CVE-2019-0221

NameCVE-2019-0221
DescriptionThe SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1810-1, DLA-1883-1, DSA-4596-1
NVD severitymedium
Debian Bugs929895

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tomcat7 (PTS)stretch7.0.75-1vulnerable
tomcat8 (PTS)stretch8.5.54-0+deb9u1fixed
stretch (security)8.5.54-0+deb9u3fixed
tomcat9 (PTS)buster, buster (security)9.0.31-1~deb10u2fixed
bullseye, sid9.0.37-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tomcat7sourcejessie7.0.56-3+really7.0.94-1DLA-1810-1
tomcat7source(unstable)(unfixed)
tomcat8sourcejessie8.0.14-1+deb8u15DLA-1883-1
tomcat8sourcestretch8.5.50-0+deb9u1DSA-4596-1
tomcat8source(unstable)(unfixed)
tomcat9source(unstable)9.0.16-4929895

Notes

affects debug channel, unlikely to be present in production websites:
https://mail-archives.apache.org/mod_mbox/www-announce/201905.mbox/%3Cb1905aa6-f340-8d0b-58c4-8ac3ebcbfa54@apache.org%3E
https://github.com/apache/tomcat/commit/15fcd16 (9.0.19)
https://github.com/apache/tomcat/commit/4fcdf70 (8.5.39)
https://github.com/apache/tomcat/commit/44ec74c (7.0.93)

Search for package or bug name: Reporting problems