Skip to content
OpenAdvisories
High · 7.5 CVE-2016-8745 EUVD-2022-5479GHSA-w3j5-q8f2-3cqq

Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat

Published Aug 10, 2017 · Updated Nov 14, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat-util Package: tomcat6 Package: tomcat7 Package: tomcat8 Ecosystem: Maven Ecosystem: Ubuntu

Description

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73, 6.0.16 to 6.0.48 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 8 tomcat7 7.0.56-3+deb8u7 DSA-3754-1
Debian 8 tomcat8 8.0.14-1+deb8u6 DSA-3755-1
Debian 7 tomcat7 7.0.28-4+deb7u9 DLA-779-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS tomcat7 7.0.68-1ubuntu0.3 —
Ubuntu 16.04 LTS tomcat8 8.0.32-1ubuntu1.3 USN-3177-1
Ubuntu 14.04 LTS tomcat7 7.0.52-1ubuntu0.8 USN-3177-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS tomcat6 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 tomcat +9 7.0.69-11.el7_3 RHSA-2017:0935
RHEL 6 tomcat6 +8 6.0.24-105.el6_8 RHSA-2017:0527
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat JBoss Web Server 3 hibernate4-eap6 +4 4.2.23-1.Final_redhat_1.1.ep6.el6 RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3 jbcs-httpd24-apache-commons-daemon 1.0.15-1.redhat_2.1.jbcs.el6 RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3 jbcs-httpd24-apache-commons-daemon-jsvc 1:1.0.15-17.redhat_2.jbcs.el6 RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3 jbcs-httpd24-runtime 1-3.jbcs.el6 RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3 mod_cluster +2 1.3.5-2.Final_redhat_2.1.ep7.el6 RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3 tomcat-native 1.2.8-9.redhat_9.ep7.el6 RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3 tomcat-vault 1.0.8-9.Final_redhat_2.1.ep7.el6 RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3 tomcat7 +11 7.0.70-16.ep7.el6 RHSA-2017:0456, RHSA-2017:0455
Red Hat JBoss Web Server 3 tomcat8 +11 8.0.36-17.ep7.el6 RHSA-2017:0456, RHSA-2017:0455

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP2 tomcat 8.0.43-23.1 SUSE-SU-2017:1229-1
SLES 12 SP1 tomcat 8.0.43-10.19.1 SUSE-SU-2017:1382-1
SLES 12 tomcat 7.0.78-7.13.4 SUSE-SU-2017:1660-1
SLES 11 SP4 tomcat6 6.0.53-0.56.1 SUSE-SU-2017:1632-1
SLES 11 SP3 tomcat6 6.0.53-0.56.1 SUSE-SU-2017:1632-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP2 tomcat 8.0.43-23.1 SUSE-SU-2017:1229-1
SLES for SAP 12 SP1 tomcat 8.0.43-10.19.1 SUSE-SU-2017:1382-1
SLES for SAP 12 tomcat 7.0.78-7.13.4 SUSE-SU-2017:1660-1
SLES for SAP 11 SP4 tomcat6 6.0.53-0.56.1 SUSE-SU-2017:1632-1
SUSE Linux Enterprise Point of Sale 11 SP3 tomcat6 6.0.53-0.56.1 SUSE-SU-2017:1632-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.36-8.4 openSUSE-SU-2024:11468-1
openSUSE Tumbleweed tomcat10 10.1.14-1.1 openSUSE-SU-2024:13441-1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat-util >= 9.0.0.M1, < 9.0.0.M14 9.0.0.M14 GHSA-w3j5-q8f2-3cqq
Maven org.apache.tomcat:tomcat-util >= 8.5.0, < 8.5.9 8.5.9 GHSA-w3j5-q8f2-3cqq
Maven org.apache.tomcat:tomcat-util >= 8.0.0-RC1, < 8.0.41 8.0.41 GHSA-w3j5-q8f2-3cqq
Maven org.apache.tomcat:tomcat-util >= 7.0.0, < 7.0.75 7.0.75 GHSA-w3j5-q8f2-3cqq
Maven org.apache.tomcat:tomcat-util >= 6.0.16, < 6.0.50 6.0.50 GHSA-w3j5-q8f2-3cqq

Advisories 16

References