CVE-2016-8745: Race Condition
A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.
Other sources
The following flaw was found in Apache Tomcat:
A bug in the error handling of the send file code for the NIO HTTP connector resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body.
Upstream patch: 6.x: http://svn.apache.org/viewvc?view=revision&revision=1777472 7.x: http://svn.apache.org/viewvc?view=revision&revision=1777471 8.0.x: http://svn.apache.org/viewvc?view=revision&revision=1777469 8.5.x: https://svn.apache.org/viewvc?view=revision&revision=1771857 9.x: https://svn.apache.org/viewvc?view=revision&revision=1771853
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 6.0.50 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 7.0.75 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 8.0.41 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 8.5.9 - Upgrade
Upgrade
maven/org.apache.tomcat:tomcatto a version that resolves this vulnerability.Fixed in 9.0.0.M14 - Upgrade
Upgrade
debian/tomcat9to a version that resolves this vulnerability.Fixed in 9.0.43-2~deb11u10Fixed in 9.0.43-2~deb11u12Fixed in 9.0.70-2Fixed in 9.0.95-1 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.5.9 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 9.0.0. - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 6.0.50 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 7.0.75 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.0.41
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8745?
CVE-2016-8745 is rated as a medium-severity vulnerability with potential impacts on performance and resource management in affected Apache Tomcat versions.
How do I fix CVE-2016-8745?
To resolve CVE-2016-8745, upgrade to the patched versions of Apache Tomcat: 6.0.50, 7.0.75, 8.0.41, 8.5.9, or 9.0.0.M14.
Which versions of Apache Tomcat are affected by CVE-2016-8745?
CVE-2016-8745 affects Apache Tomcat versions 6.0.16 to 6.0.48, 7.0.0 to 7.0.73, 8.0.0-rc1 to 8.0.39, and 8.5.0 to 8.5.8.
What potential impact does CVE-2016-8745 have on Apache Tomcat?
CVE-2016-8745 may lead to multiple instances of the same Processor object being cached, potentially leading to performance degradation.
Is there a workaround for CVE-2016-8745, or is an update required?
While upgrading to the latest secure version is recommended, there are no documented workarounds to mitigate the effects of CVE-2016-8745.