Bugzilla – Bug 1015119
VUL-0: CVE-2016-8745: tomcat: Apache Tomcat Information Disclosure
Last modified: 2019-05-29 07:26:01 UTC
CVE-2016-8745 CVE-2016-8745 Apache Tomcat Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M13 Apache Tomcat 8.5.0 to 8.5.8 Earlier versions are not affected. Description The refactoring of the Connector code for 8.5.x onwards introduced a regression in the error handling of the send file code for the NIO HTTP connector. An error during send file processing resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. Mitigation Users of the NIO HTTP connector with the affected versions should apply one of the following mitigations - Switch to the NIO2 HTTP or APR HTTP connector - Disable send file - Upgrade to Apache Tomcat 9.0.0.M15 or later (Apache Tomcat 9.0.0.M14 has the fix but was not released) - Upgrade to Apache Tomcat 8.5.9 or later Credit: This issue was reported publicly as Bug 60409 [1] and the security implications identified by the Tomcat security team. References: [1] https://bz.apache.org/bugzilla/show_bug.cgi?id=60409 [2] http://tomcat.apache.org/security-9.html [3] http://tomcat.apache.org/security-8.html References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8745 http://seclists.org/oss-sec/2016/q4/654
8.0 is our newest tomcat - closing
SUSE-SU-2017:1229-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1015119,1033447,1033448 CVE References: CVE-2016-8745,CVE-2017-5647,CVE-2017-5648 Sources used: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): tomcat-8.0.43-23.1 SUSE Linux Enterprise Server 12-SP2 (src): tomcat-8.0.43-23.1
openSUSE-SU-2017:1292-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1015119,1033447,1033448 CVE References: CVE-2016-8745,CVE-2017-5647,CVE-2017-5648 Sources used: openSUSE Leap 42.2 (src): tomcat-8.0.43-6.7.1 openSUSE Leap 42.1 (src): tomcat-8.0.43-17.1
SUSE-SU-2017:1382-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1015119,1033447,1033448 CVE References: CVE-2016-8745,CVE-2017-5647,CVE-2017-5648 Sources used: SUSE Linux Enterprise Server 12-SP1 (src): tomcat-8.0.43-10.19.1
SUSE-SU-2017:1632-1: An update that solves 10 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1007853,1007854,1007855,1007857,1007858,1011805,1011812,1015119,1033448,1036642,988489 CVE References: CVE-2016-0762,CVE-2016-5018,CVE-2016-5388,CVE-2016-6794,CVE-2016-6796,CVE-2016-6797,CVE-2016-6816,CVE-2016-8735,CVE-2016-8745,CVE-2017-5647 Sources used: SUSE Linux Enterprise Server 11-SP4 (src): tomcat6-6.0.53-0.56.1 SUSE Linux Enterprise Server 11-SP3-LTSS (src): tomcat6-6.0.53-0.56.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): tomcat6-6.0.53-0.56.1
SUSE-SU-2017:1660-1: An update that fixes 12 vulnerabilities is now available. Category: security (important) Bug References: 1007853,1007854,1007855,1007857,1007858,1011805,1011812,1015119,1033447,1033448,986359,988489 CVE References: CVE-2016-0762,CVE-2016-3092,CVE-2016-5018,CVE-2016-5388,CVE-2016-6794,CVE-2016-6796,CVE-2016-6797,CVE-2016-6816,CVE-2016-8735,CVE-2016-8745,CVE-2017-5647,CVE-2017-5648 Sources used: SUSE Linux Enterprise Server for SAP 12 (src): tomcat-7.0.78-7.13.4 SUSE Linux Enterprise Server 12-LTSS (src): tomcat-7.0.78-7.13.4