5.46 is NOT affected by CVE-2021-30639. The vulnerability requires the errorException field in org.apache.coyote.Request, which was introduced in version 8.5.64 as part of improvements to non-blocking I/O error handling. Version 8.5.46 predates this change and does not contain the vulnerable code pattern. The errorException field and its failure-to-recycle behavior do not exist in this version, so the defect cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2021-30640", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:150e0d76-6b4a-5e6f-8f82-c27911aac082", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-30640 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-33037", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:607ae4cd-f0f5-527a-aa8a-b5786f4724c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-33037 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-41079", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:10f94a13-bdfb-5b5c-9f5b-ce895993fc9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-41079 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-42340", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:113b7a88-6023-5946-a99d-e5addfc26403", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-42340 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2021-43980", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:6157a493-8931-5c3c-8fcb-3f5636b07950", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-43980 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Version 8.5.46 is NOT affected by CVE-2021-43980. The vulnerable code pattern (non-atomic `currentProcessor` field in SocketWrapperBase that could cause processor sharing between connections) was never present in this version. The vulnerability was introduced later in version 8.5.76 via a major refactoring (commit 01f2cf25b2, Feb 2022). Version 8.5.46 uses a different, thread-safe architecture ...", "justification": "code_not_present" } }, { "id": "CVE-2022-23181", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:01370e6d-199a-53b5-8afa-108dcace4b08", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-23181 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. Target version 8.5.46 is not affected by CVE-2022-23181. This TOCTOU vulnerability was introduced by the CVE-2020-9484 fix in version 8.5.55. Since 8.5.46 predates that fix (8.5.46 < 8.5.55), the vulnerable code pattern never existed in this version. The target's FileStore.java has no canonical path validation or TOCTOU race condition.", "justification": "code_not_present" } }, { "id": "CVE-2022-25762", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:5d3d1f59-8428-5a55-a06b-c30d10b89aa6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-25762 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-29885", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:226cdb95-42cb-5cf3-85db-e93aa28bfa94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-29885 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2022-34305", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:ca8c4e09-5e57-5239-a90f-b278b27158dd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-34305 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Version 8.5.46 does not contain the vulnerable code pattern described in CVE-2022-34305. The XSS vulnerability concerns displaying session attributes and Principal attributes without HTML filtering in the Form authentication example JSP. These features were added to the codebase AFTER version 8.5.46 was released (session attributes on 2019-11-28, Principal attributes on 2022-02-08, while 8.5.46...", "justification": "code_not_present" } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:07595e83-83d5-5adc-8fc2-44a06699105e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41080 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:d98b887f-8ba2-5797-8ee4-c02532039905", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-42795 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2023-45648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:64503552-f827-5c15-ba2f-5986f74c6ff0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45648 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2024-54677", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:34ec28c4-14ea-5eb2-bff3-cdf825b20b95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-54677 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:2bf92c09-2e1c-56c3-a3a7-39af47fe1a78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:db5d705f-39aa-5c18-b81f-394f183086c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-55752 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:1213181a-9057-5630-8001-7e7e62512866", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:2d42b91f-1c37-5f3d-856f-048021d02122", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-61795 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2025-66614", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:47c09cbd-bde4-5327-aab0-e8774feb1a80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-66614 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:abc52e2d-d726-5782-9b4f-84e3f69bdc8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29129", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:c05350aa-1d0a-517f-936a-56310614fa96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29129 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29145", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:244a6f6a-2261-5747-a534-845cfc086784", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-29145 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-29146", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:b9a0d45c-1606-53d3-9eae-0b1f571ef218", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-29146 is fixed in version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-32990", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:d9740e3b-3292-5e33-be2a-e9140d1d141d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32990 does not affect version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat. not_affected \u2014 Apache Tomcat 8.5.46 is not affected by CVE-2026-32990. This CVE fixes a case-sensitivity bug in the checkSni method that was introduced by the CVE-2025-66614 fix. Version 8.5.46 predates CVE-2025-66614 and does not contain the checkSni method at all, therefore the specific vulnerability pattern (case-sensitive protocolHostName comparison in checkSni's fallback clause) cannot exist in this vers...", "justification": "code_not_present" } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:3d9ac670-14ff-5a94-91a6-5cba0b1de12d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34483 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34486", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:f6d5664b-f680-5504-b27a-470859d7e0ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34486 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-34487", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:a4eebddd-914b-5386-84e9-32706c68de7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-34487 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:cce7b3ef-9f83-5ffb-b9cc-679721f8f358", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41284 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-41293", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:3c7c50af-5c59-5a43-bc20-6e70e214665c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41293 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:d4d5cdb8-3007-5354-8759-45dc66338e63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42498 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:fa2ed917-5cb7-5880-9312-0fba1b433fe7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43512 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:21860883-29f7-5bd5-a4f6-9f1c07f66235", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43513 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:2e88a6aa-8789-5a42-a1df-daa2477cbbc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:44acfde8-2d12-505f-9b1f-33b31456b2c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43515 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:d83ad805-bb99-5597-9028-71da53d24557", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:315daefd-7a0b-5c5b-86b6-7a919bfb5ab3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65905 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ], "bom-ref": "urn:uuid:88a5cd73-4cff-5eb1-9c10-ebc9c93c09f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-68525 affects version 8.5.46-tuxcare.1 of org.apache.tomcat:tomcat." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat@8.5.46-tuxcare.1" } ] }