Apache Tomcat Vulnerabilities: CVE-2022-29885, CVE-2022-42252 (4369818)

Chatee ahora con Soporte

Regresar

Comentarios enviados

¿Este artículo solucionó su problema?

Seleccionar calificación

Título

Apache Tomcat Vulnerabilities: CVE-2022-29885, CVE-2022-42252
Descripción

Two vulnerabilities for Tomcat found in security scan:

Apache Tomcat: Low: Apache Tomcat EncryptInterceptor DoS (CVE-2022-29885) - Vulnerable software installed: Apache Tomcat 9.0.55 ([FMS_HOME]/server/tomcat/lib/catalina.jar)

Apache Tomcat: Low: Apache Tomcat request smuggling (CVE-2022-42252) - Vulnerable software installed: Apache Tomcat 9.0.55 ([FMS_HOME]/server/tomcat/lib/catalina.jar)

What are the effects of these vulnerabilities on Foglight?
Causa

https://nvd.nist.gov/vuln/detail/CVE-2022-29885
https://nvd.nist.gov/vuln/detail/CVE-2022-42252
Resolución

CVE-2022-29885 is for the environments using Tomcat clustering. Foglight does not use Tomcat clustering; therefore it is not affected.

CVE-2022-42252 applies if Tomcat is configured to ignore invalid HTTP headers by setting rejectIllegalHeader to false. Foglight has rejectIllegalHeader as true which is the default value in Tomcat 9; therefore, Foglight is not affected.

STATUS

Apache Tomcat has been upgraded to version 9.0.68 beginning in Foglight 6.3.0
ID de defecto

FOG-3797

Comentarios enviados

¿Este artículo solucionó su problema?

Seleccionar calificación

Contenido recomendado

Producto(s):: Foglight
6.1.0, 6.0.0, 5.9.8, 5.9.7; Foglight Evolve
6.1.0, 6.0.0, 9.3, 9.2; Foglight for Databases
6.1.0, 6.0.0, 5.9.7

Historial del artículo:: Creado el: 1/4/2023
Última actualización: 10/16/2024

Título