AW: [EXTERNAL] Re: AW: Re: Why tomcat "Incorrect URL decoding in RewriteValve may allow security control bypass" is rated 'Low' on tomcat page but 'Critical' on NIST ?
"LAURIA Giuseppe via users" <[email protected]> Wed, 22 Jul 2026 14:12:54 +0000
| Newsgroups | gmane.comp.jakarta.tomcat.user |
|---|---|
| Message-ID | <DU7PR04MB11089EE8793013AC3D19F33AD83C12@DU7PR04MB11089.eurprd04.prod.outlook.com> |
VGhhbmsgeW91IHZlcnkgbXVjaCBNYXJrIHRvIHBvaW50IHRoYXQgb3V0Lg0KDQpCZXN0IHJlZ2Fy ZHMuDQpHaXVzZXBwZQ0KDQotLS0tLVVyc3Byw7xuZ2xpY2hlIE5hY2hyaWNodC0tLS0tDQpWb246 IE1hcmsgVGhvbWFzIDxtYXJrdEBhcGFjaGUub3JnPiANCkdlc2VuZGV0OiBEaWVuc3RhZywgMjEu IEp1bGkgMjAyNiAyMTowNA0KQW46IHVzZXJzQHRvbWNhdC5hcGFjaGUub3JnDQpCZXRyZWZmOiBb RVhURVJOQUxdIFJlOiBBVzogUmU6IFdoeSB0b21jYXQgIkluY29ycmVjdCBVUkwgZGVjb2Rpbmcg aW4gUmV3cml0ZVZhbHZlIG1heSBhbGxvdyBzZWN1cml0eSBjb250cm9sIGJ5cGFzcyIgaXMgcmF0 ZWQgJ0xvdycgb24gdG9tY2F0IHBhZ2UgYnV0ICdDcml0aWNhbCcgb24gTklTVCA/DQoNCk9uIDIx LzA3LzIwMjYgMTc6NTEsIExBVVJJQSBHaXVzZXBwZSB2aWEgdXNlcnMgd3JvdGU6DQo+IFRoYW5r IHlvdSB2ZXJ5IG11Y2ggVGltICENCj4gDQo+IFVuZm9ydHVuYXRlbHksIHRoaXMgaXMgd2h5IG91 ciBUb21jYXQgbm93IGVuZHMgdXAgb24gYSBzZWN1cml0eSBsaXN0IGFuZCBiZWNhdXNlIGl0IGlz IGNsYXNzaWZpZWQgYXMgQ3JpdGljYWwsIGl0IHNob3VsZCBiZSBzb2x2ZWQgd2l0aGluIGEgdmVy eSBzaG9ydCB0aW1lIGV2ZW4gdGhvdWdoIHdlIGFyZSBub3QgdXNpbmcgaXQuDQo+IEFuZCBJIGFz c3VtZSB0aGF0IHRoaXMgd2lsbCBub3QgZ2V0IGFueSBiZXR0ZXIgaW4gdGhlIGZ1dHVyZSwgYnV0 IHRoYXQgc3VjaCBjYXNlcyBhcmUgc3RpbGwgb2Z0ZW4gZGlzY292ZXJlZCB3aGljaCBkbyBub3Qg Y29uY2VybiB1cy4NCj4gDQo+IENvdWxkbuKAmXQgdGhlcmUgYmUgc29tZXRoaW5nIGJldHRlciBm cm9tIHRoZSBUb21jYXQgY29ybmVyPw0KDQpMaWtlIHdoYXQgZXhhY3RseT8gV2UgaGF2ZSBhbHJl YWR5IHJhdGVkIHRoaXMgaXNzdWUgYXMgbG93Lg0KDQpJZiB5b3UgaGF2ZSBpc3N1ZXMgd2l0aCB0 aGUgcHJvY2VzcyB5b3VyIGVtcGxveWVyIGlzIGZvbGxvd2luZyBmb3Igd2hlbiB0byBhcHBseSBz ZWN1cml0eSBmaXhlcyB0aGVuIHlvdSBuZWVkIHRvIHJhaXNlIHRob3NlIGlzc3VlcyB3aXRoIHlv dXIgZW1wbG95ZXIuIFdlIGNhbid0IHNvbHZlIHRoZW0gZm9yIHlvdS4NCg0KSWYgeW91LCBvciB5 b3VyIGVtcGxveWVyLCBoYXZlIGlzc3VlcyB3aXRoIE5JU1Qgb3ZlciBzdGF0aW5nIHRoZSBzZXZl cml0eSBvZiBhIENWRSB0aGVuIHRha2UgaXQgdXAgd2l0aCBOSVNULiBPciBjaG9vc2UgdG8gdXNl IGEgbW9yZSBhcHByb3ByaWF0ZSBpbmZvcm1hdGlvbiBzb3VyY2UgZm9yIHlvdXIgY2lyY3Vtc3Rh bmNlcy4gQWdhaW4sIHdlIGhhdmUgbm8gY29udHJvbCBvdmVyIHRoZSBkZWNpc2lvbnMgeW91IG1h a2UuDQoNCkFzIExMTXMgdW5jb3ZlciBtb3JlIGVkZ2UgY2FzZSBidWdzLCB0aGlzIHNjZW5hcmlv IGlzIG9ubHkgZ29pbmcgdG8gYmVjb21lIG1vcmUgZnJlcXVlbnQuIEl0IGl0IGlzIGNhdXNpbmcg eW91IGlzc3VlcyBub3csIEknZCBzdHJvbmdseSByZWNvbW1lbmQgdGFraW5nIHN0ZXBzIHRvIGFk ZHJlc3MgdGhvc2UgaXNzdWVzIHNvb25lciByYXRoZXIgdGhhbiBsYXRlci4NCg0KTWFyaw0KDQoN Cj4gDQo+IEJlc3QgcmVnYXJkcy4NCj4gR2l1c2VwcGUNCj4gDQo+IA0KPiAtLS0tLVVyc3Byw7xu Z2xpY2hlIE5hY2hyaWNodC0tLS0tDQo+IFZvbjogVGltIEZ1bmsgPGZ1bmttYW5AYXBhY2hlLm9y Zz4NCj4gR2VzZW5kZXQ6IERpZW5zdGFnLCAyMS4gSnVsaSAyMDI2IDE4OjQzDQo+IEFuOiBUb21j YXQgVXNlcnMgTGlzdCA8dXNlcnNAdG9tY2F0LmFwYWNoZS5vcmc+DQo+IEJldHJlZmY6IFtFWFRF Uk5BTF0gUmU6IFdoeSB0b21jYXQgIkluY29ycmVjdCBVUkwgZGVjb2RpbmcgaW4gUmV3cml0ZVZh bHZlIG1heSBhbGxvdyBzZWN1cml0eSBjb250cm9sIGJ5cGFzcyIgaXMgcmF0ZWQgJ0xvdycgb24g dG9tY2F0IHBhZ2UgYnV0ICdDcml0aWNhbCcgb24gTklTVCA/DQo+IA0KPiBUaGUgTklTVCBzY29y ZSBpcyBiYXNlZCBvbiBhIGZvcm11bGEgYmFzZWQgb24gdmFyaW91cyBmYWN0b3JzLiBXaGljaCBp cyBoZWF2aWx5IHdlaWdodGVkIHRvIGJlICdoaWdoIiBpbiBidWdzIGxpa2UgdGhpcy4NCj4gDQo+ IEhlcmUgaXRzIHJhdGVkIExPVyBiZWNhdXNlDQo+IC0gVGhlIFZhbHZlIG5lZWRzIGVuYWJsZWQg KGJ5IGRlZmF1bHQgbm90KQ0KPiAtIEFuZCB1c2VkIC8gY29uZmlndXJlZA0KPiAtIEFuZCAgY29u ZmlndXJlZCBpbiBhIHdheSB0aGF0IGFsbG93cyBleHBsb2l0DQo+IC0gQW5kIHVzZWQgaW4gYW4g YXBwIHRoYXQgaGFzIGluIGl0cyBhcHBsaWNhdGlvbiBwbGFuZSBzZWN1cml0eSANCj4gY29udHJv bHMgdGhhdCBjb3VsZCBiZSBieXBhc3NlZA0KPiANCj4gQUtBIC4uLiBBIG5vdCBub3JtYWwgY29t YmluYXRpb24gb2YgZmFjdG9ycy4NCj4gDQo+IC1UaW0NCj4gDQo+IE9uIFR1ZSwgSnVsIDIxLCAy MDI2IGF0IDEyOjE44oCvUE0gTEFVUklBIEdpdXNlcHBlIHZpYSB1c2VycyA8IHVzZXJzQHRvbWNh dC5hcGFjaGUub3JnPiB3cm90ZToNCj4gDQo+PiBIaSBUb21jYXQgdXNlcnMuDQo+Pg0KPj4NCj4+ DQo+PiBXZSBhcmUgdXNpbmcgVG9tY2F0IHY5LjAuMTE5IGFuZCBhcmUgbm93IGZvcmNlZCB0byBp bW1lZGlhdGVseSB1c2UNCj4+IHY5LjAuMTIwIGJlY2F1c2UgdGhlIOKAnCpJbmNvcnJlY3QgVVJM IGRlY29kaW5nIGluIFJld3JpdGVWYWx2ZSBtYXkgDQo+PiBhbGxvdyBzZWN1cml0eSBjb250cm9s IGJ5cGFzc+KAnSAqdnVsbmVyYWJpbGl0eSBpbiBUb21jYXQgaXMgcmF0ZWQgOS4xIA0KPj4gb24g TklTVCB3aGljaCBpcyBDUklUSUNBTC4gLT4NCj4+IGh0dHBzOi8vdXJsZGVmZW5zZS5jb20vdjMv X19odHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtMjAyNg0KPj4gLSANCj4+IDU5 MDgzX187ISFCbmtWOXBkaDVWMCFCQ281REtDTzdZX296aGRxTC1Hb1BDeW43TGdWOUZxbHF1S19Y R1pfYmNqTUZoTw0KPj4gTCBjTjNHQUdNdnBBcC1LRVphMDRoTmRPUVJDUTJVcFN6djFvbTAkDQo+ Pg0KPj4NCj4+DQo+PiBCdXQgb24gdGhlIFRvbWNhdCBzZWN1cml0eSBwYWdlIHRoaXMgdnVsbmVy YWJpbGl0eSBpcyByYXRlZCDigJhMT1figJkuDQo+Pg0KPj4gaHR0cHM6Ly91cmxkZWZlbnNlLmNv bS92My9fX2h0dHBzOi8vdG9tY2F0LmFwYWNoZS5vcmcvc2VjdXJpdHktOS5odG1sDQo+PiBfIA0K Pj4gXzshIUJua1Y5cGRoNVYwIUJDbzVES0NPN1lfb3poZHFMLUdvUEN5bjdMZ1Y5RnFscXVLX1hH Wl9iY2pNRmhPTGNOM0dBDQo+PiBHDQo+PiBNdnBBcC1LRVphMDRoTmRPUVJDUTJVcGNuR1NRdzYk DQo+Pg0KPj4NCj4+IFdobyBpcyB3cm9uZyA/DQo+Pg0KPj4NCj4+DQo+Pg0KPj4NCj4+IFdlIGFy ZSBub3QgdXNpbmcg4oCccmV3cml0ZSBWYWx2ZeKAnSBhbmQgdGhlcmVmb3JlIHRoaW5rIHdlIGFy ZSBub3QgYWZmZWN0ZWQuDQo+Pg0KPj4gV2h5IHRoZXJlIGlzIG5vIGRldGFpbGVkIGV4cGxhbmF0 aW9uIG9uIHRoZSBOSVNUIHBhZ2UgdGhhdCBvbmx5IA0KPj4gVG9tY2F0IHVzZXJzICp1c2luZyBy ZXdyaXRlIFZhbHZlKiBhcmUgYWZmZWN0ZWQgPw0KPj4NCj4+DQo+Pg0KPiANCj4gLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tDQo+IFRvIHVuc3Vic2NyaWJlLCBlLW1haWw6IHVzZXJzLXVuc3Vic2NyaWJlQHRvbWNhdC5h cGFjaGUub3JnDQo+IEZvciBhZGRpdGlvbmFsIGNvbW1hbmRzLCBlLW1haWw6IHVzZXJzLWhlbHBA dG9tY2F0LmFwYWNoZS5vcmcNCj4gDQoNCg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpUbyB1bnN1YnNjcmliZSwg ZS1tYWlsOiB1c2Vycy11bnN1YnNjcmliZUB0b21jYXQuYXBhY2hlLm9yZw0KRm9yIGFkZGl0aW9u YWwgY29tbWFuZHMsIGUtbWFpbDogdXNlcnMtaGVscEB0b21jYXQuYXBhY2hlLm9yZw0K DQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0NClRvIHVuc3Vic2NyaWJlLCBlLW1haWw6IHVzZXJzLXVuc3Vi c2NyaWJlQHRvbWNhdC5hcGFjaGUub3JnDQpGb3IgYWRkaXRpb25hbCBjb21tYW5kcywgZS1t YWlsOiB1c2Vycy1oZWxwQHRvbWNhdC5hcGFjaGUub3JnDQoN