The following flaw was found in Apache Tomcat: A bug in the error handling of the send file code for the NIO HTTP connector resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. Upstream patch: 6.x: http://svn.apache.org/viewvc?view=revision&revision=1777472 7.x: http://svn.apache.org/viewvc?view=revision&revision=1777471 8.0.x: http://svn.apache.org/viewvc?view=revision&revision=1777469 8.5.x: https://svn.apache.org/viewvc?view=revision&revision=1771857 9.x: https://svn.apache.org/viewvc?view=revision&revision=1771853
Created tomcat tracking bugs for this issue: Affects: fedora-all [bug 1403825]
External References: https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.9 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74 https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49
I've submitted an update for this on epel-6 already just a moment ago. I guess we should file a bug for it and add it to the update?
Created tomcat tracking bugs for this issue: Affects: epel-6 [bug 1424820]
(In reply to Coty Sutherland from comment #7) > I've submitted an update for this on epel-6 already just a moment ago. I > guess we should file a bug for it and add it to the update? Done, please use bug 1424820.
This issue has been addressed in the following products: Red Hat JBoss Web Server 3.1.0 Via RHSA-2017:0457 https://rhn.redhat.com/errata/RHSA-2017-0457.html
This issue has been addressed in the following products: Red Hat JBoss Web Server 3 for RHEL 7 Via RHSA-2017:0456 https://access.redhat.com/errata/RHSA-2017:0456
This issue has been addressed in the following products: Red Hat JBoss Web Server 3 for RHEL 6 Via RHSA-2017:0455 https://access.redhat.com/errata/RHSA-2017:0455
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2017:0527 https://rhn.redhat.com/errata/RHSA-2017-0527.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:0935 https://access.redhat.com/errata/RHSA-2017:0935
Created jbossweb tracking bugs for this issue: Affects: openshift-1 [bug 1470474]