CVE-2016-8745 Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat
HighCVSS 7.5
EPSS 16.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat/tomcat-util(Maven) | >= 9.0.0.M1, < 9.0.0.M14 | 9.0.0.M14 |
| org.apache.tomcat/tomcat-util(Maven) | = 9.0.0.M1 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 9.0.0.M10 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 9.0.0.M11 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 9.0.0.M13 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 9.0.0.M3 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 9.0.0.M4 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 9.0.0.M6 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 9.0.0.M8 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 9.0.0.M9 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | >= 8.5.0, < 8.5.9 | 8.5.9 |
| org.apache.tomcat/tomcat-util(Maven) | = 8.5.0 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.5.2 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.5.3 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.5.4 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.5.5 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.5.6 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.5.8 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | >= 8.0.0-RC1, < 8.0.41 | 8.0.41 |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.0-RC1 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.0-RC10 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.0-RC3 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.0-RC5 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.1 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.11 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.12 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.14 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.15 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.17 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.18 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.20 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.21 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.22 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.23 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.24 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.26 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.27 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.28 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.29 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.3 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.30 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.32 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.33 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.35 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.36 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.37 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.38 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.39 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.5 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.8 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 8.0.9 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | >= 7.0.0, < 7.0.75 | 7.0.75 |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.0 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.11 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.12 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.14 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.16 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.19 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.2 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.20 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.21 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.22 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.23 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.25 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.26 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.27 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.28 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.29 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.30 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.32 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.33 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.34 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.35 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.37 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.39 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.4 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.40 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.41 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.42 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.47 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.5 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.50 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.52 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.53 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.54 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.55 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.56 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.57 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.59 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.6 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.61 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.62 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.63 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.64 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.65 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.67 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.68 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.69 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.70 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.72 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.73 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | = 7.0.8 | No fix listed |
| org.apache.tomcat/tomcat-util(Maven) | >= 6.0.16, < 6.0.50 | 6.0.50 |
| apache tomcat | = 7.0.0 | No fix listed |
| apache tomcat | = 7.0.1 | No fix listed |
| apache tomcat | = 7.0.2 | No fix listed |
| apache tomcat | = 7.0.3 | No fix listed |
| apache tomcat | = 7.0.4 | No fix listed |
| apache tomcat | = 7.0.5 | No fix listed |
| apache tomcat | = 7.0.6 | No fix listed |
| apache tomcat | = 7.0.7 | No fix listed |
| apache tomcat | = 7.0.8 | No fix listed |
| apache tomcat | = 7.0.9 | No fix listed |
| apache tomcat | = 7.0.11 | No fix listed |
| apache tomcat | = 7.0.12 | No fix listed |
| apache tomcat | = 7.0.13 | No fix listed |
| apache tomcat | = 7.0.14 | No fix listed |
| apache tomcat | = 7.0.15 | No fix listed |
| apache tomcat | = 7.0.16 | No fix listed |
| apache tomcat | = 7.0.17 | No fix listed |
| apache tomcat | = 7.0.18 | No fix listed |
| apache tomcat | = 7.0.19 | No fix listed |
| apache tomcat | = 7.0.20 | No fix listed |
| apache tomcat | = 7.0.21 | No fix listed |
| apache tomcat | = 7.0.22 | No fix listed |
| apache tomcat | = 7.0.23 | No fix listed |
| apache tomcat | = 7.0.24 | No fix listed |
| apache tomcat | = 7.0.25 | No fix listed |
| apache tomcat | = 7.0.26 | No fix listed |
| apache tomcat | = 7.0.27 | No fix listed |
| apache tomcat | = 7.0.28 | No fix listed |
| apache tomcat | = 7.0.29 | No fix listed |
| apache tomcat | = 7.0.30 | No fix listed |
| apache tomcat | = 7.0.31 | No fix listed |
| apache tomcat | = 7.0.32 | No fix listed |
| apache tomcat | = 7.0.33 | No fix listed |
| apache tomcat | = 7.0.34 | No fix listed |
| apache tomcat | = 7.0.35 | No fix listed |
| apache tomcat | = 7.0.36 | No fix listed |
| apache tomcat | = 7.0.37 | No fix listed |
| apache tomcat | = 7.0.38 | No fix listed |
| apache tomcat | = 7.0.39 | No fix listed |
| apache tomcat | = 7.0.40 | No fix listed |
| apache tomcat | = 7.0.41 | No fix listed |
| apache tomcat | = 7.0.42 | No fix listed |
| apache tomcat | = 7.0.43 | No fix listed |
| apache tomcat | = 7.0.44 | No fix listed |
| apache tomcat | = 7.0.45 | No fix listed |
| apache tomcat | = 7.0.46 | No fix listed |
| apache tomcat | = 7.0.47 | No fix listed |
| apache tomcat | = 7.0.48 | No fix listed |
| apache tomcat | = 7.0.49 | No fix listed |
| apache tomcat | = 7.0.50 | No fix listed |
| apache tomcat | = 7.0.52 | No fix listed |
| apache tomcat | = 7.0.53 | No fix listed |
| apache tomcat | = 7.0.54 | No fix listed |
| apache tomcat | = 7.0.55 | No fix listed |
| apache tomcat | = 7.0.56 | No fix listed |
| apache tomcat | = 7.0.57 | No fix listed |
| apache tomcat | = 7.0.58 | No fix listed |
| apache tomcat | = 7.0.59 | No fix listed |
| apache tomcat | = 7.0.60 | No fix listed |
| apache tomcat | = 7.0.61 | No fix listed |
| apache tomcat | = 7.0.62 | No fix listed |
| apache tomcat | = 7.0.63 | No fix listed |
| apache tomcat | = 7.0.64 | No fix listed |
| apache tomcat | = 7.0.65 | No fix listed |
| apache tomcat | = 7.0.66 | No fix listed |
| apache tomcat | = 7.0.67 | No fix listed |
| apache tomcat | = 7.0.68 | No fix listed |
| apache tomcat | = 7.0.69 | No fix listed |
| apache tomcat | = 7.0.70 | No fix listed |
| apache tomcat | = 7.0.71 | No fix listed |
| apache tomcat | = 7.0.72 | No fix listed |
| apache tomcat | = 7.0.73 | No fix listed |
| apache tomcat | = 8.0 | No fix listed |
| apache tomcat | = 8.0.0-rc1 | No fix listed |
| apache tomcat | = 8.0.0-rc10 | No fix listed |
| apache tomcat | = 8.0.0-rc3 | No fix listed |
| apache tomcat | = 8.0.0-rc5 | No fix listed |
| apache tomcat | = 8.0.1 | No fix listed |
| apache tomcat | = 8.0.2 | No fix listed |
| apache tomcat | = 8.0.3 | No fix listed |
| apache tomcat | = 8.0.4 | No fix listed |
| apache tomcat | = 8.0.5 | No fix listed |
| apache tomcat | = 8.0.6 | No fix listed |
| apache tomcat | = 8.0.7 | No fix listed |
| apache tomcat | = 8.0.8 | No fix listed |
| apache tomcat | = 8.0.9 | No fix listed |
| apache tomcat | = 8.0.10 | No fix listed |
| apache tomcat | = 8.0.11 | No fix listed |
| apache tomcat | = 8.0.12 | No fix listed |
| apache tomcat | = 8.0.13 | No fix listed |
| apache tomcat | = 8.0.14 | No fix listed |
| apache tomcat | = 8.0.15 | No fix listed |
| apache tomcat | = 8.0.16 | No fix listed |
| apache tomcat | = 8.0.17 | No fix listed |
| apache tomcat | = 8.0.18 | No fix listed |
| apache tomcat | = 8.0.19 | No fix listed |
| apache tomcat | = 8.0.20 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- RHSA-2017:0455 vendor-advisory
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- lists.apache.org
- GLSA-201705-09 third-party-advisory vdb-entry vendor-advisory
- security.netapp.com
- web.archive.org
- web.archive.org
- RHSA-2017:0456 vendor-advisory
- RHSA-2017:0935 vendor-advisory
- github.com product
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [announce] 20170105 [SECURITY][UPDATE] CVE-2016-8745 Apache Tomcat Information Disclosure mailing-list
- lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- lists.apache.org
- RHSA-2017:0457 vendor-advisory
- RHSA-2017:0527 vendor-advisory
- DSA-3754 vendor-advisory
- DSA-3755 vendor-advisory
- www.oracle.com
- www.oracle.com
- 94828 third-party-advisory vdb-entry
- 1037432 third-party-advisory vdb-entry
- github.com
- Debian Security Tracker CVE-2016-8745 vendor-advisory