CVE-2016-0762 — Observable Discrepancy in Apache Tomcat

Description

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Tomcat	9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 8	tomcat7	7.0.56-3+deb8u5	DSA-3721-1
Debian 8	tomcat8	8.0.14-1+deb8u4	DSA-3720-1
Debian 7	tomcat6	6.0.45+dfsg-1~deb7u3	DLA-728-1
Debian 7	tomcat7	7.0.28-4+deb7u7	DLA-729-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	tomcat6	6.0.45+dfsg-1ubuntu0.1	USN-4557-1
Ubuntu 16.04 LTS	tomcat7	7.0.68-1ubuntu0.3	—
Ubuntu 16.04 LTS	tomcat8	8.0.32-1ubuntu1.3	USN-3177-1
Ubuntu 14.04 LTS	tomcat6	6.0.39-1ubuntu0.1	—
Ubuntu 14.04 LTS	tomcat7	7.0.52-1ubuntu0.8	USN-3177-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 7	tomcat +9	7.0.76-2.el7	RHSA-2017:2247

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 3	hibernate4-eap6 +4	4.2.23-1.Final_redhat_1.1.ep6.el6	RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3	jbcs-httpd24-apache-commons-daemon	1.0.15-1.redhat_2.1.jbcs.el6	RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3	jbcs-httpd24-apache-commons-daemon-jsvc	1:1.0.15-17.redhat_2.jbcs.el6	RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3	jbcs-httpd24-runtime	1-3.jbcs.el6	RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3	mod_cluster +2	1.3.5-2.Final_redhat_2.1.ep7.el6	RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3	tomcat-native	1.2.8-9.redhat_9.ep7.el6	RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3	tomcat-vault	1.0.8-9.Final_redhat_2.1.ep7.el6	RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3	tomcat7 +11	7.0.70-16.ep7.el6	RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3	tomcat8 +11	8.0.36-17.ep7.el6	RHSA-2017:0456, RHSA-2017:0455

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 12 SP2	tomcat	8.0.36-17.1	SUSE-SU-2016:3081-1
SLES 12 SP1	tomcat	8.0.32-10.13.2	SUSE-SU-2016:3079-1
SLES 12	tomcat	7.0.78-7.13.4	SUSE-SU-2017:1660-1
SLES 11 SP4	tomcat6	6.0.53-0.56.1	SUSE-SU-2017:1632-1
SLES 11 SP3	tomcat6	6.0.53-0.56.1	SUSE-SU-2017:1632-1

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12 SP2	tomcat	8.0.36-17.1	SUSE-SU-2016:3081-1
SLES for SAP 12 SP1	tomcat	8.0.32-10.13.2	SUSE-SU-2016:3079-1
SLES for SAP 12	tomcat	7.0.78-7.13.4	SUSE-SU-2017:1660-1
SLES for SAP 11 SP4	tomcat6	6.0.53-0.56.1	SUSE-SU-2017:1632-1
SUSE Linux Enterprise Point of Sale 11 SP3	tomcat6	6.0.53-0.56.1	SUSE-SU-2017:1632-1

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 7	tomcat +9	7.0.76-2.el7	ELSA-2017-2247

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat:tomcat	>= 9.0.0M1, < 9.0.0.M10	9.0.0.M10	GHSA-wxcp-f2c8-x6xv
Maven	org.apache.tomcat:tomcat	>= 8.5.0, < 8.5.5	8.5.5	GHSA-wxcp-f2c8-x6xv
Maven	org.apache.tomcat:tomcat	>= 8.0.0.RC1, < 8.0.37	8.0.37	GHSA-wxcp-f2c8-x6xv
Maven	org.apache.tomcat:tomcat	>= 7.0.0, < 7.0.72	7.0.72	GHSA-wxcp-f2c8-x6xv
Maven	org.apache.tomcat:tomcat	>= 6.0.0, < 6.0.46	6.0.46	GHSA-wxcp-f2c8-x6xv

Advisories 14

RHSA-2017:0456 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update Red Hat Security Advisories (RHSA) · Oct 8, 2026
RHSA-2017:0455 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 security and enhancement update Red Hat Security Advisories (RHSA) · Oct 8, 2026
RHSA-2017:2247 Red Hat Security Advisory: tomcat security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
USN-4557-1 tomcat6 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
USN-3177-1 tomcat6, tomcat7, tomcat8 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
DLA-729-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-728-1 tomcat6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DSA-3720-1 tomcat8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DSA-3721-1 tomcat7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2016:3079-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2017:1632-1 Security update for tomcat6 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2017:1660-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2016:3081-1 Security update for tomcat SUSE / openSUSE Security Updates · May 2, 2025
ELSA-2017-2247 Low: tomcat security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 7, 2017

References

1037144 vdb-entry
[announce] 20161027 [SECURITY] CVE-2016-0762 Apache Tomcat Realm Timing Attack mailing-list
RHSA-2017:2247 vendor-advisory
RHSA-2017:0457 vendor-advisory
RHSA-2017:0455 vendor-advisory
93939 vdb-entry
DSA-3720 vendor-advisory
RHSA-2017:0456 vendor-advisory
[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ mailing-list
USN-4557-1 vendor-advisory
https://www.oracle.com//security-alerts/cpujul2021.html
https://security.netapp.com/advisory/ntap-20180605-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html