CVE-2013-2071: Infoleak
An information disclosure flaw was found in the way asynchronous context implementation of Apache Tomcat, an Apache Servlet/JSP Engine, performed request information management in certain circumstances (formerly certain elements of a previous request might have been exposed to the current request). If an application used AsyncListeners that threw RuntimeExceptions, a remote attacker could use this flaw to possibly obtain sensitive information.
Upstream bug report: https://issues.apache.org/bugzilla/showbug.cgi?id=54178
Relevant upstream patch (including testcase): http://svn.apache.org/viewvc?view=rev&rev=1471372
Other sources
java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2071?
CVE-2013-2071 is classified as an information disclosure vulnerability within Apache Tomcat.
How do I fix CVE-2013-2071?
To mitigate CVE-2013-2071, upgrade to a patched version of Apache Tomcat beyond the affected 7.0.32 versions.
Which versions of Apache Tomcat are affected by CVE-2013-2071?
CVE-2013-2071 affects Apache Tomcat versions 7.0.0 to 7.0.32.
What type of vulnerabilities are associated with CVE-2013-2071?
CVE-2013-2071 is an information disclosure vulnerability that may reveal elements from previous requests to current requests.
How can I check if my Apache Tomcat is vulnerable to CVE-2013-2071?
You can check your Apache Tomcat version against the affected versions listed for CVE-2013-2071 to determine vulnerability.