PT-2017-9778 · Apache · Apache Tomcat

CVE-2016-8747 · Publicado 2017-01-16 · Atualizado 2024-10-15

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.7 through 8.5.9 Apache Tomcat versions 9.0.0.M11 through 9.0.0.M15

Description An information disclosure issue was discovered in Apache Tomcat in reverse-proxy configurations, allowing remote attackers to read data intended for a different request. The issue is caused by a regression introduced by the refactoring to make wider use of ByteBuffer, which could cause information to leak between requests on the same connection. All HTTP connector variants are affected.

Recommendations For Apache Tomcat versions 8.5.7 through 8.5.9, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 9.0.0.M11 through 9.0.0.M15, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting the use of HTTP connector variants to minimize the risk of information leakage between users.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-8747

GHSA-FJWP-R6FM-Q6QW

Produtos afetados

Apache Tomcat

Referências · 30

• https://github.com/apache/tomcat · Nota
• https://github.com/apache/tomcat/commit/452c8094a665ef6375530e81c033da4eeb2e4865 · Nota
• https://github.com/apache/tomcat/commit/9601a937ff3b7ef5d04b2a0e950d0e44e1bb4cbd · Nota
• http://tomcat.apache.org/security-8.html · Aviso do Fabricante
• https://t.me/cvenotify/62951 · Publicação no Telegram
• https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E · Correção
• https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E · Nota
• https://security.netapp.com/advisory/ntap-20180614-0002 · Nota
• http://tomcat.apache.org/security-9.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-8747 · Nota de Segurança
• https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E · Correção
• https://tomcat.apache.org/security-8 · Nota
• https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E · Correção
• http://svn.apache.org/viewvc?view=revision&revision=1774166 · Aviso do Fabricante
• https://web.archive.org/web/20200227183332/http://securityfocus.com/bid/96895 · Nota