CVE-2022-45143 is a high-severity vulnerability affecting the JsonErrorReportValve in Apache Tomcat, a widely used web server software. This vulnerability allows users to potentially manipulate or invalidate JSON output in certain circumstances, impacting systems running specific versions of Apache Tomcat. To address this issue, users are advised to upgrade their Apache Tomcat software to a more secure version.

How do I know if I'm affected?

If you're using Apache Tomcat, you might be affected by the CVE-2022-45143 vulnerability. The impacted versions include 8.5.83, 9.0.40 to 9.0.68, and 10.1.0-M1 to 10.1.1. This issue occurs when the JsonErrorReportValve doesn't properly escape certain values, potentially allowing users to manipulate or invalidate JSON output. To determine if you're affected, check your Apache Tomcat version and see if it falls within the mentioned ranges.

What should I do if I'm affected?

If you're affected by this vulnerability, it's crucial to upgrade your Apache Tomcat software. Follow these steps: for version 10.1.x, upgrade to 10.1.2 or later; for version 9.0.x, upgrade to 9.0.69 or later; and for version 8.5.x, upgrade to 8.5.84 or later. This will help secure your system against potential JSON output manipulation.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-45143 vulnerability, related to the JsonErrorReportValve in Apache Tomcat, is not listed in CISA's Known Exploited Vulnerabilities Catalog. This issue can potentially allow users to manipulate or invalidate JSON output in certain circumstances.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-116 involves improper encoding or escaping of output in Apache Tomcat's JsonErrorReportValve, which can lead to JSON output manipulation.

For more details

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and affected software configurations, refer to the NVD page or the resources listed below.

• Apache Mail Archives Security Advisory

• Gentoo Security Advisory