PT-2017-9778 · Apache · Apache Tomcat

Published 2017-01-16 · Updated 2024-10-15 · CVE-2016-8747

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.7 through 8.5.9 Apache Tomcat versions 9.0.0.M11 through 9.0.0.M15

Description An information disclosure issue was discovered in Apache Tomcat in reverse-proxy configurations, allowing remote attackers to read data intended for a different request. The issue is caused by a regression introduced by the refactoring to make wider use of ByteBuffer, which could cause information to leak between requests on the same connection. All HTTP connector variants are affected.

Recommendations For Apache Tomcat versions 8.5.7 through 8.5.9, update to a version outside of this range to resolve the issue. For Apache Tomcat versions 9.0.0.M11 through 9.0.0.M15, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting the use of HTTP connector variants to minimize the risk of information leakage between users.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-8747

GHSA-FJWP-R6FM-Q6QW

Affected Products

Apache Tomcat

References · 30

• https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E · Patch
• https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E · Patch
• https://osv.dev/vulnerability/GHSA-fjwp-r6fm-q6qw · Vendor Advisory
• https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E · Patch
• https://osv.dev/vulnerability/CVE-2016-8747 · Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=1774161 · Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=1774166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8747 · Security Note
• https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E · Patch
• http://tomcat.apache.org/security-8.html · Vendor Advisory
• https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E · Patch
• https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E · Patch
• http://tomcat.apache.org/security-9.html · Vendor Advisory
• https://github.com/apache/tomcat · Note
• https://github.com/apache/tomcat/commit/452c8094a665ef6375530e81c033da4eeb2e4865 · Note