Linux · Security advisory · February 17, 2023
ALAS2023-2023-059: Security update for 8 packages
ALAS2023-2023-059, released February 17, 2023, fixes 2 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
2
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.7467
99th percentile
Priority of the 2 CVEs
Patch now 0
Urgent 0
High 1
Routine 1
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| tomcat9 | amzn 2023 | 1:9.0.64-1.amzn2023.0.2 |
| tomcat9-admin-webapps | amzn 2023 | 1:9.0.64-1.amzn2023.0.2 |
| tomcat9-docs-webapp | amzn 2023 | 1:9.0.64-1.amzn2023.0.2 |
| tomcat9-el-3.0-api | amzn 2023 | 1:9.0.64-1.amzn2023.0.2 |
| tomcat9-jsp-2.3-api | amzn 2023 | 1:9.0.64-1.amzn2023.0.2 |
| tomcat9-lib | amzn 2023 | 1:9.0.64-1.amzn2023.0.2 |
| tomcat9-servlet-4.0-api | amzn 2023 | 1:9.0.64-1.amzn2023.0.2 |
| tomcat9-webapps | amzn 2023 | 1:9.0.64-1.amzn2023.0.2 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2022-23181 | libtomcat9-embed-java: The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 1... | 7.0 | 0.0069 | None reported | |
| Routine | CVE-2021-33037 | tomcat9-docs: Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-e... | n/a | 0.7467 | None reported |
Showing 1 to 2 of 2
1