Bug 1607582 (CVE-2018-8037)

Summary:	CVE-2018-8037 tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, alazarot, alee, anstephe, avibelli, bgeorges, bmaxwell, cdewolf, chazlett, chris.snell, cmoulliard, coolsvap, csutherl, darran.lofthouse, dimitris, dosoudil, drieden, etirelli, fgavrilo, gvarsami, gzaronik, hhorak, ibek, ikanello, ivan.afonichev, java-sig-commits, jawilson, jbalunas, jclere, jcoleman, jdoyle, jolee, jondruse, jorton, jpallich, jschatte, jshepherd, jstastny, kconner, krathod, krzysztof.daniel, ksuzumur, kverlaen, ldimaggi, lgao, loleary, lpetrovi, lthon, mbabacek, mizdebsk, mszynkie, myarboro, ninsho-dav-help, nwallace, paradhya, pgallagh, pgier, ppalaga, psakar, pslavice, rhcs-maint, rnetuka, rrajasek, rruss, rstancel, rsvoboda, rsynek, rwagner, rzhang, sdaley, spinder, sstavrev, tcunning, theute, tkirby, trogers, twalsh, vhalbert, vtunka, weli, yozone, zmiele
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	tomcat 8.5.32, tomcat 9.0.10, tomcat 7.0.87	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-07-12 13:05:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1607584, 1607585, 1608603, 1608604, 1614557, 1614558, 1619232, 1711335
Bug Blocks:	1607593

Description Pedro Sampaio 2018-07-23 19:23:07 UTC

Flaw affecting tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31. A bug in the tracking of connection closures can lead to reuse of user sessions in a new connection.

Upstream patch:

http://svn.apache.org/viewvc?view=rev&rev=1833906
http://svn.apache.org/viewvc?view=rev&rev=1833907

References:

https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html

Comment 1 Pedro Sampaio 2018-07-23 19:24:23 UTC

Created tomcat tracking bugs for this issue:

Affects: epel-all [bug 1607585]
Affects: fedora-all [bug 1607584]

Comment 5 Takeshi Nishimura 2018-07-26 08:16:49 UTC

I found no evidence that CVE-2018-8037 is fixed in tomcat 7.0.87.

Comment 8 Timothy Walsh 2018-08-20 10:26:29 UTC

Review of JWS 3.1 indicates that versions of Tomcat used in that release are not affected.

Comment 9 Timothy Walsh 2018-08-20 10:36:32 UTC

Red Hat Enterprise Linux 7 supports Tomcat 7 (7.0.76) which is not affected by this flaw.

Comment 11 errata-xmlrpc 2018-10-03 13:42:57 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2018:2867 https://access.redhat.com/errata/RHSA-2018:2867

Comment 12 errata-xmlrpc 2018-10-03 13:53:46 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 5.0 on RHEL 7
  Red Hat JBoss Web Server 5.0 on RHEL 6

Via RHSA-2018:2868 https://access.redhat.com/errata/RHSA-2018:2868

Comment 15 errata-xmlrpc 2019-06-18 17:20:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1529 https://access.redhat.com/errata/RHSA-2019:1529

Comment 16 Product Security DevOps Team 2019-07-12 13:05:50 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-8037