Bug 2047417 (CVE-2022-23181) - CVE-2022-23181 tomcat: local privilege escalation vulnerability
Summary: CVE-2022-23181 tomcat: local privilege escalation vulnerability
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-23181
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2047418 2047419 2052082
Blocks: 2047420
TreeView+ depends on / blocked
 
Reported: 2022-01-27 19:29 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-02-06 14:38 UTC (History)
75 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-12-03 03:03:25 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:5532 0 None None None 2022-07-07 14:22:20 UTC
Red Hat Product Errata RHSA-2022:7272 0 None None None 2022-11-02 10:43:26 UTC
Red Hat Product Errata RHSA-2022:7273 0 None None None 2022-11-02 10:40:52 UTC
Red Hat Product Errata RHSA-2023:0272 0 None None None 2023-02-06 14:38:35 UTC

Description Guilherme de Almeida Suckevicz 2022-01-27 19:29:10 UTC 
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

Reference:
https://lists.apache.org/thread/l8x62p3k19yfcb208jo4zrb83k5mfwg9
Comment 1 Guilherme de Almeida Suckevicz 2022-01-27 19:29:40 UTC 
Created tomcat tracking bugs for this issue:

Affects: fedora-all [bug 2047419]


Created tomcat:master/tomcat tracking bugs for this issue:

Affects: fedora-all [bug 2047418]
Comment 7 Mauro Matteo Cascella 2022-02-08 16:04:38 UTC 
Upstream commit:
https://github.com/apache/tomcat/commit/70da1aaa51e0f9d088438e9d958812a144e12754
Comment 11 errata-xmlrpc 2022-07-07 14:22:14 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.11

Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532
Comment 16 errata-xmlrpc 2022-11-02 10:40:46 UTC 
This issue has been addressed in the following products:

  JWS 5.7.0

Via RHSA-2022:7273 https://access.redhat.com/errata/RHSA-2022:7273
Comment 17 errata-xmlrpc 2022-11-02 10:43:20 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 5.7 on RHEL 9
  Red Hat JBoss Web Server 5.7 on RHEL 7
  Red Hat JBoss Web Server 5.7 on RHEL 8

Via RHSA-2022:7272 https://access.redhat.com/errata/RHSA-2022:7272
Comment 19 Product Security DevOps Team 2022-12-03 03:03:20 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-23181
Comment 20 errata-xmlrpc 2023-02-06 14:38:30 UTC 
This issue has been addressed in the following products:

  Spring Boot 2.7.2.SP1

Via RHSA-2023:0272 https://access.redhat.com/errata/RHSA-2023:0272
Note You need to log in before you can comment on or make changes to this bug.