[GHSA-q3mw-pvr8-9ggc] Apache Tomcat Open Redirect vulnerability#7617
Conversation
github-actions
Bot
changed the base branch from
main
to
hara-satoshi-ymr/advisory-improvement-7617
There was a problem hiding this comment.
Pull request overview
Updates the OSV advisory record for GHSA-q3mw-pvr8-9ggc (Apache Tomcat Open Redirect) to include Catalina’s standalone Maven artifact as an affected product, aligning affected-package coverage with where the vulnerable FORM authentication code resides.
Changes:
- Add
org.apache.tomcat:tomcat-catalinato theaffectedlist with version ranges matching the existing Tomcat/embedded ranges (8.5.x, 9.0.x, 10.1.x, 11.0.x). - Bump the advisory
modifiedtimestamp to reflect the update.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the |
advisory-database
Bot
merged commit 207daf5
into
hara-satoshi-ymr/advisory-improvement-7617
|
Hi @hara-satoshi-ymr! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
Adding
org.apache.tomcat:tomcat-catalinato the affected products. The vulnerable code (FORM authentication open-redirect) lives in Catalina, so installations that shiptomcat-catalina— typically the standalone Tomcat distribution — are also affected even thoughtomcat-embed-corealready covers the embedded variant.Note: an earlier attempt (#7517) used
org.apache.tomcat.embed:tomcat-catalina, but that coordinate does not exist on Maven Central. The correct coordinate isorg.apache.tomcat:tomcat-catalina, matching the convention used by other Tomcat advisories in this repo (e.g. GHSA-3vx3-xf6q-r5xp). This re-submits the change with the correct coordinate per Copilot's review.