[GHSA-563x-q5rq-57qp] Apache Tomcat has an HTTP Request/Response Smuggling vulnerability#7519
[GHSA-563x-q5rq-57qp] Apache Tomcat has an HTTP Request/Response Smuggling vulnerability#7519
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the affected Maven package coordinates and version ranges for the Tomcat HTTP Request/Response Smuggling advisory (GHSA-563x-q5rq-57qp) to better reflect which Tomcat artifacts are impacted.
Changes:
- Replace the affected artifact from
org.apache.tomcat:tomcat-tribestoorg.apache.tomcat:tomcatin existing affected entries. - Add affected entries for
org.apache.tomcat:tomcat-coyote. - Add affected entries for
org.apache.tomcat.embed:tomcat-embed-core(including 11.x branch metadata).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| { | ||
| "package": { | ||
| "ecosystem": "Maven", | ||
| "name": "org.apache.tomcat:tomcat-tribes" | ||
| "name": "org.apache.tomcat:tomcat" | ||
| }, | ||
| "ranges": [ | ||
| { |
There was a problem hiding this comment.
In this affected entry for the 10.1.x line, the fixed version is set such that 10.1.52 is treated as non-affected. That conflicts with the advisory text (affected through 10.1.52) and the security reference URL indicating the fix is in 10.1.53. Please update the fixed version accordingly (and keep the narrative/details consistent).
| { | ||
| "introduced": "10.1.0-M1" | ||
| }, | ||
| { | ||
| "fixed": "10.1.52" | ||
| } | ||
| ] |
There was a problem hiding this comment.
For the 10.1.x range here, fixed: 10.1.52 makes 10.1.52 itself non-affected. That appears inconsistent with the advisory text (affected through 10.1.52) and the referenced Tomcat security page (fixed in 10.1.53). Please adjust the fixed version (and keep the narrative/details in sync).
| { | ||
| "package": { | ||
| "ecosystem": "Maven", | ||
| "name": "org.apache.tomcat:tomcat" | ||
| "name": "org.apache.tomcat.embed:tomcat-embed-core" | ||
| }, | ||
| "ranges": [ | ||
| { |
There was a problem hiding this comment.
This affected entry for the 10.1.x line appears to mark 10.1.52 as fixed/non-affected, but the advisory text says versions through 10.1.52 are affected and the reference indicates the fix is in 10.1.53. Please update the fixed version to match the referenced fixed release and keep the narrative/details consistent.
Updates
Comments
fix affected packages depends on patch codes