vulnwire
7.5high

CVE-2016-8745in critical feed

Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat

Also known as GHSA-w3j5-q8f2-3cqq

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
16.0%
percentile 97%
Public exploits
0
none known

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction (EPSS)

16.04% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub3.07.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat:tomcat-util
>=9.0.0.M1, <9.0.0.M14
>=8.5.0, <8.5.9
>=8.0.0-RC1, <8.0.41
>=7.0.0, <7.0.75
>=6.0.16, <6.0.50
9.0.0.M14
8.5.9
8.0.41
7.0.75
6.0.50

Affected products

  • Apache Software Foundation Apache Tomcat

Classification

Weakness
  • CWE-388 7PK - Errors
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

  • securityfocus.com /bid/94828 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1037432 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • security.gentoo.org /glsa/201705-09 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2017-3236626.html · x_refsource_CONFIRM, x_transferred
  • security.netapp.com /advisory/ntap-20180607-0002/ · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuapr2018-3678067.html · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2017:0935 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2017/dsa-3754 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • rhn.redhat.com /errata/RHSA-2017-0457.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2017/dsa-3755 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • access.redhat.com /errata/RHSA-2017:0455 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • rhn.redhat.com /errata/RHSA-2017-0527.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2017:0456 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.apache.org /thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4%40%3Cannounce.tomcat · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apa · mailing-list, x_refsource_MLIST, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-8745 · advisory
  • github.com /apache/tomcat/commit/143bb466cf96a89e791b7db5626055ea819dad89 · web
  • github.com /apache/tomcat/commit/16a57bc885e212839f1d717b94b01d154a36943a · web
  • github.com /apache/tomcat/commit/cbc9b18a845d3c8c053ac293dffda6c6c19dd92b · web
  • github.com /apache/tomcat80/commit/3dd2fec73e0de1edc1d3eb1c52a01255fdfc84e7 · web
  • lists.apache.org /thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apach · web
  • lists.apache.org /thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apach · web
  • security.netapp.com /advisory/ntap-20180607-0002 · web
  • web.archive.org /web/20200227165932/http://www.securityfocus.com/bid/94828 · web
  • web.archive.org /web/20200517114357/http://www.securitytracker.com/id/1037432 · web
  • github.com /apache/tomcat · package
  • lists.apache.org /thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache · web
  • lists.apache.org /thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.