7.5

CVE-2016-8745

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Tomcat Version 7.0.0
Apache ≫ Tomcat Version 7.0.1
Apache ≫ Tomcat Version 7.0.2
Apache ≫ Tomcat Version 7.0.3
Apache ≫ Tomcat Version 7.0.4
Apache ≫ Tomcat Version 7.0.5
Apache ≫ Tomcat Version 7.0.6
Apache ≫ Tomcat Version 7.0.7
Apache ≫ Tomcat Version 7.0.8
Apache ≫ Tomcat Version 7.0.9
Apache ≫ Tomcat Version 7.0.11
Apache ≫ Tomcat Version 7.0.12
Apache ≫ Tomcat Version 7.0.13
Apache ≫ Tomcat Version 7.0.14
Apache ≫ Tomcat Version 7.0.15
Apache ≫ Tomcat Version 7.0.16
Apache ≫ Tomcat Version 7.0.17
Apache ≫ Tomcat Version 7.0.18
Apache ≫ Tomcat Version 7.0.19
Apache ≫ Tomcat Version 7.0.20
Apache ≫ Tomcat Version 7.0.21
Apache ≫ Tomcat Version 7.0.22
Apache ≫ Tomcat Version 7.0.23
Apache ≫ Tomcat Version 7.0.24
Apache ≫ Tomcat Version 7.0.25
Apache ≫ Tomcat Version 7.0.26
Apache ≫ Tomcat Version 7.0.27
Apache ≫ Tomcat Version 7.0.28
Apache ≫ Tomcat Version 7.0.29
Apache ≫ Tomcat Version 7.0.30
Apache ≫ Tomcat Version 7.0.31
Apache ≫ Tomcat Version 7.0.32
Apache ≫ Tomcat Version 7.0.33
Apache ≫ Tomcat Version 7.0.34
Apache ≫ Tomcat Version 7.0.35
Apache ≫ Tomcat Version 7.0.36
Apache ≫ Tomcat Version 7.0.37
Apache ≫ Tomcat Version 7.0.38
Apache ≫ Tomcat Version 7.0.39
Apache ≫ Tomcat Version 7.0.40
Apache ≫ Tomcat Version 7.0.41
Apache ≫ Tomcat Version 7.0.42
Apache ≫ Tomcat Version 7.0.43
Apache ≫ Tomcat Version 7.0.44
Apache ≫ Tomcat Version 7.0.45
Apache ≫ Tomcat Version 7.0.46
Apache ≫ Tomcat Version 7.0.47
Apache ≫ Tomcat Version 7.0.48
Apache ≫ Tomcat Version 7.0.49
Apache ≫ Tomcat Version 7.0.50
Apache ≫ Tomcat Version 7.0.52
Apache ≫ Tomcat Version 7.0.53
Apache ≫ Tomcat Version 7.0.54
Apache ≫ Tomcat Version 7.0.55
Apache ≫ Tomcat Version 7.0.56
Apache ≫ Tomcat Version 7.0.57
Apache ≫ Tomcat Version 7.0.58
Apache ≫ Tomcat Version 7.0.59
Apache ≫ Tomcat Version 7.0.60
Apache ≫ Tomcat Version 7.0.61
Apache ≫ Tomcat Version 7.0.62
Apache ≫ Tomcat Version 7.0.63
Apache ≫ Tomcat Version 7.0.64
Apache ≫ Tomcat Version 7.0.65
Apache ≫ Tomcat Version 7.0.66
Apache ≫ Tomcat Version 7.0.67
Apache ≫ Tomcat Version 7.0.68
Apache ≫ Tomcat Version 7.0.69
Apache ≫ Tomcat Version 7.0.70
Apache ≫ Tomcat Version 7.0.71
Apache ≫ Tomcat Version 7.0.72
Apache ≫ Tomcat Version 7.0.73
Apache ≫ Tomcat Version 8.0
Apache ≫ Tomcat Version 8.0.0 Update rc1
Apache ≫ Tomcat Version 8.0.0 Update rc10
Apache ≫ Tomcat Version 8.0.0 Update rc3
Apache ≫ Tomcat Version 8.0.0 Update rc5
Apache ≫ Tomcat Version 8.0.1
Apache ≫ Tomcat Version 8.0.2
Apache ≫ Tomcat Version 8.0.3
Apache ≫ Tomcat Version 8.0.4
Apache ≫ Tomcat Version 8.0.5
Apache ≫ Tomcat Version 8.0.6
Apache ≫ Tomcat Version 8.0.7
Apache ≫ Tomcat Version 8.0.8
Apache ≫ Tomcat Version 8.0.9
Apache ≫ Tomcat Version 8.0.10
Apache ≫ Tomcat Version 8.0.11
Apache ≫ Tomcat Version 8.0.12
Apache ≫ Tomcat Version 8.0.13
Apache ≫ Tomcat Version 8.0.14
Apache ≫ Tomcat Version 8.0.15
Apache ≫ Tomcat Version 8.0.16
Apache ≫ Tomcat Version 8.0.17
Apache ≫ Tomcat Version 8.0.18
Apache ≫ Tomcat Version 8.0.19
Apache ≫ Tomcat Version 8.0.20
Apache ≫ Tomcat Version 8.0.21
Apache ≫ Tomcat Version 8.0.22
Apache ≫ Tomcat Version 8.0.23
Apache ≫ Tomcat Version 8.0.24
Apache ≫ Tomcat Version 8.0.25
Apache ≫ Tomcat Version 8.0.26
Apache ≫ Tomcat Version 8.0.27
Apache ≫ Tomcat Version 8.0.28
Apache ≫ Tomcat Version 8.0.29
Apache ≫ Tomcat Version 8.0.30
Apache ≫ Tomcat Version 8.0.31
Apache ≫ Tomcat Version 8.0.32
Apache ≫ Tomcat Version 8.0.33
Apache ≫ Tomcat Version 8.0.34
Apache ≫ Tomcat Version 8.0.35
Apache ≫ Tomcat Version 8.0.36
Apache ≫ Tomcat Version 8.0.37
Apache ≫ Tomcat Version 8.0.38
Apache ≫ Tomcat Version 8.0.39
Apache ≫ Tomcat Version 8.5.0
Apache ≫ Tomcat Version 8.5.1
Apache ≫ Tomcat Version 8.5.2
Apache ≫ Tomcat Version 8.5.3
Apache ≫ Tomcat Version 8.5.4
Apache ≫ Tomcat Version 8.5.5
Apache ≫ Tomcat Version 8.5.6
Apache ≫ Tomcat Version 8.5.7
Apache ≫ Tomcat Version 8.5.8
Apache ≫ Tomcat Version 9.0.0 Update milestone1
Apache ≫ Tomcat Version 9.0.0 Update milestone10
Apache ≫ Tomcat Version 9.0.0 Update milestone11
Apache ≫ Tomcat Version 9.0.0 Update milestone12
Apache ≫ Tomcat Version 9.0.0 Update milestone13
Apache ≫ Tomcat Version 9.0.0 Update milestone2
Apache ≫ Tomcat Version 9.0.0 Update milestone3
Apache ≫ Tomcat Version 9.0.0 Update milestone4
Apache ≫ Tomcat Version 9.0.0 Update milestone5
Apache ≫ Tomcat Version 9.0.0 Update milestone6
Apache ≫ Tomcat Version 9.0.0 Update milestone7
Apache ≫ Tomcat Version 9.0.0 Update milestone8
Apache ≫ Tomcat Version 9.0.0 Update milestone9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 16.04% 0.965
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
https://security.gentoo.org/glsa/201705-09
Third Party Advisory
VDB Entry
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
http://rhn.redhat.com/errata/RHSA-2017-0457.html
https://access.redhat.com/errata/RHSA-2017:0455
https://access.redhat.com/errata/RHSA-2017:0456
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
http://rhn.redhat.com/errata/RHSA-2017-0527.html
https://access.redhat.com/errata/RHSA-2017:0935
http://www.debian.org/security/2017/dsa-3754
http://www.debian.org/security/2017/dsa-3755
http://www.securityfocus.com/bid/94828
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037432
Third Party Advisory
VDB Entry
https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4%40%3Cannounce.tomcat.apache.org%3E
https://security.netapp.com/advisory/ntap-20180607-0002/