Bug 1607582 (CVE-2018-8037)

Summary: CVE-2018-8037 tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aileenc, alazarot, alee, anstephe, avibelli, bgeorges, bmaxwell, cdewolf, chazlett, chris.snell, cmoulliard, coolsvap, csutherl, darran.lofthouse, dimitris, dosoudil, drieden, etirelli, fgavrilo, gvarsami, gzaronik, hhorak, ibek, ikanello, ivan.afonichev, java-sig-commits, jawilson, jbalunas, jclere, jcoleman, jdoyle, jolee, jondruse, jorton, jpallich, jschatte, jshepherd, jstastny, kconner, krathod, krzysztof.daniel, ksuzumur, kverlaen, ldimaggi, lgao, loleary, lpetrovi, lthon, mbabacek, mizdebsk, mszynkie, myarboro, ninsho-dav-help, nwallace, paradhya, pgallagh, pgier, ppalaga, psakar, pslavice, rhcs-maint, rnetuka, rrajasek, rruss, rstancel, rsvoboda, rsynek, rwagner, rzhang, sdaley, spinder, sstavrev, tcunning, theute, tkirby, trogers, twalsh, vhalbert, vtunka, weli, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: tomcat 8.5.32, tomcat 9.0.10, tomcat 7.0.87 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-12 13:05:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1607584, 1607585, 1608603, 1608604, 1614557, 1614558, 1619232, 1711335    
Bug Blocks: 1607593    

Description Pedro Sampaio 2018-07-23 19:23:07 UTC
Flaw affecting tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31. A bug in the tracking of connection closures can lead to reuse of user sessions in a new connection.

Upstream patch:

http://svn.apache.org/viewvc?view=rev&rev=1833906
http://svn.apache.org/viewvc?view=rev&rev=1833907

References:

https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html

Comment 1 Pedro Sampaio 2018-07-23 19:24:23 UTC
Created tomcat tracking bugs for this issue:

Affects: epel-all [bug 1607585]
Affects: fedora-all [bug 1607584]

Comment 5 Takeshi Nishimura 2018-07-26 08:16:49 UTC
I found no evidence that CVE-2018-8037 is fixed in tomcat 7.0.87.

Comment 8 Timothy Walsh 2018-08-20 10:26:29 UTC
Review of JWS 3.1 indicates that versions of Tomcat used in that release are not affected.

Comment 9 Timothy Walsh 2018-08-20 10:36:32 UTC
Red Hat Enterprise Linux 7 supports Tomcat 7 (7.0.76) which is not affected by this flaw.

Comment 11 errata-xmlrpc 2018-10-03 13:42:57 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2018:2867 https://access.redhat.com/errata/RHSA-2018:2867

Comment 12 errata-xmlrpc 2018-10-03 13:53:46 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 5.0 on RHEL 7
  Red Hat JBoss Web Server 5.0 on RHEL 6

Via RHSA-2018:2868 https://access.redhat.com/errata/RHSA-2018:2868

Comment 15 errata-xmlrpc 2019-06-18 17:20:55 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1529 https://access.redhat.com/errata/RHSA-2019:1529

Comment 16 Product Security DevOps Team 2019-07-12 13:05:50 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-8037