CVE-2019-0221

NameCVE-2019-0221
DescriptionThe SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1810-1, DLA-1883-1
NVD severitymedium
Debian Bugs929895

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tomcat7 (PTS)jessie7.0.56-3+deb8u11vulnerable
jessie (security)7.0.56-3+really7.0.94-1fixed
stretch7.0.75-1vulnerable
tomcat8 (PTS)jessie8.0.14-1+deb8u11vulnerable
jessie (security)8.0.14-1+deb8u15fixed
stretch (security), stretch8.5.14-1+deb9u3vulnerable
tomcat9 (PTS)buster9.0.16-4fixed
bullseye, sid9.0.27-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tomcat7source(unstable)(unfixed)
tomcat7sourcejessie7.0.56-3+really7.0.94-1DLA-1810-1
tomcat8source(unstable)(unfixed)
tomcat8sourcejessie8.0.14-1+deb8u15DLA-1883-1
tomcat9source(unstable)9.0.16-4929895

Notes

affects debug channel, unlikely to be present in production websites:
https://mail-archives.apache.org/mod_mbox/www-announce/201905.mbox/%3Cb1905aa6-f340-8d0b-58c4-8ac3ebcbfa54@apache.org%3E
https://github.com/apache/tomcat/commit/15fcd16 (9.0.19)
https://github.com/apache/tomcat/commit/4fcdf70 (8.5.39)
https://github.com/apache/tomcat/commit/44ec74c (7.0.93)

Search for package or bug name: Reporting problems