[kaito-yamaguchi-assured]

Updates

• Affected products
• References
• Summary

Comments
Add the affected Maven packages. This advisory currently has no affected packages.

• The fix changes org.apache.catalina.connector.OutputBuffer. In the binary jars on Maven Central, the changed classes are packaged in tomcat-catalina and tomcat-embed-core (checked in 11.0.26). They are also shipped in the binary distribution org.apache.tomcat:tomcat.
• Patched versions are the first upstream tags containing the fix commits (11.0.27).
• Only 11.0.x is affected, as in the Apache advisory. The content-length close condition changed by the fix is not present in OutputBuffer in 10.1.60 or 9.0.122. The lower bound 11.0.0-M25 follows the Apache advisory.

Evidence:

• Apache Tomcat security pages: https://tomcat.apache.org/security-11.html , https://tomcat.apache.org/security-10.html , https://tomcat.apache.org/security-9.html
• Fix commits:
  • 11.0.x: apache/tomcat@f13748b (first included in 11.0.27)

CVSS (for reference only):

• Apache Tomcat security team rating: important
• NVD (provided by CISA ADP): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H (9.1, Critical)
• Current GitHub advisory (GHSA-64hx-4gc9-f6v4): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H (9.1, Critical), which matches the NVD score

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.