{"id":"CLSA-2023-1691083477","summary":"Fix CVE(s): CVE-2021-25329, CVE-2022-23181, CVE-2020-9484","details":"\n   * SECURITY UPDATE: Remote Code Execution via session persistence\n     - debian/patches/CVE-2020-9484.patch: Improve validation of storage\n       location when using FileStore.\n     - CVE-2020-9484\n   * SECURITY UPDATE: Fix for CVE-2020-9484 was incomplete\n     - debian/patches/CVE-2021-25329-pre1.patch: Fix some edge cases where\n       the docBase was not being set using a canonical path which in turn\n       meant resource URLs were not being constructed as expected.\n     - debian/patches/CVE-2021-25329.patch: Use java.nio.file.Path for\n       consistent sub-directory checking.\n     - CVE-2021-25329\n   * SECURITY UPDATE: Local Privilege Escalation\n     - debian/patches/CVE-2022-23181.patch: Make calculation of session\n       storage location more robust.\n     - CVE-2022-23181\n   * Update the expired test certificates:\n     - debian/test_certs/*.pem|*.jks: Take the last test certificates from\n       the upstream branch 8.5.x.\n     - debian/source/include-binaries: Specifying the binary *.jks files\n       to prevent build failures.\n     - debian/rules: Before the testing stage, the old certificates in the\n       source code are replaced with the new ones from debian/test_certs.","modified":"2026-06-04T10:04:13.558495556Z","published":"2023-08-03T17:24:42Z","upstream":["CVE-2020-9484","CVE-2021-25329","CVE-2022-23181"],"references":[{"type":"ADVISORY","url":"https://errata.cloudlinux.com/ubuntu18_04-els/CLSA-2023-1691083477"}],"affected":[{"package":{"name":"libtomcat8-embed-java","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libtomcat8-embed-java?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2023-1691083477.json"}},{"package":{"name":"libtomcat8-java","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libtomcat8-java?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2023-1691083477.json"}},{"package":{"name":"tomcat8","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat8?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2023-1691083477.json"}},{"package":{"name":"tomcat8-admin","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat8-admin?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2023-1691083477.json"}},{"package":{"name":"tomcat8-common","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat8-common?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2023-1691083477.json"}},{"package":{"name":"tomcat8-docs","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat8-docs?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2023-1691083477.json"}},{"package":{"name":"tomcat8-examples","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat8-examples?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2023-1691083477.json"}},{"package":{"name":"tomcat8-user","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/tomcat8-user?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2023-1691083477.json"}}],"schema_version":"1.7.5"}