[yusuke-koyoshi]

Updates

• Affected products
• References
• Summary

Comments
Add the affected Maven packages. This advisory currently has no affected packages.

• The fix changes org.apache.coyote.AsyncStateMachine. In the binary jars on Maven Central, the changed classes are packaged in tomcat-coyote and tomcat-embed-core (checked in 11.0.26 / 10.1.60 / 9.0.122). They are also shipped in the binary distribution org.apache.tomcat:tomcat.
• Patched versions are the first upstream tags containing the fix commits (11.0.27 / 10.1.61 / 9.0.123).
• Lower bounds follow the Apache advisory (11.0.22 / 10.1.55 / 9.0.118).

Evidence:

• Apache Tomcat security pages: https://tomcat.apache.org/security-11.html , https://tomcat.apache.org/security-10.html , https://tomcat.apache.org/security-9.html
• Fix commits:
  • 11.0.x: apache/tomcat@1dc6aa1 (first included in 11.0.27)
  • 10.1.x: apache/tomcat@6c7da60 (first included in 10.1.61)
  • 9.0.x: apache/tomcat@4b1eb9a (first included in 9.0.123)

CVSS (for reference only):

• Apache Tomcat security team rating: important
• NVD (provided by CISA ADP): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H (9.1, Critical)
• Current GitHub advisory (GHSA-w9r8-5j45-v8mg): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H (9.1, Critical), which matches the NVD score

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.