[keita-chiba]

Updates

• Affected products
• CVSS v3
• References
• Severity
• Summary

Comments
Add the affected Maven packages. This advisory currently has no affected packages.

• The fix changes the Jasper JSTL <c:redirect> tag plugin (org.apache.jasper.tagplugins.jstl.core.Redirect) and the code generator (org.apache.jasper.compiler.Generator, Node, TagPluginManager, tagplugin.TagPluginContext). In the binary jars on Maven Central, the changed classes are packaged in tomcat-jasper and tomcat-embed-jasper (checked in 11.0.26 / 10.1.60 / 9.0.122). They are also shipped in the binary distribution org.apache.tomcat:tomcat.
• Patched versions are the first upstream tags containing the fix commits (11.0.27 / 10.1.61 / 9.0.123).
• 8.5.0-8.5.100 and 7.0.0-7.0.109 are also included without patched versions (EOL). The CVE record lists them as affected, and the Redirect tag plugin in 8.5.100 and 7.0.109 does not terminate page processing after the redirect.

Evidence:

• Apache Tomcat security pages: https://tomcat.apache.org/security-11.html , https://tomcat.apache.org/security-10.html , https://tomcat.apache.org/security-9.html
• Fix commits:
  • 11.0.x: apache/tomcat@d7948a0 (first included in 11.0.27)
  • 10.1.x: apache/tomcat@f8023d8 (first included in 10.1.61)
  • 9.0.x: apache/tomcat@6cd2ec7 (first included in 9.0.123)

CVSS (for reference only):

• Apache Tomcat security team rating: low
• The CVE record currently carries no CVSS v3.1 score (no CNA or CISA ADP metrics).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.