PT-2018-3242 · Apache+6 · Apache Tomcat+6
Publicado
2018-06-26
·
Atualizado
2024-06-15
·
CVE-2018-8037
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 8.5.5 through 8.5.31
Apache Tomcat versions 9.0.0.M9 through 9.0.9
Description
The issue is caused by synchronization errors when using a shared resource, which could allow a remote attacker to disclose protected information. A race condition exists when an async request is completed by the application at the same time as the container triggers the async timeout, potentially resulting in a user seeing a response intended for another user. An additional issue is present in the NIO and NIO2 connectors that do not correctly track the closure of the connection when an async request is completed by the application and timed out by the container at the same time.
Recommendations
For Apache Tomcat versions 8.5.5 through 8.5.31, update to a version outside of this range to resolve the issue.
For Apache Tomcat versions 9.0.0.M9 through 9.0.9, update to a version outside of this range to resolve the issue.
As a temporary workaround, consider restricting access to the NIO and NIO2 connectors until a patch is available.
Exploit
Correção
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Apache Tomcat
Centos
Red Hat
Rocky Linux
Suse