ID CVE-2016-8745
Summary A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.
References
Vulnerable Configurations
  • cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.53:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.54:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.55:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.56:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.57:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.58:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.58:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.59:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.60:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.60:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.61:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.62:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.63:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.64:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.65:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.66:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.66:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.67:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.68:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.68:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.69:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.69:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.70:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.70:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.71:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.71:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.72:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.72:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:7.0.73:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:7.0.73:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.0:rc3:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.16:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.16:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.18:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.19:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.19:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.20:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.21:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.22:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.24:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.25:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.25:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.26:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.27:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.28:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.29:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.30:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.30:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.31:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.31:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.32:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.32:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.33:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.33:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.34:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.34:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.35:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.35:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.36:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.36:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.37:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.37:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.38:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.38:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.0.39:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.0.39:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m10:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m10:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m11:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m11:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m12:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m12:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m13:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m13:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m2:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m2:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m3:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m3:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m4:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m4:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m5:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m5:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m6:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m6:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m7:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m7:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m8:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m8:*:*:*:*:*:*
  • cpe:2.3:a:apache:tomcat:9.0.0:m9:*:*:*:*:*:*
    cpe:2.3:a:apache:tomcat:9.0.0:m9:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 15-04-2019 - 16:30)
Impact:
Exploitability:
CWE CWE-388
CAPEC
  • Fuzzing for garnering J2EE/.NET-based stack traces, for application mapping
    An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The stack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.
  • Fuzzing
    Fuzzing is a software testing method that feeds randomly constructed input to the system and looks for an indication that a failure in response to that input has occurred. Fuzzing treats the system as a black box and is totally free from any preconceptions or assumptions about the system. An attacker can leverage fuzzing to try to identify weaknesses in the system. For instance fuzzing can help an attacker discover certain assumptions made in the system about user input. Fuzzing gives an attacker a quick way of potentially uncovering some of these assumptions without really knowing anything about the internals of the system. These assumptions can then be turned against the system by specially crafting user input that may allow an attacker to achieve his goals.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
redhat via4
advisories
  • bugzilla
    id 1403824
    title CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhba:tst:20111656001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhba:tst:20111656002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20111656004
    • OR
      • AND
        • comment tomcat6 is earlier than 0:6.0.24-105.el6_8
          oval oval:com.redhat.rhsa:tst:20170527005
        • comment tomcat6 is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110335006
      • AND
        • comment tomcat6-admin-webapps is earlier than 0:6.0.24-105.el6_8
          oval oval:com.redhat.rhsa:tst:20170527021
        • comment tomcat6-admin-webapps is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110335022
      • AND
        • comment tomcat6-docs-webapp is earlier than 0:6.0.24-105.el6_8
          oval oval:com.redhat.rhsa:tst:20170527019
        • comment tomcat6-docs-webapp is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110335020
      • AND
        • comment tomcat6-el-2.1-api is earlier than 0:6.0.24-105.el6_8
          oval oval:com.redhat.rhsa:tst:20170527017
        • comment tomcat6-el-2.1-api is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110335024
      • AND
        • comment tomcat6-javadoc is earlier than 0:6.0.24-105.el6_8
          oval oval:com.redhat.rhsa:tst:20170527011
        • comment tomcat6-javadoc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110335012
      • AND
        • comment tomcat6-jsp-2.1-api is earlier than 0:6.0.24-105.el6_8
          oval oval:com.redhat.rhsa:tst:20170527007
        • comment tomcat6-jsp-2.1-api is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110335008
      • AND
        • comment tomcat6-lib is earlier than 0:6.0.24-105.el6_8
          oval oval:com.redhat.rhsa:tst:20170527013
        • comment tomcat6-lib is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110335018
      • AND
        • comment tomcat6-servlet-2.5-api is earlier than 0:6.0.24-105.el6_8
          oval oval:com.redhat.rhsa:tst:20170527009
        • comment tomcat6-servlet-2.5-api is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110335010
      • AND
        • comment tomcat6-webapps is earlier than 0:6.0.24-105.el6_8
          oval oval:com.redhat.rhsa:tst:20170527015
        • comment tomcat6-webapps is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110335014
    rhsa
    id RHSA-2017:0527
    released 2017-03-15
    severity Moderate
    title RHSA-2017:0527: tomcat6 security update (Moderate)
  • bugzilla
    id 1403824
    title CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhba:tst:20150364001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhba:tst:20150364002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhba:tst:20150364003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20150364004
    • OR
      • AND
        • comment tomcat is earlier than 0:7.0.69-11.el7_3
          oval oval:com.redhat.rhsa:tst:20170935013
        • comment tomcat is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140686006
      • AND
        • comment tomcat-admin-webapps is earlier than 0:7.0.69-11.el7_3
          oval oval:com.redhat.rhsa:tst:20170935019
        • comment tomcat-admin-webapps is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140686016
      • AND
        • comment tomcat-docs-webapp is earlier than 0:7.0.69-11.el7_3
          oval oval:com.redhat.rhsa:tst:20170935015
        • comment tomcat-docs-webapp is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140686014
      • AND
        • comment tomcat-el-2.2-api is earlier than 0:7.0.69-11.el7_3
          oval oval:com.redhat.rhsa:tst:20170935021
        • comment tomcat-el-2.2-api is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140686024
      • AND
        • comment tomcat-javadoc is earlier than 0:7.0.69-11.el7_3
          oval oval:com.redhat.rhsa:tst:20170935009
        • comment tomcat-javadoc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140686012
      • AND
        • comment tomcat-jsp-2.2-api is earlier than 0:7.0.69-11.el7_3
          oval oval:com.redhat.rhsa:tst:20170935007
        • comment tomcat-jsp-2.2-api is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140686018
      • AND
        • comment tomcat-jsvc is earlier than 0:7.0.69-11.el7_3
          oval oval:com.redhat.rhsa:tst:20170935017
        • comment tomcat-jsvc is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140686022
      • AND
        • comment tomcat-lib is earlier than 0:7.0.69-11.el7_3
          oval oval:com.redhat.rhsa:tst:20170935011
        • comment tomcat-lib is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140686010
      • AND
        • comment tomcat-servlet-3.0-api is earlier than 0:7.0.69-11.el7_3
          oval oval:com.redhat.rhsa:tst:20170935023
        • comment tomcat-servlet-3.0-api is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140686020
      • AND
        • comment tomcat-webapps is earlier than 0:7.0.69-11.el7_3
          oval oval:com.redhat.rhsa:tst:20170935005
        • comment tomcat-webapps is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140686008
    rhsa
    id RHSA-2017:0935
    released 2017-04-12
    severity Moderate
    title RHSA-2017:0935: tomcat security update (Moderate)
  • rhsa
    id RHSA-2017:0455
  • rhsa
    id RHSA-2017:0456
  • rhsa
    id RHSA-2017:0457
rpms
  • tomcat6-0:6.0.24-105.el6_8
  • tomcat6-admin-webapps-0:6.0.24-105.el6_8
  • tomcat6-docs-webapp-0:6.0.24-105.el6_8
  • tomcat6-el-2.1-api-0:6.0.24-105.el6_8
  • tomcat6-javadoc-0:6.0.24-105.el6_8
  • tomcat6-jsp-2.1-api-0:6.0.24-105.el6_8
  • tomcat6-lib-0:6.0.24-105.el6_8
  • tomcat6-servlet-2.5-api-0:6.0.24-105.el6_8
  • tomcat6-webapps-0:6.0.24-105.el6_8
  • tomcat-0:7.0.69-11.el7_3
  • tomcat-admin-webapps-0:7.0.69-11.el7_3
  • tomcat-docs-webapp-0:7.0.69-11.el7_3
  • tomcat-el-2.2-api-0:7.0.69-11.el7_3
  • tomcat-javadoc-0:7.0.69-11.el7_3
  • tomcat-jsp-2.2-api-0:7.0.69-11.el7_3
  • tomcat-jsvc-0:7.0.69-11.el7_3
  • tomcat-lib-0:7.0.69-11.el7_3
  • tomcat-servlet-3.0-api-0:7.0.69-11.el7_3
  • tomcat-webapps-0:7.0.69-11.el7_3
refmap via4
bid 94828
confirm
debian
  • DSA-3754
  • DSA-3755
gentoo GLSA-201705-09
mlist
  • [announce] 20170105 [SECURITY][UPDATE] CVE-2016-8745 Apache Tomcat Information Disclosure
  • [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
  • [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
  • [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
  • [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
  • [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
  • [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
  • [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
  • [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
  • [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
  • [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
  • [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
sectrack 1037432
Last major update 15-04-2019 - 16:30
Published 10-08-2017 - 22:29
Back to Top