Bug 1015119 (CVE-2016-8745) - VUL-0: CVE-2016-8745: tomcat: Apache Tomcat Information Disclosure
Summary: VUL-0: CVE-2016-8745: tomcat: Apache Tomcat Information Disclosure
Status: RESOLVED UPSTREAM
Alias: CVE-2016-8745
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Bo Maryniuk
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/177431/
Whiteboard: CVSSv3:RedHat:CVE-2016-8745:7.5:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2016-12-12 12:31 UTC by Marcus Meissner
Modified: 2019-05-29 07:26 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2016-12-12 12:31:40 UTC
CVE-2016-8745

CVE-2016-8745 Apache Tomcat Information Disclosure

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Apache Tomcat 9.0.0.M1 to 9.0.0.M13
Apache Tomcat 8.5.0 to 8.5.8
Earlier versions are not affected.

Description
The refactoring of the Connector code for 8.5.x onwards introduced a
regression in the error handling of the send file code for the NIO HTTP
connector. An error during send file processing resulted in the current
Processor object being added to the Processor cache multiple times. This
in turn meant that the same Processor could be used for concurrent
requests. Sharing a Processor can result in information leakage between
requests including, not not limited to, session ID and the response body.

Mitigation
Users of the NIO HTTP connector with the affected versions should apply
one of the following mitigations
- Switch to the NIO2 HTTP or APR HTTP connector
- Disable send file
- Upgrade to Apache Tomcat 9.0.0.M15 or later
  (Apache Tomcat 9.0.0.M14 has the fix but was not released)
- Upgrade to Apache Tomcat 8.5.9 or later

Credit:
This issue was reported publicly as Bug 60409 [1] and the security
implications identified by the Tomcat security team.

References:
[1] https://bz.apache.org/bugzilla/show_bug.cgi?id=60409
[2] http://tomcat.apache.org/security-9.html
[3] http://tomcat.apache.org/security-8.html


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8745
http://seclists.org/oss-sec/2016/q4/654
Comment 1 Marcus Meissner 2016-12-12 12:33:08 UTC
8.0 is our newest tomcat - closing
Comment 2 Swamp Workflow Management 2017-05-10 16:10:12 UTC
SUSE-SU-2017:1229-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1015119,1033447,1033448
CVE References: CVE-2016-8745,CVE-2017-5647,CVE-2017-5648
Sources used:
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    tomcat-8.0.43-23.1
SUSE Linux Enterprise Server 12-SP2 (src):    tomcat-8.0.43-23.1
Comment 3 Swamp Workflow Management 2017-05-15 19:24:44 UTC
openSUSE-SU-2017:1292-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1015119,1033447,1033448
CVE References: CVE-2016-8745,CVE-2017-5647,CVE-2017-5648
Sources used:
openSUSE Leap 42.2 (src):    tomcat-8.0.43-6.7.1
openSUSE Leap 42.1 (src):    tomcat-8.0.43-17.1
Comment 4 Swamp Workflow Management 2017-05-23 19:12:00 UTC
SUSE-SU-2017:1382-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1015119,1033447,1033448
CVE References: CVE-2016-8745,CVE-2017-5647,CVE-2017-5648
Sources used:
SUSE Linux Enterprise Server 12-SP1 (src):    tomcat-8.0.43-10.19.1
Comment 5 Swamp Workflow Management 2017-06-21 10:11:25 UTC
SUSE-SU-2017:1632-1: An update that solves 10 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1007853,1007854,1007855,1007857,1007858,1011805,1011812,1015119,1033448,1036642,988489
CVE References: CVE-2016-0762,CVE-2016-5018,CVE-2016-5388,CVE-2016-6794,CVE-2016-6796,CVE-2016-6797,CVE-2016-6816,CVE-2016-8735,CVE-2016-8745,CVE-2017-5647
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    tomcat6-6.0.53-0.56.1
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    tomcat6-6.0.53-0.56.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    tomcat6-6.0.53-0.56.1
Comment 6 Swamp Workflow Management 2017-06-23 13:10:56 UTC
SUSE-SU-2017:1660-1: An update that fixes 12 vulnerabilities is now available.

Category: security (important)
Bug References: 1007853,1007854,1007855,1007857,1007858,1011805,1011812,1015119,1033447,1033448,986359,988489
CVE References: CVE-2016-0762,CVE-2016-3092,CVE-2016-5018,CVE-2016-5388,CVE-2016-6794,CVE-2016-6796,CVE-2016-6797,CVE-2016-6816,CVE-2016-8735,CVE-2016-8745,CVE-2017-5647,CVE-2017-5648
Sources used:
SUSE Linux Enterprise Server for SAP 12 (src):    tomcat-7.0.78-7.13.4
SUSE Linux Enterprise Server 12-LTSS (src):    tomcat-7.0.78-7.13.4