[GHSA-cw54-59pw-4g8c] Apache Tomcat Improper Access Control vulnerability

[westonsteimel]

Updates

• Affected products

Comments
Looking at the commits (such as apache/tomcat@7e3a037), the affected component is org.apache.catalina.mbeans which is bundled into the maven artifacts org.apache.tomcat:tomcat-catalina and org.apache.tomcat.embed:tomcat-embed-core per https://github.com/search?q=repo%3Aapache%2Ftomcat+catalina.mbeans+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=code

[advisory-database]

Hi @westonsteimel! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[westonsteimel]

Hmm, this merged change seems not to be reflected yet in the advisory record for GHSA-cw54-59pw-4g8c

[westonsteimel]

@darakian do you happen to have any ideas why this change doesn't seem to be making it into the published advisory record GHSA-cw54-59pw-4g8c? It appears to have merged correctly into the repo https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cw54-59pw-4g8c/GHSA-cw54-59pw-4g8c.json

[darakian]

Looks like we had some sort of bug in the publication pipe. I kicked it and we're updated now 👍

[westonsteimel]

Thank you!