[GHSA-53hp-jpwq-2jgq] Uncontrolled Resource Consumption in Apache Tomcat#8736
[GHSA-53hp-jpwq-2jgq] Uncontrolled Resource Consumption in Apache Tomcat#8736yusuke-koyoshi wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates the OSV advisory for GHSA-53hp-jpwq-2jgq (CVE-2020-11996) to reflect corrected fixed versions across Tomcat release trains and to add coverage for an additional Maven artifact.
Changes:
- Updated fixed versions for Tomcat 10.0.0-M*, 9.0.x, and 8.5.x release lines
- Adjusted
last_known_affected_version_rangefor the Tomcat 10.0.0-M* line - Added new
affectedentries fororg.apache.tomcat:tomcat-coyote
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| { | ||
| "package": { | ||
| "ecosystem": "Maven", | ||
| "name": "org.apache.tomcat:tomcat-coyote" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "10.0.0-M1" | ||
| }, | ||
| { | ||
| "fixed": "10.0.0-M6" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "last_known_affected_version_range": "<= 10.0.0-M5" | ||
| } | ||
| }, | ||
| { | ||
| "package": { | ||
| "ecosystem": "Maven", | ||
| "name": "org.apache.tomcat:tomcat-coyote" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "9.0.0.M1" | ||
| }, | ||
| { | ||
| "fixed": "9.0.36" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "package": { | ||
| "ecosystem": "Maven", | ||
| "name": "org.apache.tomcat:tomcat-coyote" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "8.5.0" | ||
| }, | ||
| { | ||
| "fixed": "8.5.56" |
There was a problem hiding this comment.
While the OSV schema does allow multiple ranges in a single affected object, the established convention in this repository — and specifically in this advisory file — is to use one affected entry per version range for Maven packages.
The existing entries for org.apache.tomcat:tomcat and org.apache.tomcat.embed:tomcat-embed-core in this same file are each split into three separate affected entries (one per Tomcat train: 8.5, 9.x, 10.x). The new org.apache.tomcat:tomcat-coyote entries in this PR follow that same pattern intentionally, to keep the file internally consistent.
Consolidating only tomcat-coyote would introduce a stylistic inconsistency with the two other affected packages in the same advisory. I'd prefer to keep the current structure unless the maintainers would like all three packages restructured together in a separate change.
Updates
Comments
org.apache.tomcat:tomcat-coyote should be listed as an affected package for this advisory, but it is currently missing.
A prior PR #7655 was explicitly described as "Add org.apache.tomcat:tomcat-coyote as an affected Maven package across the impacted Tomcat version ranges", and the PR was reviewed and merged on that basis. However, for reasons that are not clear from the PR history, the final merged change to
advisories/github-reviewed/2022/02/GHSA-53hp-jpwq-2jgq/GHSA-53hp-jpwq-2jgq.jsononly added org.apache.tomcat.embed:tomcat-embed-core — the org.apache.tomcat:tomcat-coyote entry never actually made it into the advisory. The advisory today still lists only org.apache.tomcat:tomcat and org.apache.tomcat.embed:tomcat-embed-core.Corrects the
fixedvalue on every affected package (org.apache.tomcat:tomcat,org.apache.tomcat.embed:tomcat-embed-core, and the newly addedorg.apache.tomcat:tomcat-coyote) to the first patched release per the Apache advisories:introduced: 8.5.0,fixed: 8.5.56,last_known_affected_version_range: < 8.5.56introduced: 9.0.0.M1,fixed: 9.0.36,last_known_affected_version_range: < 9.0.36introduced: 10.0.0-M1,fixed: 10.0.0-M6,last_known_affected_version_range: <= 10.0.0-M5https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html
https://tomcat.apache.org/security-10.html