{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:22110337-96ed-5391-be57-4524c7d1071d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2", "type": "library", "group": "org.apache.tomcat", "bom-ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2", "version": "10.1.16-tuxcare.2", "pedigree": { "ancestors": [ { "name": "tomcat-catalina", "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16", "type": "library", "group": "org.apache.tomcat", "version": "10.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-5388", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:37993c4c-da99-578f-bed6-94303d58f832", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-5388 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2016-5388 (httpoxy) is not present in Apache Tomcat 10.1.16. The vulnerability allowed attackers to set the HTTP_PROXY environment variable in CGI scripts by sending a crafted \"Proxy\" HTTP header, potentially redirecting outbound HTTP traffic. The upstream Apache Tomcat fix (commit fb3569fbb9) introduced a whitelist-based filtering mechanism that restricts which HTTP headers are passed as environment variables to CGI processes. This fix was already included in the upstream Tomcat 10.1.16 release before TuxCare onboarded it. The vulnerable code pattern (unrestricted header-to-environment-variable conversion) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.72; >= 8.0.0, < 8.5.5), NVD (>= 6.0, <= 6.0.45; >= 7.0, <= 7.0.70; >= 8.0, <= 8.5.4), Snyk (>= 7.35, < 8.5.5; >= 7.35, < 8.5.5).", "justification": "code_not_present" } }, { "id": "CVE-2016-8735", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:8695c241-d81f-5f2a-94bf-6b94bcee4917", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-8735 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2016-8735 affects Apache Tomcat's JmxRemoteLifecycleListener component, which allows remote code execution via deserialization of arbitrary credential objects during JMX authentication. The vulnerability exists because the listener did not restrict credential types, allowing attackers to send malicious serialized objects. Apache Tomcat 10.1.16 is NOT AFFECTED because the JmxRemoteLifecycleListener component was completely removed by upstream Apache in commit 46fbf32e556 (2020-01-15), before version 10.1.16 was released (2023). The component was deprecated in 2019 as its functionality was superseded by the JRE's built-in remote JMX capability. Since the vulnerable code path does not exist in version 10.1.16, the target cannot be exploited via this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0.0, < 8.0.39; >= 8.5.0, < 8.5.7; >= 9.0.0.M1, < 9.0.0.M12), NVD (< 6.0.48; >= 7.0.0, < 7.0.73; >= 8.0, < 8.0.39; >= 8.5.0, < 8.5.7; = 9.0.0; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (< 6.0.48; >= 7, < 7.0.73; >= 8, < 8.0.39; >= 8.5, < 8.5.7; >= 9, < 9.0.0.M12).", "justification": "code_not_present" } }, { "id": "CVE-2017-12616", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:c8d8ce60-2cc0-575b-83fd-961c6ea3ae64", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12616 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2017-12616 affects VirtualDirContext in Apache Tomcat 7.0.0-7.0.80. The target (Tomcat 10.1.16) does not contain VirtualDirContext; this class was completely removed and replaced with the WebResourceSet architecture in Tomcat 8.0 (October 2012). The vulnerability pattern cannot exist in the target because the vulnerable component is architecturally absent. The replacement WebResourceSet architecture includes robust path validation (AbstractFileResourceSet.file() lines 98-99: canonical path validation against base directory) that provides equivalent protection to the CVE-2017-12616 patches.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 7.0.0, < 7.0.81), NVD (= 7.0.0; = 7.0.0-beta; = 7.0.1; = 7.0.2; = 7.0.2-beta; = 7.0.3; = 7.0.4; = 7.0.4-beta; = 7.0.5; = 7.0.5-beta; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 7.0.76; = 7.0.77; = 7.0.79; = 7.0.80), cve.org (>= 7.0.0, <= 7.0.80), Snyk (>= 7.0.0, < 7.0.81).", "justification": "code_not_present" } }, { "id": "CVE-2017-12617", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:a9ad74a3-517c-59dc-b4d0-9178d1ba5c86", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-12617 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2017-12617 is not present in Tomcat 10.1.16. The vulnerability allowed uploading JSP files via specially crafted HTTP PUT requests using trailing slash path manipulation. The upstream Apache Tomcat project fixed this in September 2017 (commits b7e0435d17 and b577f9a799). These fixes were already included in the upstream 10.1.16 release that TuxCare onboarded. The vulnerable pattern is not present because the upstream vendor's fix was already applied before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82; >= 9.0.0.M1, < 9.0.1; >= 8.5.0, < 8.5.23; >= 8.0.0-RC1, < 8.0.47; >= 7.0.0, < 7.0.82), NVD (>= 7.0.0, < 7.0.82; >= 8.0, < 8.0.47; >= 8.5.0, < 8.5.23; >= 9.0.0, < 9.0.1), cve.org (>= 9.0.0.M1, <= 9.0.0; >= 8.5.0, <= 8.5.22; >= 8.0.0.RC1, <= 8.0.46; >= 7.0.0, <= 7.0.81), Snyk (< 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1; < 7.0.82; >= 8, < 8.0.46; >= 8.5, < 8.5.22; >= 9.0.0.M1, < 9.0.1).", "justification": "code_not_present" } }, { "id": "CVE-2017-5648", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:7886dbce-f1e5-56b2-8665-7a626f786424", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2017-5648 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2017-5648 is NOT present in Tomcat 10.1.16. The vulnerability involved passing internal Request/Response objects to application listeners instead of facade wrappers, allowing untrusted applications under SecurityManager to retain references and access data from other web applications. The fix (using request.getRequest() to obtain facades) was applied upstream by Apache Tomcat developer Mark Thomas in March 2017 (commit dfa40863) and shipped in the upstream Tomcat 10.1.16 release. All critical code locations in the target use facades correctly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76; >= 9.0.0.M1, < 9.0.0.M18; >= 8.5.0, < 8.5.13; >= 8.0.0, < 8.0.42; >= 7.0.0, < 7.0.76), NVD (= 7.0.0; = 7.0.1; = 7.0.2; = 7.0.3; = 7.0.4; = 7.0.5; = 7.0.6; = 7.0.7; = 7.0.8; = 7.0.9; = 7.0.10; = 7.0.11; = 7.0.12; = 7.0.13; = 7.0.14; = 7.0.15; = 7.0.16; = 7.0.17; = 7.0.18; = 7.0.19; = 7.0.20; = 7.0.21; = 7.0.22; = 7.0.23; = 7.0.24; = 7.0.25; = 7.0.26; = 7.0.27; = 7.0.28; = 7.0.29; = 7.0.30; = 7.0.31; = 7.0.32; = 7.0.33; = 7.0.34; = 7.0.35; = 7.0.36; = 7.0.37; = 7.0.38; = 7.0.39; = 7.0.40; = 7.0.41; = 7.0.42; = 7.0.43; = 7.0.44; = 7.0.45; = 7.0.46; = 7.0.47; = 7.0.48; = 7.0.49; = 7.0.50; = 7.0.51; = 7.0.52; = 7.0.53; = 7.0.54; = 7.0.55; = 7.0.56; = 7.0.57; = 7.0.58; = 7.0.59; = 7.0.60; = 7.0.61; = 7.0.62; = 7.0.63; = 7.0.64; = 7.0.65; = 7.0.66; = 7.0.67; = 7.0.68; = 7.0.69; = 7.0.70; = 7.0.71; = 7.0.72; = 7.0.73; = 7.0.74; = 7.0.75; = 8.0.0; = 8.0.0-rc1; = 8.0.1; = 8.0.2; = 8.0.3; = 8.0.4; = 8.0.5; = 8.0.6; = 8.0.7; = 8.0.8; = 8.0.9; = 8.0.10; = 8.0.11; = 8.0.12; = 8.0.13; = 8.0.14; = 8.0.15; = 8.0.16; = 8.0.17; = 8.0.18; = 8.0.19; = 8.0.20; = 8.0.21; = 8.0.22; = 8.0.23; = 8.0.24; = 8.0.25; = 8.0.26; = 8.0.27; = 8.0.28; = 8.0.29; = 8.0.30; = 8.0.31; = 8.0.32; = 8.0.33; = 8.0.34; = 8.0.35; = 8.0.36; = 8.0.37; = 8.0.38; = 8.0.39; = 8.0.40; = 8.0.41; = 8.5.0; = 8.5.1; = 8.5.2; = 8.5.3; = 8.5.4; = 8.5.5; = 8.5.6; = 8.5.7; = 8.5.8; = 8.5.9; = 8.5.10; = 8.5.11; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone2; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9), cve.org (>= 9.0.0.M1, <= 9.0.0.M17; >= 8.5.0, <= 8.5.11; >= 8.0.0.RC1, <= 8.0.41; >= 7.0.0, <= 7.0.75), Snyk (>= 7.0.0, < 7.0.76; >= 8, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9-alpha, < 9.0.0.M17; >= 7.0.0, < 7.0.76; >= 8.0.0-RC1, < 8.0.42; >= 8.5.0, < 8.5.12; >= 9.0.0.M1, < 9.0.0.M17).", "justification": "code_not_present" } }, { "id": "CVE-2019-0221", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:59ebecab-9e4a-55d9-b106-010769f998e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-0221 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2019-0221 affects the SSI printenv command in Apache Tomcat, which echoed environment variable values without HTML entity encoding, enabling XSS attacks. The target repository (Tomcat 10.1.16-tuxcare.1) already contains the upstream fix introduced by Mark Thomas (markt@apache.org) in commit 15fcd166 on March 11, 2019. The fix adds HTML entity encoding via the SSIMediator.ENCODING_ENTITY par...", "justification": "code_not_present" } }, { "id": "CVE-2020-9484", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:e686437a-ac6b-5d55-8357-13abe3f4c7e5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-9484 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Apache Tomcat 10.1.16 is NOT affected by CVE-2020-9484. The vulnerability involves a path traversal attack in FileStore that allows loading and deserializing arbitrary files via manipulated session IDs. The fix adding canonical path validation was already present in the Apache Tomcat 10.1.16 upstream release that TuxCare onboarded. The defense code at FileStore.java:347-350 validates that resolved file paths remain within the storage directory boundary, blocking the attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0, < 9.0.35; >= 8.0.0, < 8.5.55; >= 7.0.0, < 7.0.104), NVD (>= 7.0.0, < 7.0.108; >= 8.5.0, < 8.5.63; >= 9.0.1, < 9.0.43; = 9.0.0-milestone1; = 9.0.0-milestone10; = 9.0.0-milestone11; = 9.0.0-milestone12; = 9.0.0-milestone13; = 9.0.0-milestone14; = 9.0.0-milestone15; = 9.0.0-milestone16; = 9.0.0-milestone17; = 9.0.0-milestone18; = 9.0.0-milestone19; = 9.0.0-milestone2; = 9.0.0-milestone20; = 9.0.0-milestone21; = 9.0.0-milestone22; = 9.0.0-milestone23; = 9.0.0-milestone24; = 9.0.0-milestone25; = 9.0.0-milestone26; = 9.0.0-milestone27; = 9.0.0-milestone3; = 9.0.0-milestone4; = 9.0.0-milestone5; = 9.0.0-milestone6; = 9.0.0-milestone7; = 9.0.0-milestone8; = 9.0.0-milestone9; = 10.0.0-milestone1; = 10.0.0-milestone2; = 10.0.0-milestone3; = 10.0.0-milestone4), cve.org (>= 10.0.0-M1, <= 10.0.0-M4; >= 9.0.0.M1, <= 9.0.34; >= 8.5.0, <= 8.5.54; >= 7.0.0, <= 7.0.103), Snyk (>= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104; >= 10.0.0-M1, < 10.0.0-M5; >= 9.0.0M1, < 9.0.35; >= 8.5.0, < 8.5.55; >= 7.0.0, < 7.0.104).", "justification": "code_not_present" } }, { "id": "CVE-2022-45143", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:9aa134ec-3b7d-54d8-ada9-f9531c81f5e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-45143 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2022-45143 is not present in Apache Tomcat 10.1.16. The vulnerability concerns missing escaping in JsonErrorReportValve that could allow JSON injection. The fix was already included in the upstream Apache Tomcat 10.1.16 release that TuxCare onboarded. The JsonErrorReportValve.java file at lines 86-88 properly uses JSONFilter.escape() to escape type, message, and description fields before embedding them in JSON output, preventing JSON injection and malformed output. The fix commit (1f50bff8daabb48c5f15398689988f26aac6ec56) was authored by Mark Thomas (markt@apache.org) and is an ancestor of TuxCare's onboarding commit (e1463febbc), confirming it shipped in the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0, < 10.1.2; >= 10.1.0, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69), NVD (>= 9.0.40, < 9.0.69; = 8.5.83; = 10.1.0-milestone1; = 10.1.0-milestone10; = 10.1.0-milestone11; = 10.1.0-milestone12; = 10.1.0-milestone13; = 10.1.0-milestone14; = 10.1.0-milestone15; = 10.1.0-milestone16; = 10.1.0-milestone17; = 10.1.0-milestone2; = 10.1.0-milestone3; = 10.1.0-milestone4; = 10.1.0-milestone5; = 10.1.0-milestone6; = 10.1.0-milestone7; = 10.1.0-milestone8; = 10.1.0-milestone9; = 10.1.1), cve.org (>= 10.1.0-M1, <= 10.1.1; >= 9.0.40, <= 9.0.68; = 8.5.83), Snyk (>= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2; >= 8.5.83, < 8.5.84; >= 9.0.40, < 9.0.69; >= 10.1.0-M1, < 10.1.2).", "justification": "code_not_present" } }, { "id": "CVE-2023-24998", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:02539ec7-b379-54f6-b536-66b4afb5f0c8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-24998 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. CVE-2023-24998 fix was already present in upstream Apache Tomcat 10.1.16 release. The vulnerability concerns unbounded file upload part processing in Commons FileUpload. The fix adds fileCountMax enforcement to limit the number of file parts processed per request. In Tomcat 10.1.16, this defense is active by default via maxParameterCount=10000. The fix was authored by upstream Apache developer Mark Thomas and shipped with the 10.1.16 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M2, < 11.0.0-M5; >= 8.5.85, < 8.5.88; >= 9.0.0-M1, < 9.0.71), cve.org (= 11.0.0-M1; >= 10.0.0-M1, <= 10.1.4; >= 9.0.0-M1, <= 9.0.70; >= 8.5.0, <= 8.5.84), Snyk (>= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3; >= 8.5.0, < 8.5.85; >= 9.0.0-M1, < 9.0.71; >= 10.1.0-M1, < 10.1.5; >= 11.0.0-M1, < 11.0.0-M3).", "justification": "code_not_present" } }, { "id": "CVE-2023-28708", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:a129de43-ebb2-5515-9c6b-5812d69fee27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-28708 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-28708 affects Apache Tomcat versions 10.1.0-M1 to 10.1.5, where RemoteIpFilter fails to propagate the secure flag when X-Forwarded-Proto is set to https, resulting in session cookies without the Secure attribute. The target version 10.1.16 is beyond the affected range and already contains the upstream fix. The fix (commit f509bbf31f by lihan@apache.org) was present in the upstream Apac...", "justification": "code_not_present" } }, { "id": "CVE-2023-41080", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:81af515a-9322-5a2e-a3dc-ada8ce28e0e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-41080 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 CVE-2023-41080 (open redirect via protocol-relative URLs in FORM authentication) is NOT present in Apache Tomcat 10.1.16. The upstream fix (commit bb4624a9f3) was already included in the Tomcat 10.1.16 release before TuxCare onboarded it. The vulnerable pattern (missing sanitization of leading slashes in savedRequestURL) does not exist; the fix code at FormAuthenticator.java:765-768 strips lead...", "justification": "code_not_present" } }, { "id": "CVE-2023-42795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:c1d7ae36-53ae-5d00-84cc-973560d65798", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-42795 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. not_affected \u2014 Apache Tomcat 10.1.16 is not affected by CVE-2023-42795. The vulnerability affects versions 10.1.0-M1 through 10.1.13, and was fixed in 10.1.14 and later. Since 10.1.16 > 10.1.14, the fix was already present in the upstream release when TuxCare onboarded it. All five recycle() method fixes (exception handling in Request.part.delete(), ApplicationHttpRequest.session.endAccess(), B2CConverter.dec...", "justification": "code_not_present" } }, { "id": "CVE-2023-46589", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:74cb2bbd-1dce-59d6-964f-0eb06d4557d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-46589 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Target Apache Tomcat 10.1.16 is NOT AFFECTED by CVE-2023-46589. The vulnerability affects Tomcat 10.1.0-M1 through 10.1.15, and version 10.1.16 is the first upstream release containing the fix. The fix was authored by Mark Thomas (markt@apache.org) in upstream commit 8ecff306 on 2023-10-05 and was already present in the upstream 10.1.16 release when TuxCare onboarded it. Both the primary fix (trailer header validation in ChunkedInputFilter) and secondary defensive measure (error handling in InputBuffer) are present in the target at HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96; >= 11.0.0-M1, < 11.0.0-M11), NVD (>= 8.5.0, < 8.5.96; >= 9.0.0, < 9.0.83; >= 10.1.0, < 10.1.16; = 11.0.0-milestone1; = 11.0.0-milestone10; = 11.0.0-milestone2; = 11.0.0-milestone3; = 11.0.0-milestone4; = 11.0.0-milestone5; = 11.0.0-milestone6; = 11.0.0-milestone7; = 11.0.0-milestone8; = 11.0.0-milestone9), cve.org (>= 11.0.0-M1, <= 11.0.0-M10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95; >= 11.0.0-m1, <= 11.0.0-m10; >= 10.1.0-M1, <= 10.1.15; >= 9.0.0-M1, <= 9.0.82; >= 8.5.0, <= 8.5.95), Snyk (>= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10; >= 8.5.0, < 8.5.96; >= 9.0.0-M1, < 9.0.83; >= 10.1.0-M1, < 10.1.16; >= 11.0.0-M1, < 11.0.0-M10).", "justification": "code_not_present" } }, { "id": "CVE-2024-50379", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:85d7a5db-4d8b-5708-b71b-dba77342b006", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-50379 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-52316", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:43bdfce5-7599-57df-ac5e-f07bdcd83c3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52316 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2024-56337", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:92197ae3-86ab-59ee-a59c-3503c88cbf60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-56337 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-24813", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:efe47fc3-29b8-5373-9e10-ef0f2cde737b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-24813 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-31651", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:24a68294-5218-5439-bf58-64ad4ba04ada", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-31651 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-46701", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:fdfb6285-4fe8-58cf-b8a4-f1ea60dd25d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46701 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-48988", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:a48d744a-d0fa-52c4-b1c1-947507018d2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-48988 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49124", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:27a1cfa2-e354-585d-b891-7d7c31860090", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49124 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-49125", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:f9cadef3-ab43-51ad-900f-fdf3e88a6757", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-49125 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-52520", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:aaaa08ec-7a2e-5426-a28e-c04d6c9ddefb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-52520 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55668", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:b3c3f112-930c-530f-8156-2c7147a8c211", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55668 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-55752", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:1d368569-4ef2-5a76-8981-bf467f6e62d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-55752 does not affect version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina. Version 10.1.16 is NOT vulnerable to CVE-2025-55752. The vulnerable code pattern (normalizing before decoding in RewriteValve) was introduced later in version 10.1.40. Version 10.1.16 uses a different code structure that does not call URLDecoder.decode after RequestUtil.normalize, thus the vulnerability is not present. The CVE advisory's version range \"10.1.0-M1 through 10.1.44\" is over-broad; only versions 10.1.40-10.1.44 contain the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2025-55754", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:c335ed83-4f2f-5150-b574-6a54a382442f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-55754 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2025-61795", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:964dfb89-b30f-5aef-a9b5-2502a419ef32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-61795 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-25854", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:d9c2f524-72fe-57c5-8620-af5088801e34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25854 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-34483", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:f1dd7f32-b99b-5363-b449-5e136d675cba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-34483 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-41284", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:580015f9-9b6a-5f47-b7e3-5f74bddda85d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41284 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-42498", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:af645466-d684-5491-ae10-c9433aaaf6d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42498 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43512", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:c459ef39-118f-567e-b810-693085da7fdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43512 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43513", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:6b6249c4-d18b-59cd-8430-9c85b9093071", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43513 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43514", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:10ed8e6b-0a9b-5629-b276-dea53d7910cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-43514 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-43515", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:29d2570b-9783-568f-9142-9de864374be6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-43515 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-53404", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:18026699-3bed-5c67-9ccb-1639db243f91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-53404 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55956", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:38a80f5c-094d-56a0-84b5-471d7c44ba16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55956 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-55957", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:8273dfed-9ba0-5423-b9fc-bf05ad26fac6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-55957 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-65182", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:e9cd5f59-0699-5e68-8935-6b16eb78c75f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65182 affects version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina, and is fixed in 10.1.16-tuxcare.3." } }, { "id": "CVE-2026-65905", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:8ae010b5-49cb-5145-86e4-978db49fc398", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65905 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } }, { "id": "CVE-2026-68525", "affects": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ], "bom-ref": "urn:uuid:9282bf8b-7f69-59f4-b7c2-3852f25b60c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-68525 is fixed in version 10.1.16-tuxcare.2 of org.apache.tomcat:tomcat-catalina." } } ], "dependencies": [ { "ref": "pkg:maven/org.apache.tomcat/tomcat-catalina@10.1.16-tuxcare.2" } ] }