Bug 1403824 (CVE-2016-8745) - CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing
Summary: CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-8745
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1403825 1413588 1413589 1413591 1413592 1424820 1470474
Blocks: 1403827 1428325
TreeView+ depends on / blocked
 
Reported: 2016-12-12 12:42 UTC by Martin Prpič
Modified: 2021-02-17 02:53 UTC (History)
78 users (show)

Fixed In Version: tomcat 8.5.9, tomcat 9.0.0.M15, tomcat 6.0.50, tomcat 7.0.75, tomcat 8.0.41
Doc Type: If docs needed, set a value
Doc Text:
A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:04:10 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:0455 0 normal SHIPPED_LIVE Important: Red Hat JBoss Web Server 3.1.0 security and enhancement update 2017-03-08 00:06:40 UTC
Red Hat Product Errata RHSA-2017:0456 0 normal SHIPPED_LIVE Important: Red Hat JBoss Web Server 3.1.0 security and enhancement update 2017-03-08 00:06:06 UTC
Red Hat Product Errata RHSA-2017:0457 0 normal SHIPPED_LIVE Important: Red Hat JBoss Web Server security and enhancement update 2017-03-08 00:05:59 UTC
Red Hat Product Errata RHSA-2017:0527 0 normal SHIPPED_LIVE Moderate: tomcat6 security update 2017-03-15 17:01:42 UTC
Red Hat Product Errata RHSA-2017:0935 0 normal SHIPPED_LIVE Moderate: tomcat security update 2017-04-12 19:02:18 UTC

Description Martin Prpič 2016-12-12 12:42:45 UTC
The following flaw was found in Apache Tomcat:

A bug in the error handling of the send file code for the NIO HTTP connector resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body.

Upstream patch:
6.x: http://svn.apache.org/viewvc?view=revision&revision=1777472
7.x: http://svn.apache.org/viewvc?view=revision&revision=1777471
8.0.x: http://svn.apache.org/viewvc?view=revision&revision=1777469
8.5.x: https://svn.apache.org/viewvc?view=revision&revision=1771857
9.x: https://svn.apache.org/viewvc?view=revision&revision=1771853

Comment 1 Martin Prpič 2016-12-12 12:45:00 UTC
Created tomcat tracking bugs for this issue:

Affects: fedora-all [bug 1403825]

Comment 7 Coty Sutherland 2017-02-17 20:33:40 UTC
I've submitted an update for this on epel-6 already just a moment ago. I guess we should file a bug for it and add it to the update?

Comment 8 Martin Prpič 2017-02-19 16:49:40 UTC
Created tomcat tracking bugs for this issue:

Affects: epel-6 [bug 1424820]

Comment 9 Martin Prpič 2017-02-19 16:50:42 UTC
(In reply to Coty Sutherland from comment #7)
> I've submitted an update for this on epel-6 already just a moment ago. I
> guess we should file a bug for it and add it to the update?

Done, please use bug 1424820.

Comment 10 errata-xmlrpc 2017-03-07 19:11:20 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3.1.0

Via RHSA-2017:0457 https://rhn.redhat.com/errata/RHSA-2017-0457.html

Comment 11 errata-xmlrpc 2017-03-07 19:15:50 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3 for RHEL 7

Via RHSA-2017:0456 https://access.redhat.com/errata/RHSA-2017:0456

Comment 12 errata-xmlrpc 2017-03-07 19:20:21 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 3 for RHEL 6

Via RHSA-2017:0455 https://access.redhat.com/errata/RHSA-2017:0455

Comment 13 errata-xmlrpc 2017-03-15 13:03:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0527 https://rhn.redhat.com/errata/RHSA-2017-0527.html

Comment 14 errata-xmlrpc 2017-04-12 15:05:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:0935 https://access.redhat.com/errata/RHSA-2017:0935

Comment 16 Kurt Seifried 2017-07-13 02:09:37 UTC
Created jbossweb tracking bugs for this issue:

Affects: openshift-1 [bug 1470474]


Note You need to log in before you can comment on or make changes to this bug.